Complaint Case Notes

編號: 0078/2012/IP

標題: An employee suspected that he was blacklisted and his data was transferred to other casinos after damaging a slot machine

立案原因: Complaint


    Resident X stated that after an interview with Casino A, he was told by its staff that the Casino would not hire him as he was blacklisted.  X has damaged the slot machine located in the area of Casino B, and his identity card data was recorded immediately afterwards.
  X was of the view that, Casino B has blacklisted him, and transferred his data to Casino A, which is suspected to have violated the PDPA, therefore he requested the GPDP to follow up.


    According to Articles 4(1)(1) and 3(1) of the Personal Data Protection Act (PDPA or Law 8/2005), this Law regulates the data processing of the current case.
  Based on the data obtained by the GPDP from Department C and six casinos in Macao, no evidence showed that the casinos have jointly established a blacklist, nor any interconnected database to communicate the data of the current employees, ex-employees or the applicants.
  According to Casino A’s reply, it was informed by Y and Z, its staff members who once worked Casino B, about X’s damaging of the slot machine.
  The GPDP was of the view that, because X has damaged the slot machine in the casino, so his information was recorded by Casino B.  Afterwards, Casino A processed X’s data when he applied for a position.  Casino B and Casino A have their own rights in deciding the processing purposes and processing methods, therefore, they are considered as the data controllers of the case. 
  In regard to establishing and forwarding the blacklist, according to Casino B’s reply, although X has previously damaged the slot machine and his information was recorded, this did not mean that X has been blacklisted and his data was communicated to other casinos.  In addition, Casino A also stated it has not learnt from Casino B of X’s information.  Hence, X’s accusation against Casino B was unsubstantiated.
  The GPDP took the view that, in the recruitment process, Casino A shall observe Law 8/96/M and Law 16/2001, to examine that whether the applicant has been banned from entering casinos by judicial decision or administrative decision and to check whether his conduct is honest, fair, etc.  The purpose of such checks is lawful and necessary for enhancing its legitimate interests.
  During the application process, X has authorized Casino A to investigate and to verify the information which he provided.  In addition, X agreed that he would disclose all the relevant information to the said Casino and would waive the responsibilities of those who published his information.  Since X has already authorized Casino A to verify his suitability for the relevant position by obtaining his information from the third parties, Casino A obtained X’s information from his two employees.  Therefore, Casino A has achieved the legitimacy of processing A’s data, as well as the legitimacy based on the data subject’s consent as governed by Article 6 of the PDPA, thus complying with Article 8(2) idem. 
  As to the Articles 18 and 41 of the PDPA, regarding the knowledge of one’s personal data during Y and Z’s employment with Casino B, they are bound by the professional secrecy even if their duties with this Casino have ended.  However, provided that X has made the above mentioned authority and declaration, the fact that Y and Z informed Casino A in relation to X’s previous damage of the slot machine falls within the scope authorized by X.  Therefore, it failed to prove that Y and Z violated the duty of professional secrecy.
  To sum up, no evidence showed the blacklist did exist, which was used to communicate the mentioned data between the casinos.  The processing of X’s data by Casino A also complies with the PDPA.


    The GPDP has notified Casino A, Casino B and X regarding the above mentioned analysis and the decision.  This case has been closed.

Please refer to "Personal Data Protection Act", articles 3, 4, 6, 8, 18 and 41.