Complaint Case Notes

編號: 0097/2012/IP

標題: Collecting personal data from the minor without the parental consent

立案原因: Report


    The GPDP has received J’s telephone report, stating that when bringing his child to a booth of Bazaar X, they were asked by a staff there to fill in a form for a lucky draw.  Since this form only contained some information for course promotion, and did not contain anything related to the lucky draw, hence J rejected to fill in.  Afterwards, J has known that his child completed the form and provided his contact number and address while J was away.
  J believed that the staff should not have collected data from any children when they were not accompanied by their parents. Furthermore, the data was also not collected for the lucky draw. Thus this may have violated the Personal Data Protection Act (PDPA, or Law 8/2005), therefore he requested the Office for Personal Data Protection (the GPDP) to follow up.


    According to Articles 4(1)(1) and 3(1) of the PDPA, the handling of relevant data in this case is regulated by the PDPA.
  In the reply of the Department B, which is the standing representative of Company A in Hong Kong, it stated that it organized the “Challenge Competition X” in the booth.  Although the form has contained the introduction of the course, in the area for filling in the details it already stated clearly that it was an application form.  The organization asked the participants to provide details like student name, class to be attended, domicile area (Macau/Taipa), email address, contact number, classes to be applied for and the hours concerned, and the purposes of providing such information are to evaluate the result of that day, to verify the participant identities and to inform the winning students.  All these information would be destroyed after notifying the participants of their results by text messages.  Department B’s staff were responsible for the games of the booth; they would clearly reveal their identities and specify that the information, mostly provided by the parents, was collected for the competition.  Since the bazaar was opened to the public, with many participants came with enthusiasm, it has probably causing incomprehensiveness while collecting the minor’s data.  While handling and publishing the data of the enrolled students, Department B has already formulated policies for processing personal data that requires its staff to obtain explicit consent from the data subjects. 
  In normal circumstance, data subjects would voluntarily fill in the competition form and submit it to the organizer for the purpose of joining the competition, it means that the consent was given to the organizer to handle his personal data for the competition purpose, and thus the organizer has the legitimacy pursuant to Article 6 of the PDPA, which is based on the data subjects’ clear consent.
  In this case, since the participants were students, and minors were amongst those whose data was collected. According to Articles 111 to 113 of the Civil Code, as approved by Directive 39/99/M, minors were of incapacity in general circumstances, and their capacity could be compensated by parental rights and custodial rights.
  A further consideration is that, in the scope of protecting personal data, depending on the physical and mental maturity level of the minor, corresponding treatment shall be given.  But in this case, the complainant lodged an anonymous complaint, so it is impossible to base on the age of the data subject to analyze whether his consent is valid or not.
  Department B pointed out that since most participation forms were completed by the parents, the minors’ ability has been supplemented by the parental rights and custodial rights, hence Department B has the legitimacy in handling the minor’s personal data.  However Department B itself could not rule out that some minors joined the competition himself.  If the consent of handling the personal data was obtained from a minor directly, where it does not comply with any of the circumstances in Article 6(1)(5) of the PDPA and Department B processed the personal data without the legitimacy, this may constitute an administrative offense under Article 33(2) of the same Law.
  Since the current case is a report, and the identity of the data subject is not identifiable, as well as the competition has finished, all participating forms have been destroyed, the GPDP is not able to conduct an extensive examination.  Hence, it is also impossible to confirm if any minors participated the contest without being accompanied by their parents.
  Owing to the fact that Department B processed the personal data of the participating students based on the aforementioned purposes, which are legal and appropriate and have direct connection with the competition activities.  Furthermore, as no evidence showed that the data has been used for other irrelevant purposes, thus it did not violate Article 5(1)(2) and Article 5(1)(3) of the PDPA.  In addition, Department B has fully destroyed the data after informing the participants of the result, this also complies with Article 5(1)(5) of the same Law, which governs the storage period of personal data.
  From the samples of the forms, it shows that they have been printed with the words “X Challenge Competition”, “participating form” and “join to win the prizes”.  Such words informed the data subjects that these forms are used for participating in the contest, instead of what J mentioned that they were for course promotion only.  In addition, the parents and students should also be able to tell the identity of Department B while visiting the booth (for example, the booth banner), hence Department B complied with Article 10 of the PDPA regarding the right to information.
  However, one shall consider that the website of Company A in Hong Kong shows that the course was running by franchise, either through partnership or affiliate.  In Macao there are more than 10 organizations carrying similar names as of today, it may cause confusion to others.  Thus, based on the principle of good practices, Department B shall specify its controller identity in its personal data collection statement, and shall lay down the information regarding the processing as clear as possible, so as to avoid misunderstanding.
  Overall, no evidence showed that Department B has violated the Personal Data Protection Act.


    The file has already been closed.  The GPDP has informed J and Department B regarding the investigation result.

Please refer to "Personal Data Protection Act", articles 3, 4, 5, 6 and 33.