Enquiry Case Notes

編號: 0063/2011/RP

標題: Personal data processing involved in “Short-term Food Assistance Programme”


    Social Welfare Bureau and Caritas Macao consulted GPDP about the personal data processing of the Short-term Food Assistance Programme.


    1. According to Article 4(1)(J) of Decree-Law 24/99/M, one of the statutory duties of the Social Welfare Bureau is “to cooperate with the private social institutions, and to provide them with technical and financial assistance in particular through the conclusion of cooperation agreements and trainings”. The Regulations for Inviting Non-profitable Social Service Institutions to Undertake Short-term Food Assistance Programme specifies that “…… it will publicly invite non-profitable social service institutions to undertake this service……” Moreover, the Short-term Food Assistance Programme Cooperation Agreement states clearly that “…… to assist the institutions to operate such services by providing financial assistance……” Therefore, due to the fact that the Social Welfare Bureau only provides financial assistance to Caritas for whom to become an institution under the Short-term Food Assistance Programme. This does not mean that Social Welfare Bureau outsourced this service to Caritas. Moreover, it has the right to decide the processing purposes and methods of the personal data of the service applicants, so it is an independent data controller instead of a sub-contractor of the Social Service Bureau.
  2. According to the regulations and cooperation agreement of the service aforementioned, and the information on Carita’s Application Form of the Short-term Food Assistance Programme showed that the applicants have consented Caritas to provide their personal data to the Social Welfare Bureau. Therefore, on the personal data processing of this service, the Social Welfare Bureau is the data recipient, in other words, “the entity to whom data are disclosed with the data subjects’ consent”.
  3. According to the data provide by the Social Welfare Bureau, in order to verify whether an applicant satisfies the application conditions, he could check with the said Bureau personally, or authorize Caritas, in writing, to verify the relevant conditions through the Short-term Food Assistance Programme Support System, established by the Social Welfare Bureau. For requests of proof or verifications with the said Bureau by Caritas, as authorized by the data subjects, the former is an independent data controller, on the contrary that Caritas is an representative or trustee of the data subjects. In other words, the Social Welfare Bureau only passed the data to the data subjects, rather than transferring the data to any third party. Therefore, “combination of data” is not found.
  4. Concerning data security and confidentiality, according to the data provided by Social Welfare Bureau, including the types of data, the relevant organizational and technical measures, etc., the measures herein are in line with Article 15 of the Personal Data Protection Act. As a data controller, the said Bureau should continue to assess and examine such measures, thus ensuring the level of security for data processing corresponds to that as stipulated by laws.

Please refer to "Personal Data Protection Act", articles 3,4,15 .