Enquiry Case Notes

編號: 0087/2011/RP

標題: Collecting applicants’ personal data


    Macao Pass S. A. consulted GPDP about collecting applicants’ personal data for the launch of the personalized Macao Pass specialized for monthly bus pass holders.


    Under its Articles 4(1)(1) and 3(1), the Personal Data Protection Act (Law 8/2005) governs the data processing of the current case. However, as the said Company failed to provide adequate information, so GPDP could not make detailed analysis or specific recommendations.
  This company stated that it launched this type of Macao Pass card in order to cooperate with the new bus business model and the new monthly bus pass by the Transport Bureau. Generally, the new Macao Pass card has built-in functions as an e-wallet, to add value, report and freeze stolen stored value card, and for card cancellation and money reclaim. Apart from the pre-loaded personal information on the card, it also records information like the holder’s spending habit during its use, for instance. Therefore, this is regarded as a personalized financial product, and relevant terms and conditions apply to its policies of processing personal data and, in principle, should conform to those for other types of personalized Macao Pass card (such as the Macao Pass for Students ).
  Moreover, through the monthly bus pass the public could receive bus subsidies funded by the government, as a consequence, the Transport Bureau should have the rights to decide for the qualifications and conditions of the applicants, and the types of personal data needed for establishing cardholders’ identities. Thus, the Macao Pass S.A. should list out the terms and conditions for applying the monthly bus pass as stipulated by the said Bureau.
  Under Article 21(1) of the Law aforesaid, GPDP should be informed of the automatic processing of the monthly bus pass holders’ personal data. The Macao Pass S.A. should also review whether the notification submitted earlier includes the data of the monthly bus pass, or alternatively to inform GPDP, in writing, to amend or supplement the earlier notification.

Please refer to "Personal Data Protection Act", articles 3,4,21 .