個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0062/2016/IP

Title: A property management company delivered a reminder letter to data subject’s previous workplace to recover debt

Reason: Complaint

Brief:

      A property management company (hereinafter as Company) tried to recover the outstanding management fee from the Complainant of the current case, and therefore sent the reminder letter, which contained the Complainant’s personal data, to his previous workplace. This letter was sent without the Complainant’s consent and he, therefore, asked the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to investigate.

Analysis:

      The information contained in the said letter could lead to identifiability of natural persons, and therefore it qualifies as personal data under Article 4(1)(1) and 3(1) of the PDPA (Personal Data Protection Act). The data processing of the current case, as a consequence, is subject to the PDPA.
    The investigation revealed that the Company provides the management services for the building where the Complainant lives in. For a number of times the Company sent the payment notices to the Complainant or asked the caretaker to inform him the overdue payment while he passed by the building reception. Even having been reminded on several occasions, the Complainant refused to settle the overdue payment.
    Since the Company’s person-in-charge spotted the Complainant working in a certain location, and therefore the former sent a letter to that place. The letter contained the Complainant’s name, address, the amount owed and other information. At the beginning, it was addressed to the Complainant (i.e., to his domicile), but later it was delivered to his workplace and addressed to the person-in-charge and thereby concealing the original addressee’s name and address. As a result, the employing company of the Complainant read the letter and the information therein. In fact, during that time the Complainant had already left the job. Since the current case stemmed from the mentioned debts—a relationship between the Complainant and the Company, and was irrelevant to the Complainant’s job—the former’s employer was not necessarily to be informed. Even though, according to the Company, the letter was sent for debt demand (interpelação), but it knew clearly where his domicile was and it was there, instead of his workplace, where the letter should be delivered to. In addition, the Company has the right to demand the unsettled payment through legal process, instead of sending the letter to the Complainant’s employer during that time. Demanding debt as such could never be a mean to satisfy the legitimate interests of the Company.
    All things considered, the Company sent the letter, containing the personal data of the Complainant to his previous employer, and thus failed to achieve any of the criteria of lawful data processing as Article 6 of the PDPA sets out. As a consequence, this constituted an unlawful processing of data under the same provision.     

Result:

      The Company sent the mentioned letter to the employer and its act violated Article 6 of the PDPA, to which the GPDP decided to impose a fine of MOP$8000, based on Article 33(2) of the same Law.

Reference:
Please refer to Article 3, 4, 6 and 33 of the PDPA.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116