個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0137/2016/IP

Title: Publicizing friend’s photo on social networking site

Reason: Complaint

Brief:

      In this case, A was a friend of the Complainant. Feeling outraged by how the Complainant badly treated his family members, A posted a photo, which showed both of them, on a social networking site. A was using his user account and through his mobile app to upload the photo to the said site, in addition to leaving his criticism and comments in order to dissuade the Complainant from ill-treating his family.
    The Complainant, however, held the view that A violated the PDPA (Personal Data Protection Act) and asked the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to follow up.

Analysis:

      During the time the photos were published, A had not established any privacy configuration for his account, i.e. under such status the photos were accessible by everyone; therefore the data processing of the current case is subject to the PDPA (Personal Data Protection Act) according to its Article 4(1)(1) and 3(1).
    The personal data processing here should be based on any of the legitimate conditions laid down in Article 6 Loc. cit. Before publicizing the photo, A had not obtained the Complainant’s consent, i.e., without the prerequisite of explicit consent as specified by Article 6. Moreover, the aforesaid photo, accessible freely on the social network site, is not a situation where Paragraph 1 to 4 of Article 6 of the PDPA applies.
     A decided to publicize the Complainant’s photo, as a move to reproach and dissuade him from disrespecting his family—a deviation of simply sharing the photo. A published the photo in order to take up the cudgels for the Complainant’s family members. He did not have any legitimate interests in the incident and also the photo, once allowed for unrestricted access, could have been uncontrollably forwarded by others. Considering the interests of the involved parties, the GPDP holds the view that A’s interests did not precede those of the Complainant, and also his processing was not legitimate according to Article 6(5) of the PDPA.
     In sum, A publicized the personal data of the Complainant online, through the mobile app, violated Article 6 of the PDPA.

Result:

      Since A established unrestricted online access, through his user account, to the Complainant’s personal data on a social networking site, this could lead to uncontrollable access and forwarding of the data by others. Taking into account that this was A’s first violation of the PDPA and his cooperativeness during the investigations, and later he also restricted his account to private access, the GPDP, decided to impose a fine of MOP$8000 according to Article 33(2) of the PDPA.

Reference:
Please refer to Article 3, 4, 6, and 33 of the PDPA.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116