個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0173/2017/IP

Title: Publicizing others’ personal data on the social networking site

Reason: Complaint

Brief:

      This case stemmed from the unauthorized publicizing of the Complainant’s user-account information and phone numbers on a social networking site. Screen capture showing the said information was publicized on Page A, a dedicated page on a social networking site, without the Complainant’s consent, and therefore the latter requested the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to investigate due to the suspected violation of the PDPA.

Analysis:

      Page A, mainly used for online marketing and merchandizing, was established and administered by Mr. X. The said screen capture, published online, revealed the Complainant’s account information and phone numbers, alongside with the profile picture of the Complainant. The Complainant could be identified when all these information are combined together. Pursuant to Article 4(1)(1) and 3(1) of the PDPA, this incident involved personal data processing that is subject to the PDPA.
    Originally, the Complainant expressed his interests in the products on Page A, and used his personal account to contact the administrator there. Later, however, the two parties argued over the pre-order of the goods and the Complainant, through his account, posted on a public discussion group to accuse the dishonesty of Page A, and also called on other viewers to boycott it. Not long after, Mr. X, to defend the goodwill of the page and to respond to the Complainant’s criticism, gave his comments on Page A. In addition, he posted the screen capture of the messages exchanged between them in order to clarify what happened.
    During investigations, the GPDP found out that it was the Complainant who first used his account to post on a public discussion group to criticize Page A. In other words, the argument was exposed to other page viewers by the Complainant in the first place. Mr. X was trying to defend the goodwill of his business and therefore published a post on Page A to refute. Mr. X published the information only to contradict the Complainant and to defend his goodwill, all things considered. In this case, one cannot regard the interests of Mr. X and Page A did not precede those of the Complainant, in the GPDP’s perspectives, and therefore Mr. X achieved the legitimacy condition as laid down in Article 6(5) of the PDPA.
    As mentioned, it was the Complainant that first used his account to publish the said post. Since his account name and profile picture were already made public by himself, the said post by Mr. X would not be an issue. However, in order to clarify Mr. X published on Page A the screen capture, which showed the phone numbers and account information that other viewers might relate them to the Complainant. Despite Mr. X pointed out that the phone numbers were already available online as they had been published on other website, this is no equivalence to such numbers were already known to be used by Complainant. In view of the pre-order argument between the two parties, revealing these numbers is not pertinent even if Mr. X only intended to respond to the Complainant’s public criticism. The unnecessary publicizing of the phone numbers was an excessive disclosure of personal data and violated the principle of proportionality as laid down in Article 5(1)(3) of the PDPA.

Result:

      In order to respond to the criticism left by the Complainant, Mr. X published a post on Page A, this achieved the legitimacy condition as governed by Article 6(5) of the PDPA. However, publishing the Complainant’s phone numbers was off the point, and consequently Mr. X violated Article 5(1)(3) of the PDPA, which governs the principle of proportionality. Based on the aforesaid, the GPDP decided to impose a penalty of MOP$4000 to the Mr. X according to Article 33(1) of the PDPA.

Reference:
Please refer to Article 3, 4, 5, 6, and 33 of the PDPA.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116