個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0165/2017/IP

Title: A property management company disclosed contact numbers of a residential unit resident

Reason: Complaint

Brief:

      In the current case, the Complainant disclosed his contact numbers to Company A, a property management company, in order to solve the water seepage problem of his flat. Not long after, a resident of another residential unit of the same housing estate, Mr. X, directly called the Complainant, in the hope to discuss the seepage problem of his flat. The Complainant believed that Company A, without his consent, had passed his contact numbers to the said resident. Therefore he asked the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to investigate Company A’s suspected violation of the PDPA (Personal Data Protection Act or Law 8/2005).

Analysis:

      The data processing of this case should be subject to the PDPA under its Article 4(1)(1) and 3(1).
    According to Article 6 idem, a data controller shall have fulfilled any of the legitimate conditions before carrying out a data processing. Company A, prior to disclosing the Complainant’s contact numbers to others, did not obtain his consent, which was a non-compliance of Article 6 of the PDPA, requiring unambiguous consent from the data subject. Furthermore, the data processing of the current case was not conducted for contractual performance or steps for entering into a contract, laid down in Paragraph 1 of the same Article, not to mention for compliance with a legal obligation as laid down in Paragraph 2 idem, nor the processing was conducted “for the protection of the vital interests of the data subject if the latter is physically or legally incapable of giving his consent”, pursuant to Paragraph 3 idem. Beyond that, Company A was not a public authority nor was it acting for a task for public interests, therefore having failed to legitimize its data processing according to Paragraph 4 of the Article last-said.
    Due to the seepage problem, Company A, being the property management company of the said housing estate, obtained the Complainant’s contact numbers. These numbers, however, were revealed to Mr. X, who requested private discussions with the Complainant to resolve the problem. In fact, they actually live in different residential units of different buildings, and later it was discovered that water seepage did not originate from the Complainant’s flat. As a consequence, Mr. X never called him again. The GPDP, after much rumination, could not conclude that Company A or Mr. X has preceding interests over those of the Complainant, therefore Company A failed to process the data upon the legitimate condition set forth in Paragraph 5 of Article 6.
     In sum, Company A failed to legitimize its data processing upon the conditions set forth in Article 6 of Law 8/2005, and constituted an administrative offense as a consequence.

Result:

      Taking into account that it was Company A’s first violation and its cooperativeness during investigations, and the fact that Mr. X called the Complainant only once, the GPDP decided to impose a penalty of MOP$8000, according to Article 33(2) of the PDPA.

Reference:
Please refer to 3, 4, 6, 33 of the PDPA.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116