個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0122/2019/IP

Title: Negligence of notifying data processing

Reason: Active intervention

Brief:

      The GPDP earlier visited Shop A to investigate its surveillance camera system, followed by, informing it, by writings, on two occasions, to notify its automatic data processing conducted by this system, as required by Article 21(1) of the PDPA (Personal Data Processing Act or Law 8/2005).  However, Shop A did not respond nor notify its data processing to the GPDP, and the latter therefore initiated investigations as this was a suspected violation of the PDPA.

Analysis:

      Under Article 4(1)(1) and 3(1) of the PDPA, the data processing of the current case is subject to the same Law. 
    Shop A, for security purpose, installed the surveillance system in its shop area, which qualify as automatic data processing.  Under Article 21(1) of the PDPA, Shop A should notify the GPDP the said processing within eight days after this has been initiated. 
    When writing twice to Shop A, the GPDP reminded it to discharge the notification obligation within the period required but it never responded.  Later it finally submitted its notification application after the GPDP took further measures.  Shop A explained that it had already submitted information specifying the position of its surveillance system and the screenshots showing the shooting range of the surveillance cameras, and consequently it assumed these were equivalent to a completed notification and therefore ignored the correspondences the GPDP sent out. Should Shop A had fulfilled the requirements the GPDP laid out in the correspondences, the GPDP would not have informed Shop A respectively on two occasions to demand it to notify its data processing, despite its submission of the said information. In the correspondences the GPDP clearly pointed out that Shop A should complete and submit the Personal Data Processing Form (initial application) (Notificação de Tratamento dos Dados Pessoais [Pedido inicial]), and also indicated that this form was downloadable from the GPDP’s website.    
    According to Shop A, the positions of the installed CCTVs and the screenshots of their shooting range have been informed to the GPDP.  Under Article 23 of the PDPA, there is a list of information to be notified to the GPDP for data processing, including the data recipients to be informed, any combination or transfer of data, and how the right of access and right to rectify are exercised by data subjects, and others.  As a consequence, the information as submitted by Shop A, apart from the aforementioned, would not be equivalent to a completed notification.  
    To sum up, the absence of the notification obligation of Shop A, caused by negligence, constituted an administrative offense under Article 21(1) of the PDPA.

Result:

      The GPDP decided to impose a penalty of MOP$10,000, according to Article 32(1)(2) of the PDPA, considering that it was Shop A’s first violation of this Law.

Reference:
Please refer to Article 3, 4, 21, 23 and 32 of the PDPA.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116