個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0041/2009/IP

Title: Staff in a museum recorded the Macau Resident Identity Cards (BIR) numbers of visitors

Reason: Reports

Brief:

    Resident I stated that in Museum A there was a price differentiation policy in its admission prices, and visitors were asked to provide their Macau Resident Identity Cards (BIR), student cards and other personal identification documents to the museum staff to register and confirm that they were eligible to receive the discount or fee waiver.
  Resident I considered that BIR numbers were irrelevant for the purposes of verifying the ages of the visitors and that the museum staff did not need to register the document number. In addition to this, resident I stated that there was no “Personal Information Collection Statement” or any similar notifications posted at the museum premises. Resident I considered that the registration of the BIR numbers was a potential breach of the terms of the “Personal Data Protection Act” and consequently filed a report to this Office (GPDP).

Analysis:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  Museum A explained that it registered the names and BIR numbers of the visitors for statistical purposes. However, the Museum reviewed and amended its rules after the complaints. The visitors then could only display their identification documents. Museum A no longer collected and registered any of their personal data.
  GPDP believed that Museum A registered the BIR numbers of the visitors not only to verify whether they were eligible to purchase tickets at a discount price or for free, but also for financial supervision purposes; which was legitimate purpose for data processing. The data processing observed the principle of proportionality. If visitors chose to obtain a discount or fee waiver, and this act should be considered as the visitors giving their tacit consent or the execution of a contract in which the museum and visitors were parties. GPDP consequently considered that the verification of the visitors’ identities to confirm that such persons were eligible to receive the discount or fee waiver was a legitimate and necessary act.
  Regarding the lack of a “Personal Information Collection Statement” or a similar notice in Museum A, another issue raised by Resident I, according to the terms of article 10 of the “Personal Data Protection Act”, Museum A was obliged to provide the information required by law to satisfy the data subjects’ right to information. However, the law does not force museum A to post a “Personal Information Collection Statement” or any similar notice. Museum A had declared that they no longer processed the data in such a way and had implemented a series of measures, including a “Personal Data Collection Statement”, in order to improve their observance of the legal rules on the subject of “right to information” of the visitors.
  In summary, GPDP believed that Museum A’s conduct didn’t entirely conform to the provisions stated in article 10 of the “Personal Data Protection Act” in relation to the right to information, but it did not constitute an administrative offence.

Result:

    GPDP sent an official letter containing the foregoing analysis to Museum A and recommended that it should set a retention period for the preservation of names and BIR numbers collected and registered to “allow people to receive discounts or waivers for the admission fee” so that they could subsequently be blocked, deleted or destroyed in a timely manner.
  Museum A replied, stating that they had accepted the recommendations of GPDP and implemented the appropriate measures.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,10 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116