個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0024/2008/IP

Title: A government agency disclosed personal data of a citizen

Reason: Complaints

Brief:

    Citizen A alleged that the governmental Agency X had improperly provided her copies of ID document to citizen B, enabling B to make use of them in illegal dealings. A claimed that this was a violation of the Personal Data Protection Act and filed a complaint with this Office (GPDP).

Analysis:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  GPDP’s investigation verified that resident B sought help from Agency X for resolving his dissatisfaction with the service provided by resident A’s shop for its sold goods. After some mediation by the Consumer Arbitration Centre (Hereinafter referred to as “the Centre”), A and B entered into an “Agreement on Dispute Settlement” (hereinafter “the Agreement”). However, citizen A defaulted on her obligation under the Agreement, making no compensation to B. Therefore, B turned to X for help. On B’s request, X made repeated attempts to contact A by phone, mail or field visits to A’s shop, which all ended in vain. X found later that A had closed the shop for good. Afterwards, X was informed by the Commercial Registry and Finance Services Bureau that there was no registration nor tax record available with the authorities pertaining to A’s shop. In view of this fact, X proposed that B pursue his case through judicial channels. So, B asked X for copies of the Agreement and A’s ID document, to be used in taking legal action with the Court of Minor Civil Cases for compensation. X provided B with copies of the documents that A had requested.
  After analysing all aspects of the case, GPDP held that X’s providing copies of resident A’s ID document to resident B had constituted a breach of the principle of proportionality provided for in Article 5.1.(3) of the Personal Data Protection Act. Therefore, GPDP decided to penalise X with a fine of MOP4,000.00 in accordance with Article 33.1 of the same Act (for detail refer to Summary Case Decision 24/2008 available on the Office’s website).

Result:

    GPDP decided to penalise X with a fine of MOP4,000.00 in accordance with Article 33.1 of the same Act (for detail refer to Summary Case Decision 24/2008 available on the Office’s website). X paid the fine.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,5,33 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116