個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0025/2010/IP

Title: Department A’s notice did not mention the sound recording system

Reason: Complaints

Brief:

    Resident I littered on the streets and was fined by Government Department A. Resident I subsequently visited Department A to obtain more information on the details of the fine, and was taken to a room to speak to an officer of Department A. There is a notice in the room stating that it was equipped with a video recording system. Resident I asked the officer whether the room was also equipped with a sound recording system, and the officer confirmed positively.
  Resident I believed that the notice posted by Department A mentioned only the video recording system but not the simultaneous sound recording system, leading to a situation where he would be unwittingly providing verbal information. Resident I considered this a violation of the “Personal Data Protection Act” and filed a complaint with this Office (GPDP).

Analysis:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  Department A did not specify in its notification to GPDP that it had processed “sound (other audio recordings)” data. After investigation, GPDP considered that Department A’s omission was not a negligent provision of false information in notification. Moreover, there was no evidence to prove that Department A willingly concealed the processing of residents’ sound recording data. Therefore, its behavior did not constitute an administrative offence or crime as stated in articles 32 and 37 of the “Personal Data Protection Act”.
  Under the terms of article 10 of the “Personal Data Protection Act”, Resident I has the right to information to know about the identity of the data controller, the objective of data processing, the data recipient, etc.. In general terms there are three levels of the “Personal Data Collection Statement”: the complete version, the summarized version and the abridged version. In the present case, the notice posted in the room contained basic information regarding the personal data processing, and was an abridged version of a “Personal Data Collection Statement” in GPDP’s opinion. However, the notice mentioned only the existence of a video recording system but not the simultaneous sound recording system. Although the abridged version, instead of the complete version of the “Personal Data Collection Statement”, may be provided to the data subjects in certain situations, the respective content must be displayed in a clear and detailed manner, without any omissions. Thus, in order to avoid any misunderstandings by the public, the notice placed in the abovementioned Department A’s room should clearly state the data that will be processed and processed (for example, the notice should mention both the video recording and sound recording systems), thereby allowing the data subjects to know exactly what data will be processed. Department A revised the content of their notice, mentioning both video and sound recording system, soon after receiving GPDP’s recommendations.
  Under the terms of Article 11 of the “Personal Data Protection Law”, data subjects have the right to access, and should freely and unrestrictedly know about the types of data being processed, the data recipient, the data origins, etc.. In the present case, Resident I asked Department A’s officer whether there was sound recording in addition to the video recording, and the officer gave him an immediate response. GPDP considered that Department A had satisfied his right of access.
  In summary, the notification by Department A did not clearly specify that sound recording data, but its behavior did not constitute an administrative offence or a crime. Resident I exercised his right to access with Department A and knew about the data to be processed included both video and sound recording data. As such, his right of access was satisfied.

Result:

    GPDP decided to close this case, sent an official letter to Department A and recommended that the notification should be modified as quickly as possible and the “Personal Data Collection Statement” to public should be revised.
  Department A responded and followed the recommendations.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,10,11,32,37 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116