個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0036/2010/IP

Title: Summons were not placed in envelopes

Reason: Complaints

Brief:

    Resident X states that Department B of Government Bureau A sent him the “First Summons for the Payment of Professional Tax” (hereinafter referred to as the summons) by post. As it was only folded twice and sealed at the top and bottom with double-side tape instead of being placed in an envelope, any third party could read the content of the summons clearly from both sides.
  Resident X believed that Department B’s conduct breached the “Personal Data Protection Act”, and filed a complaint with this Office (GPDP), but indicating that he did not intend to pursue further.

Analysis:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  It was necessary to find out the data controller in this case. Articles 1 and 3 of Decree-Law No.36/99/M state that the Director of Bureau A is concurrently the head of Department B and Department B is an entity with public authority, unlike the other subsidiary units of Bureau A. Under the terms of Article 29 of Decree-Law no. 30/99/M, “Department B has the authority to … execute all taxes which do not fall within purview of the courts’ powers as determined in the ‘Tax Execution Code’.” GPDP can therefore conclude that Department B has the power to enforce the law, and any summons or official letters prepared are made in the name of Department B. As Department B had the power to control and decide how Resident X’s personal data was processed in case at hand, it was the data controller. Department B could legitimately process Resident X’s Personal data in accordance with the terms of Article 6.(4) of the “Personal Data Protection Act”.
  In GPDP’s opinion, as there are no specific rules regarding tax collection methods in Article 43 of the “Tax Execution Code”, Department B can formulate its own policies and decide whether or not to place summons in envelopes. Taking into account the fact that there will be personal data in the summons, such as the name, address and tax identification number of the respective taxpayer (it is the same as the complete identity card number of the taxpayer in this case), Department B should have taken the appropriate security measures to protect the relevant data according to Article 15 of the “Personal Data Protection Act”, such as placing the summons in envelopes to prevent unauthorised third parties from viewing the content. Department B therefore did not process the personal data included in the summons in accordance with Article 15 of the “Personal Data Protection Act”.
  Department B made improvements after the intervention of GPDP, by placing the relevant summons in envelopes in order to ensure that their contents will not be wrongfully disclosed in the mail.
  In GPDP’s opinion, if Resident X had suffered damages as a result of this conduct, he could demand compensation from Department B, under the terms of Article 14 of the “Personal Data Protection Act”.

Result:

    GPDP sent official letters to Government Bureau A, Department B and Resident X, informing them of the abovementioned assessment.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,15 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116