個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0042/2011/IP

Title: An association did not provide “Personal Data Collection Statement” when organizing a competition

Reason: Reports

Brief:

    Resident B stated that Association A organized a “Competition X”, in which it required participants to provide their personal information including names, addresses, mobile phone number, date of birth, identity card number and name of school. However, the competition regulations did not contain a “Personal Data Collection Statement” or any information regarding the purpose of the data collection, the data retention period, the ways and means in which the data would be rectified. Resident B believed that the conduct of Association A breached the “Personal Data Protection Act” and consequently filed a complaint with this Office (GPDP).

Analysis:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  After reviewing the regulations for the competition organised by Association A, GPDP confirmed that there was not a “Personal Data Collection Statement” or any information regarding the processing of the participants’ personal data (the purpose, the ways and means in which the data subject would exercise their rights of access and rectification). This omission signified that the provisions of Article 10 of the Personal Data Protection Act were not observed.
  Association A replied, stating that it had cancelled and terminated the above-mentioned activities as soon as it received the enquiry from GPDP. In reality, it had not collected any personal data whatsoever until the date on which it cancelled the activity.
  GPDP believed that as no personal data was collected yet. Under the terms of Article 4.1.93) of the Personal Data Protection Act, the Act was not applicable to the present situation.
  In summary, the conduct of Association A did not breach the terms of the Personal Data Protection Law, but there is room for improvement as regards their observance of the law.

Result:

    GPDP decided to close the case and sent an official letter to Association A informing them of the abovementioned analysis. Association A replied that they had learned a valuable lesson from this experience and that they would process personal information more carefully in the future.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,10 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116