個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0039/2010/IP

Title: Personal photos persistently used by others as self portrait on social networking sites

Reason: Complaints

Brief:

    Citizen X complained to GPDP, in person, that his personal data and photos had been persistently, for about four months, used by others on social networking sites for making friends and publishing posts. X said that he did not know the persons being complained, hence he could only provide to GPDP the email address of the persons being complained.
  X claimed that this might have violated the Personal Data Protection Act as his personal data and photos had been used for making friends and posts in social network sites, and therefore filed a complaint with GPDP.

Analysis:

    In this particular case, the data and photos of X had been repeatedly used by others, for making friends, publishing posts and so forth, in popular Websites A and B, Discussion Site C, as well as Forums D, E and F. Based on the information X provided, it could construe that personal photos uploaded by X to website A were used by the persons being complained on the said HTMLs.
  Since the website and its users have the control over and the rights to decide the processing of X’s data, the “controllers” of the present case include the website, the communication tools and their users, therefore X and the persons being complained are included in the latter. The data published by X on the Internet site appertains to X’s personal data and involves no other natural persons, therefore according to stipulation of Article 3(2) of the Personal Data Protection Act, this is not applicable to the involved processing of data. While considering the persons being complained, information showed that a same email address was used to register for Website B and Forum D. In the latter, personal information a user has to register include his name, gender, date of birth, etc. A same photo was used for Website A and Forum D, additionally on Website A the user registered herself as a female user. In this regard, it could be assumed that the persons being complained involved are natural persons.
  As it is difficult to, based on the information above, identify the persons being complained, therefore leading to the differentiation of Macau users and non-Macau users. Taking into account the fact that processing of X’s data by non-Macau users was conducted outside Macau, GPDP therefore had no competence to follow up. To Macau users, the natural persons who used the picture of X not only are users of Website A, but also of Discussion Site C, Forum D and Forum E. It is obvious that X’s photo had been disseminated via internet and resulted in the situation of “save those with the purposes of systematic communication and dissemination”, as given in Article 3(2) of the Personal Data Protection Act. In this case, if the users of the abovementioned websites are natural persons, such processing should be regulated by the said Act.
  The websites and communication tools, in this case, involved in processing X’s personal data include popular Websites A and B, Discussion Site C, as well as Forums D, E and F.
  According to the terms of use of website A, any user is deemed as agreeing to the said terms once using or visiting the website, as such include accepting his personal data processing regulated by the American legislations and the data processing in US. Moreover, with the information X provided, the user of Website A had apologized and deleted the photos of X, and X is recommended exercise his rights towards the website with its terms of use in case of any recurrence.
  As Website B is a communication tool, generally speaking, the Personal Data Protection Act did not regulate communication between users with this tool, as it is regarded as personal communication. Also, X’s photos used by the user on Website B are different from those used on other websites, therefore no information does indicate the photos were disseminated through other websites. In addition, considering the aforementioned users are natural persons, therefore the involved processing of data does not fall within the regulation of the said Act.
  Upon investigation to Discussion Site C, Forums D, E and F, it found that these sites had not formulated any terms of use, and their servers were confirmed locating in Hong Kong and US. In addition, the Personal Data Protection Act does not regulate personal communication between users of Website B, plus the difficulty in identifying whether the person being complained is a Macau user, GPDP was therefore unable to follow up.
  Moreover, user of Website A had stopped using X’s photos. With regard the use of X’s photos by users of other websites, X shall exercise his rights under the terms of use and privacy policies of these websites.
  In summary, it was not within the GPDP’s competence to follow up the processing of data by these websites and communication tools.

Result:

    Since GPDP does not have the competence to follow up the processing of personal data by these websites and communication tools, in addition to the failure in identifying whether the persons being complained is a Macau user, GPDP, therefore, decided to close this case. GPDP also informed X, in writing, of the concerned result.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116