個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0033/2011/IP

Title: Public Department transferred a complaint letter to another organization without the citizen’s consent

Reason: Complaints

Brief:

    Citizen A wrote a letter to Bureau A, complaining that Association B was suspected of selecting non-qualified persons to participate in the international competition. The complaint letter contained his name, telephone number, email address and contact address. Afterwards, Bureau A replied to Citizen A that his complaint letter had been transferred to Association B.
  Citizen A considered that the transfer of his complaint letter to Association B without his consent was an inappropriate disclosure of his personal data and it might breach the “Personal Data Protection Act”.

Analysis:

    The data process of current case is regulated by the “Personal Data Protection Act” under Article 4(1)(1) and 3(1).
  Under Articles 27 and 28 of Decree-Law no. 67/93/M, the jurisdictional committees of sports associations are responsible for investigating violations regarding the selection of local representatives. However, according to Article 42 of the same Law, Bureau A should take the initiative to carry out investigations on matters that have significant impact on sports. GPDP felt that, based on the interests of the MSAR and the continuity of the process of the relevant investigation, the transfer of the complaint letter to Association B by Bureau A was subject to the public interest mandate or in the exercise of its administrative authority, which conforms to the legitimacy requirement specified in Article 6(4) of the “Personal Data Protection Act”.
  GPDP considered that, in order to impel relevant investigation, Bureau A transferred the complaint letter (including Citizen A’s personal data) to Association B. Since Citizen A’s personal data processing done by Bureau A was for a purpose with specific, clear, legitimate and directly related to its activities that was in line with Article 5(1)(2) of the “Personal Data Protection Act”. In addition, Citizen A was not the interested party in the complaint and had not asked Bureau A to follow up the complaint in an anonymous manner. Considering the current case, as well as the reputation and interest of MSAR, the data subject’s interest or fundamental right, freedom or protection should not be placed above the aforementioned public interest. Therefore, Bureau A did not breach Article 5(1)(3) of the “Personal Data Protection Act”.
  Bureau A subsequently drew up its own “Working Guidelines on the Personal Data Processing and Protection”, which determined that copies of letters could only be referred to another entity with the inquirer’s or complainant’s consent and the relevant personal data was hidden.
  In summary, although Bureau A did not breach the “Personal Data Protection Act”, there was room for improvement.

Result:

    GPDP informed both Citizen A and Bureau A, in writing, of the aforementioned analysis and decision and recommended Bureau A to implement a “Personal Data Collection Statement” and execute the obligation on declaration with the aims of automated complaints and suggestions, etc. The case was closed.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,5,6 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116