個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0174/2014/IP

Title: Commercial enterprise publishing a photo showing the suspected shoplifter

Reason: Report

Brief:

    A citizen reported to the Office for Personal Data Protection (GPDP) that Shop A published a photo clearly showing the appearance of a shoplifter.  Finding this as a suspected violation of the Personal Data Protection Act (PDPA or Law 8/2005), he decided to report to the GPDP.  

Analysis:

    According to Article 4(1)(1) and 3(1) of the PDPA, since the photo clearly showed the appearance of the shoplifter, being the information relating to an identifiable natural person, therefore it is regarded as personal data.  As a consequence, its processing is subject to the PDPA. 
  Shop A expressed that even frequent shoplifting was found, the average amount shoplifted was rather small and due to the complicated police reporting procedures, it declined to report to the police and displayed a photo that showed the surveillance system images instead.
  For the security of its place of business, Shop A’s installation of the surveillance system is to protect its property and legitimate interests, this constituted the legitimacy as laid down in Article 6(5) of the PDPA and precedes the interests of the data subjects. Publishing the photo of the shoplifter as warnings is not purely for the Shop’s security, but an intention to publish the appearance of the shoplifter and act as a law enforcement to punish this individual.  As a consequence, its intention deviated from the purpose of installing the surveillance system for its internal security. 
  Based on the above, Shop A violated Article 5(1)(2) of the PDPA by publishing the suspected shoplifter’s photo.  

Result:

    Since the photo of the suspected shoplifter was displayed and went beyond the original purpose – internal security – of the installation, this violated Article 5(1)(2) of the PDPA.  As a consequence, under Article 33(1) and 35(1) of the same Law, the GPDP imposed a fine of MOP 4,000.

Reference:
Please refer to Article 3, 4, 5, 6, 33 and 35 of the Personal Data Protection Act.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116