個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0034/2015/IP

Title: A telecommunications company handed the personal data of customers with outstanding payment to a company in Hong Kong for collection.

Reason: Complaint

Brief:

    The Complainant is a customer of Telecommunications Company A.  During the contract validity period, the Complainant switched to another telecommunications provider and then stopped paying Company A the monthly fee.  Later, the Complainant was contacted, in writing, by Company B, a Hong Kong Company acting on behalf of Company A to recover the arrears.  The Complainant questioned why Company A, without his consent, transferred his personal data to Company B.

Analysis:

    According to Article 3(1) and 4(1)(1) of the Personal Data Protection Act (PDPA), when Company A concluded a telecommunications service contract with its customers, it will process their name, mobile phone numbers, ID card numbers, etc.  Such information relates to identifiable or identified natural persons and therefore it is personal data.  The processing of such information is subject to the PDPA.
  The Complainant alleged that, Company A, without obtaining his consent, transferred his personal data to Company B. But according to the sample contract Company A provided, the contractual clauses therein stated clearly that a customer concluded the contract would agree to the provision of his personal data to foreign companies for recovering undue payment, if necessary.  Once customers signed the contract, they would be regarded as having been informed of such terms and conditions.  In addition, as the Complainant refused to disclose his identity to Company A, this case could only be handled according to the general policies set out by Company A for processing customers’ personal data.   
  When a customer decided to use the telecommunications services provided by Company A, he has to submit his personal data in order to conclude the contract.  On this basis, Company A was concluding the contract with the consent of the data subject, which fulfilled the conditions of unambiguous consent of a data subject and legitimate processing as provided for in Article 6 and 6(1) of the PDPA respectively. 
  Provided that Company B concluded an agency-contract (representação) with Company A, as long as a customer induced overdue payment, his personal data will be handed over to the former by the latter for payment collection.  In addition, the notification of data transfer and automatic data processing that Company A filed with the GPDP also stated that Company B is the processor of Company A.  In fact, a controller provided the personal data to its processor, and then the latter acts under the former’s name and according to its instructions, this could be understood as the acts undertaken by the data controller.  In other words, the mentioned processing of data is equivalent to the processing carried out by the data controller itself and therefore it is not within the bounds of consideration with regard whether the handover of data is legitimate. As a consequence, Company A’s provision of personal data to Company B to which customers’ consent is unnecessary.    
  Given that Company B is a Hong Kong company and Company A is required to comply with the legal requirements laid down in Article 19 and 20 of the PDPA for data transfer, data subjects’ unambiguous consent for the transfer, or the transfer fulfilled the legal requirements of the respective provisions, given in Article 20(1) of the same Law, is the precondition as long as the data transfer has been notified to the Office for Personal Data Protection (GPDP).
  Put shortly, the contractual clauses, given in the document provided by Company A, have specified that customers agreed to the handover of their personal data to foreign companies outside the Macao SAR, in addition that Company A has already notified the GPDP of its transfer of data.   

Result:

    The GPDP has already informed Company A and the Complainant the investigation result.  This case was closed.

Reference:
Please refer to Article 3, 4, 6, 10, 19 and 20 of the Personal Data Protection Act.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116