Receipts containing personal data - Enquiry Case Notes

No： 0539/C/2011

Title： Receipts containing personal data

Content：

　　Resident X said that, from time to time, he saw the staff of Shop A, without any processing, gave the receipts that contained personal data (name, membership No., etc) to scavengers on the street or just left them in the rubbish bins.
　　X asked whether the practice of the staff violated the Personal Data Protection Act (Law 8/2005).

Result：

　　In the absence of detailed case information, the GPDP could only provide general opinions to the personal data processing of the current case.
　　Under Articles 4(1)(1) and 3(1) of the Personal Data Protection Act, this Law governs the data processing of the current case.
　　According to Article 15 of the aforesaid Law, data controllers are responsible for adopting appropriate security measures to protect personal data against unauthorized alteration, transmission or access, etc. If X found any violations of the same Law, he can file a complaint or report to the GPDP.
　　However, normally, a clerk will hand the customer a receipt immediately after he or she receives the payment. Therefore, the customer, without being restricted by the shop, could decide how to deal with the receipt. If he has already discarded it as ordinary rubbish, as well as Shop A did not recycle them either, the latter is not bound to process the personal data therein, and such processing of rubbish does not involve personal data processing.
　　Therefore, the GPDP reminded consumers, for their own interests, to handle the receipts that contain personal data properly, and to avoid discarding them as ordinary rubbish.

Reference：
Please refer to "Personal Data Protection Act", articles 3，4，15 .

Back

個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

News Update