個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Enquiry Case Notes
Print

No: 0162/C/2012

Title: Commissioning sub-contractor to process personal data

Content:

    Agency A asked for information and data of their children and parents who voluntarily accept the children assessment and consultation. Then, these will be passed from Agency A to Agency B, who is commissioned by the former to conduct a research and analysis. Agency A consulted the GPDP whether this conforms to the Personal Data Protection Act.

Result:

    As Citizen A failed to provide detailed and specific information, the GPDP could only provide the following opinions based on general personal data processing:
  According to Articles 4(1)(1) as well as 3(1) of the Personal Data Protection Act, the processing found in the current enquiry is subject to the Personal Data Protection Act (Law 8/2005).
  In addition, in accordance with Article 6 of the same Law, as parents voluntarily provided such information to Agency A, it can be taken as their consent have been given to Agency A to handle their personal information. In the current enquiry, Agency B is the sub-contractor, commissioned by Agency A, to process personal data. Agency A has the responsibility to choose a sub-contractor which can handle the personal data safely, and to supervise the processing and formulate guidelines to regulate the data processing. Although Agency A commissioned a sub-contractor to process the personal data, still the processing is considered as that of this Agency, instead of data transferred to a third party.
  In addition, in accordance with Article 10(2) of the same Law, while Agency A collects the personal data by collection forms, on which the processing purposes, data recipients, etc., should be clearly specified.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,6,10 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116