MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou – Advogados e Notários
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The Macau Special Administrative Region of the Peo - ple’s Republic of China (Macau SAR or MSAR) has its political and legal framework in the Basic Law, adopted by the National People’s Congress in 1993, under the provision of Article 31 of the Constitution. Data privacy and personal data protection are two rights enshrined by the Basic Law, which covers these two separate but related rights in a systematic and extensive manner. The most relevant pieces of legislation addressing data protection and data privacy issues in Macau are: • the Macau Basic Law; • the Section of the Macau Civil Code on privacy and personal rights, enacted in 1999; and • Law No 8/2005, the Macau Personal Data Protec - tion Act (PDPA). The latter is an act inspired by the former European legislation on data protection, namely the European Union Data Protection Directive of 1995, and sets the legal framework for the protection of personal data in Macau SAR. Other legislation affecting this area that should be noted includes: • Administrative Regulation No 42/2023, effective from 1 February, 2024, which created the Personal Data Protection Bureau (PDPB); • a set of generic authorisations, legal opinions and case analyses that have been published by the PDPB on its official website; and • Law No 2/2012, on the legal regime for video surveillance in public spaces and, pursuant to this act, the Dispatches of the Secretary for Security, authorising the specific setting up of video surveil - lance cameras in public spaces. The government consistently includes a statement of priority in the annual policy address regarding the implementation of e-government, smart city and other
areas involving sensitive digital technologies and arti - ficial intelligence. Notwithstanding this, since its enactment in 2005, the PDPA has not been amended. The international trend for amendments and updates of legal frameworks on data protection matters, as well as the continued domestic and international inter - est in the area, has not been reflected in amendments to the PDPA. The legislation has no extraterritorial reach. Separate legislation (Law 13/2019) provides for cyber - security, covering networks and IT systems, with spe - cific focus on operators of critical infrastructures. 1.2 Rights and Obligations The general principle of transparency of processing is supplemented by specific principles, as provided by Articles 2, 5 and 6 of the PDPA: • lawfulness and good faith; • purpose limitation; • adequacy and proportionality; • accuracy; • time limitation; and • legitimacy by consent of the data subject or by prevailing legitimate interest of the controller. Organisations carrying out processing of personal data should comply with the duty to notify the Regu - lator of the processing, within eight days the initiation of processing. The PDPB provides a structured and itemised form for the notification. Besides the general duty of notification, organisations need to apply, unless otherwise provided by law, for authorisation for conducting some types of process - ing, namely when involving sensitive personal data, data relating to credit and solvency, combination of personal data and further processing of data for pur - poses not giving rise to their collection. 1.3 Special Categories of Personal Data Sensitive personal data (Article 7 of the PDPA) is stated to be “data revealing philosophical or political
273 CHAMBERS.COM
Powered by FlippingBook