MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou – Advogados e Notários
1.6 Data Breach Requirement Under the cybersecurity law, private operators of critical infrastructures must inform the competent authority (the “Cybersecurity Committee”) of any “cybersecurity incident”. The PDPB is a member of the Cybersecurity Committee. Notwithstanding, the PDPA does not require specific actions in the event of data breaches. 1.7 Regulators The PDPB is, under Administrative Regulation 42/2023, the government entity responsible and accountable for monitoring and enforcing compliance with PDPA provisions, and for establishing an adequate confiden - tiality system and monitoring its enforcement. The PDPB is granted powers covering a broad area of activities both in the private and in the public sec - tors and possesses a full legal basis and a permanent status. Being a Bureau within the Public Administration of the MSAR, but reporting directly to the Chief Executive, it remains to be clarified whether this status equates with a status of permanent independence. The PDPB is a member of the Asia Pacific Privacy Authorities (APPA). Following its admission as an observer at the 30th Conference of the Global Privacy Assembly (GPA) in 2008, the current status of the PDPB is still observer, renewed at the 47th Conference in September 2025. Guidance and recommendations issued by the PDPB are not binding but are generally adopted. 1.8 Enforcement Proceedings and Fines There are two different types of administrative pro - cess: notification and authorisation. Notification Under the PDPA, the data controller, or their repre - sentative, if any, must notify the public authority in writing within eight days after the start of carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single pur -
beliefs, political association or trade-union member - ship, religion, privacy and racial or ethnic origin, and data concerning health or sex life, including genetic data”. As a general rule, the processing of sensitive personal data is prohibited. Processing of sensitive personal data, when allowed, must guarantee non-discrimination and be carried out with special security measures. Processing of sensitive personal data may be allowed by a legal provision, under “important public interest grounds” and by “explicit consent” of the data sub - ject. Data relating to minors is not specifically addressed by legislation. Data on suspicion of illegal activities, criminal and administrative offences (Article 8 of the PDPA) is restricted to “when such processing is necessary for pursuing the legitimate purposes of the control - ler, provided the fundamental rights and freedoms of the data subject are not overriding”. Central registers may only be created or kept by public authorities and data “for the purposes of police investigations shall be restricted to the processing necessary to prevent a specific danger or to prosecute a particular offence”. 1.4 Processing of Personal Data for Research and Development Purposes Data relating to health and sex life, including genetic data, may be processed for the purposes of preven - tive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, provided that data is processed by a health professional bound by professional secrecy. If data is adequately anonymised, it becomes no longer related to an “identified or identifiable natural person”, and is no longer deemed “personal data”. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Macau does not have specific privacy requirements for the use of personal data in the context of AI.
274 CHAMBERS.COM
Powered by FlippingBook