MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou – Advogados e Notários
activity, criminal offences and administrative offences – is an administrative offence which may entail a fine between MOP4,000 and MOP40,000. Although the PDPA provides penalties for undue access, as well as for tampering with, or destruc - tion of, personal data, it does not specifically pro - vide for security breaches by the data controller. It should be noted, however, that the PDPA mandates that the data controller shall present the notification/ authorisation request with a general description of the security measures, so that the PDPB may evaluate the adequacy of such measures. If the PDPB notifies the above-mentioned entity to address any insufficiency in the security measures and no remedy is taken, then a fine of between MOP2,000 and MOP20,000 for indi - viduals and of between MOP10,000 and MOP100,000 for legal persons may be imposed. Other potential enforcement penalties are outlined below. Non-compliance with notification of data process - ing in breach of the terms set out in Article 23 of the PDPA, providing false information after notification by the PDPB and maintaining access to open data trans - mission networks for data controllers which do not comply with the provisions of the PDPA are all punish - able by administrative sanction. This will take the form of a fine between MOP2,000 and MOP20,000 for indi - viduals and of between MOP10,000 and MOP100,000 for legal persons; the fines are increased to twice the amount indicated above if the data is subject to previ - ous authorisation. Non-compliance with stipulations of the PDPA regard - ing: • data quality (Article 5); • right to information, access, objection, right not to be subject to automated individual decisions (Articles 10 to 13); • special security measures (Article 16); • processing by subcontractor (Article 17); and • non-provision of mandatory information provided in Article 24, paragraph 1, involve an administrative sanction of a fine between MOP4,000 and MOP40,000.
Non-compliance with stipulations of the PDPA regard - ing: • conditions for legitimacy of data processing (Article 6); • processing of sensitive data (Article 7); • suspicions of illegal activities, criminal offences and administrative offences (Article 8); • interconnection of personal data (Article 9); and • transfer of data to a destination outside the MSAR and respective exemptions (Articles 19 and 20), involve an administrative sanction of a fine between MOP8,000 and MOP80,000. Criminal offences Non-compliance with stipulations of the PDPA regard - ing: • purposefully omitting the notification/authorisation indicated in Articles 21 and 22 of the PDPA; • providing false information in the notification/ authorisation requests for the processing of per - sonal data or making modifications in this request not allowed by the instrument of legalisation; • diverting or using personal data, in a manner incompatible with the purpose of the collection or with the instrument of legalisation; • promoting or carrying out an illegal interconnection of personal data; • non-compliance with the obligations provided for in this law or in other data protection legislation in the period established by the PDPB; and • maintaining access to open data transmission networks for those responsible for the processing of personal data that do not comply with the provi - sions of the PDPA, after notification of the PDPB not to do so, involve a criminal sanction of imprisonment up to one year or a fine up to 120 days. Fines which are set in days are under the discretion of the court – each day’s fine corresponds to an amount between MOP50 and MOP10,000, which the court shall set according to the economic and financial situation of the convicted person and their personal expenses. The sanction is increased to twice the duration indicated above if the data involved is sensitive (Article 7 of the PDPA) or if
276 CHAMBERS.COM
Powered by FlippingBook