MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou – Advogados e Notários
1.9 Enforcement Trends According to the two most recent annual reports pub - lished by the PDPB, in 2023 there were 105 investi - gations, mostly involving (in 55% of the cases) lack of legitimacy conditions for processing personal data or non-compliance with personal data protection principles (in 47% of the cases). In 2024, the num - ber of investigations dropped to 74, involving lack of legitimacy in 66% of the cases and non-compliance with principles in 38% of the cases. The proportion of PDPB’s own-motion investigations is low – 9% in 2023 and under 2% in 2024. The investigations resulted in enforcement of penal - ties (fines) in 25% and 17% of the cases, in 2023 and 2024, respectively. The PDPA provides, in Article 14, that any person who has suffered damage as a result of an unlawful pro - cessing operation or of any other act incompatible with legal provisions or regulations in the area of per - sonal data protection is entitled to receive compensa - tion from the controller for the damage suffered. How - ever, no case law exists on the basis of this provision. 2.2 Recent Case Law No recent case law exists regarding Article 14 of the PDPA. 2.3 Collective Redress Mechanisms There is no collective redress mechanism for pro - tection of the collective interests of data subjects in Macau. As mentioned in 2.1 Privacy Litigation Over- view , individuals may file for damages arising from unlawful processing of their personal data. These cases are judged by the civil courts. 2. Privacy Litigation 2.1 Privacy Litigation Overview 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Macau has not enacted laws relating to processing of non-personal data.
illegal activities, criminal offences and administrative offences are suspected (Article 8 of the PDPA). Access in any way to personal data whose access is forbidden to said individual/entity is forbidden. The sanction is increased to twice the duration indicated when access: • is achieved through violation of technical safety rules; • has allowed the agent or third parties to obtain personal data; or • has provided the agent or third parties with a ben - efit or patrimonial advantage. Such access is punishable with a criminal sanction of imprisonment up to one year or a fine up to 120 days, unless otherwise provided by special law. The sanction is increased to twice the duration indicated in the cases provided. Deletion, destruction, damaging, suppression or mod - ification of personal data without proper authorisation, rendering the data unusable or affecting its ability to be used is punishable with a criminal sanction: impris - onment up to two years or a fine up to 240 days, unless otherwise provided by special law. The sanc - tion is increased to twice the duration indicated if the damage resulting therefrom is particularly serious. If the agent acts with negligence, the sanction is, in both of the cases provided above, imprisonment for up to one year or a fine up to 120 days. Qualified disobedience regarding notification to inter - rupt, cease or block the processing of personal data, or in cases of: • refusal, without just cause, to co-operate as spe - cifically requested by the PDPB; • refusal to totally or partially destroy personal data; and/or • refusal to destroy personal data, after the period of conservation provided for in the PDPA, involve a criminal sanction of imprisonment for up to two years or a fine up to 240 days.
277 CHAMBERS.COM
Powered by FlippingBook