MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou – Advogados e Notários
5. International Considerations 5.1 Restrictions on International Data Transfers
Therefore, processing of trade union membership data is lawful in those two circumstances. The duty of the employer to notify the PDPB of the processing of personal data of their employees is waived in some cases: • personal data necessary for processing of payroll and payroll-related obligations (Authorisation No 01/2007); • personal data necessary for processing of admin - istrative management of the employment relation (Authorisation No 02/2007); and • processing of biometric data for attendance control purposes (Authorisation No 02/2020). The PDPB provides detailed recommendations on the use of personal data for supervision of employees’ activities in the workplace, emphasising the principles of legality of purpose, non-excessive collection and including sample privacy statements for processing of supervision of telephone calls, e-mail and internet In asset deals, the standard provisions of the PDPA apply. Namely, the buyer, as a recipient for the per - sonal data controlled by the seller, shall become the controller of the data. The data subjects’ right to information includes the identity of the recipients and the purposes of the dis - closure of data to those recipients. Besides, the identity and purposes of processing of the recipients are part of the notification to the PDPB and this notification might also need to be amended/ updated. The recipient must fulfil the requirements of legitimacy for processing the transferred data. Therefore, either consent from the data subjects or another condition for legitimacy needs to be secured, along with a notification to the PDPB, whenever the processing is not already covered by such a notifica - tion. usage and video surveillance. 4.4 Data Protection in M&A
The transfer of personal data overseas can only take place in accordance with PDPA provisions and provid - ed that the jurisdiction to which the data is going to be transferred ensures an adequate level of protection. This level of protection may be assessed by the PDPB on a case-by-case basis (Article 19 of the PDPA) but, in practice, the PDPB does not assess the adequacy of the level or protection guaranteed by the import jurisdiction. All cases are assessed under Article 20 of the PDPA on derogations (see below). Under the PDPA there is no provision enabling the publication of a list of jurisdictions capable of ensuring the level of protection that is imposed by the PDPA (no “white list”). The transfer of data overseas may be possible under the various exceptions provided by the PDPA. These include the necessity of such a transfer for the formation of a contract between the data subject and the data controller and for preliminary measures for the formation of that contract at the request of the data subject, among others. However, the most common exception to the rule indicated above is the obtaining of the data subject’s express and unambiguous consent to such a transfer (Article 20, paragraph 1 of the PDPA). Organisations collecting or transferring data in con - nection with foreign government data requests, for - eign litigation proceedings (eg, civil discovery) or inter - nal investigations are not exempted from the standard requirements set out under the PDPA and shall be subject to the same penalties in case of breach of the existing laws. 5.2 Government Notifications and Approvals As no list of jurisdictions ensuring an adequate level of protection currently exists in Macau, the transfer
279 CHAMBERS.COM
Powered by FlippingBook