MACAU SAR, CHINA Trends and Developments Contributed by: Pedro Cortés and Luís Rôlo, Lektou – Advogados e Notários
Legal Framework The Personal Data Protection Act of Macau (PDPA) was enacted by Law No 8/2005, and follows very closely the text of the former Portuguese Act of 1998, with the notable exception of the provisions on the Public Authority for Personal Data Protection. The Act on Video Surveillance in Public Areas was enacted by Law No 2/2012. The Personal Data Protection Bureau (PDPB) is the public authority with regulatory and supervisory pow - ers, created in 2023 by Administrative Regulation No 42/2023. It succeeded the former Office for Personal Data Protection (OPDP). The PDPB is a permanent Bureau of the Public Admin - istration of the Macau Special Administrative Region, and, despite not having a formal independent status, it is placed under the direct authority of the Chief Execu - tive, not under a Secretary of the Government. This means that the PDPD is not under the authority of other public administration bodies in the performance of its regulatory and supervision powers. The PDPB is an Observer to the Global Privacy Assembly. The substantive law framework has not seen a sig - nificant change in the last few years, and no plans to legislate in the field of Personal Data Protection have been announced. The previously reported concerns, namely regarding a duty of notification of data breaches to the data sub - jects, provision for mandatory privacy officers in rel - evant controllers, preliminary assessments of impact on privacy to be carried out by large-scale controllers, duties in connection to further transfers in the case of cross-border transfer of personal data, remain current. The continued expansion of AI is an additional chal - lenge to the resilience of the PDPA. Another area where the Macau SAR may consider a revision of the legal framework is the requirement for
notification (registration) of processing of personal data with the PDPB. This notification is an administrative requirement, not necessarily followed by an assessment of the lawful - ness of the notified processing of personal data. The volume of such notifications remained high in 2023 and 2024, with more than 1,500 cases each year. It is debatable whether the benefits of this system outweigh the administrative burden it imposes. The challenges posed by AI tools and their impact on privacy and personal data protection are being addressed worldwide and one may expect that the new PDPB will address them, either by issuing guide - lines or by promoting legislation and/or regulation on the subject. Enforcement The PDPB will continue to publish annual reports of activity, offering some insight on its approach to enforcement. Two distinct phases have been observed in this regard in the past. • During the first few years of operation, the OPDP provided for the education of the public, conduct - ing a variety of activities intended to foster the awareness of rights and obligations both of data subjects and controllers regarding privacy issues. • More recently, the priority has shifted somewhat towards enforcement and this is shown both in the number of investigations conducted and in the number of penalties applied; this is most notable in the field of direct marketing or telemarketing. 2024 did not show a significant trend for change in the average number of new investigations (74, compared to 105 in 2023 and 73 in 2022) and in the number of sanctions applied (14 offenders, compared to 30 in 2023 and 18 in 2022). Less than 2% of the investigations were own-motion. Transfer of Personal Data to Jurisdictions outside Macau – “White List” There were no recent developments on this subject.
282 CHAMBERS.COM
Powered by FlippingBook