MACAU SAR, CHINA Trends and Developments Contributed by: Pedro Cortés and Luís Rôlo, Lektou – Advogados e Notários
The apparent provision of Article 19 of the PDPA for adopting a white list of jurisdictions for the purpose of cross-border data transfers does not translate into a practicable mechanism. The PDPB is expected to continue to solve this prob - lem by resorting in every case to Article 20 of the PDPA (Derogations), which allows for transfers, even where “the legal system does not ensure an adequate level of protection”, provided that “the data subject has given his consent unambiguously to the proposed transfer” and in a number of other limited circum - stances (as per Article 20 of the PDPA). Any change to this situation depends of the amend - ment to the relevant provisions of the PDPA. In respect of regional cross-border data flows, there is a close co-operation with the Cyberspace Admin - istration of China, for facilitating the flow of personal information in the context of the Greater Bay Area Guangdong-Hong Kong-Macau. In a joint initiative, together with the Economic and Technological Development Bureau of Macau (DSEDT) and the Cyberspace Administration of China, the PDPB launched the “Standard Contract for cross- border flow of personal information in the Greater Bay Area Guangdong-Hong Kong-Macau (Mainland China – Macau)”. Data Combination (Interconnection) The PDPA subjects the processing of personal data involving “data combination” to prior checking and authorisation by the OPDP. It also makes it a criminal offence to “promote or carry out an illegal combination of personal data”, punishable with imprisonment for a period not exceeding one year or a fine not exceeding 120 days (double maxima if sensitive data is involved). This would be the case should the controller fail to secure the authorisation. In practice, almost every department of the public administration is empowered, by law or by its organic regulation, to conduct data combination in areas relat - ed to their lawful activities.
There is a tight connection between this topic and the development of e-Government, making the use of data combination by the public administration the norm, rather than the exception. However, in the private sector, the need for securing a prior authorisation from the OPDP, keeps the process - ing by means of data combination as an exception. The total number of applications for authorisations (mostly granted to bodies of the public sector, includ - ing data combination) was 48 in 2024, compared with 57 in 2023 and 33 in 2022. Video Surveillance Macau’s video surveillance programme, “Eyes in the Sky”, continues to develop. As the initial phases have yielded satisfactory results in criminal investigation, the authorities have disclosed plans to further expand the system, which is expected to include up to 4,200 cameras by 2028. The system has the capability to provide facial recog - nition and vehicle licence plate recognition. In respect of the retention period of the collected data, the authorities have stated that, under normal circum - stances (ie, if no criminal investigation is involved), all the data is automatically erased 60 days after collec - tion. Under the 2012 Act, the OPDP’s prior opinion is required for each camera, regarding the location, the angle of coverage and its width of field. The OPDP regularly confirms that this has been carried out. How - ever, the particulars of the process are not disclosed to the public. PIPL Mainland China’s Personal Information Protection Law (PIPL) has a special significance for Macau, given the intense economic and human cross-border flows. The PDPB continues to engage in joint activities with the Commissioner of the Office of the Privacy Com - missioner for Personal Data, Hong Kong and the Cyberspace Administration of China, among others.
283 CHAMBERS.COM
Powered by FlippingBook