MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou, Advogados e Notários
1.2 Regulators The PDPB is, under Administrative Regulation 42/2023, the government entity responsible and accountable for monitoring and enforcing com - pliance with PDPA provisions, and for estab - lishing an adequate confidentiality system and monitoring its enforcement. The PDPB is granted powers covering a broad area of activities both in the private and in the public sectors and possesses a full legal basis and a permanent status. Being a Bureau within the Public Administration of the MSAR, but reporting directly to the Chief Executive, it remains to be clarified whether this status equates with a status of permanent inde - pendence. The PDPB is a member of the Asia Pacific Pri - vacy Authorities (APPA). Following it’s admission as an observer at the 30th Conference of the Global Privacy Assembly (GPA) in 2008, the current status of the PDPB is still observer, valid until April 2025. It is expected that the PDPB will apply for admis - sion as a member of the GPA. 1.3 Enforcement Proceedings and Fines There are two different types of administrative process: notification and authorisation. Notification Under the PDPA, the data controller, or their representative, if any, must notify the public authority in writing within eight days after the start of carrying out any wholly or partly auto - matic processing operation or set of such oper - ations intended to serve a single purpose or several related purposes. The public authority
may authorise the simplification of, or exemp - tion from, notification for specific categories of processing which, taking account of the data to be processed, are unlikely to adversely affect the rights and freedoms of the data subjects. In allowing this simplification or exemption, the authority will also consider the speed, economy and efficiency of the relevant processing. The authorisation of simplification shall be pub - lished in the Official Gazette of the Macau SAR and must specify: the purposes of the process - ing; the data or category of data to be processed; the category or categories of data subjects; the recipients, or categories of recipients, to whom the data may be disclosed; and the length of time the data is to be stored. There are exemptions from notification, such as those for processing whose sole purpose is the keeping of a register which, according to laws or administrative regulations, is intended to provide information to the public and which is open to consultation by the public in general or by any person demonstrating a legitimate interest. The texts of these generic authorisations are available at the PDPB’s official website. Authorisation Prior authorisation by the PDPB is required for some types of processing. These include the processing of sensitive data (where it is not car - ried out pursuant to a legal provision or it is car - ried out without the explicit consent of the data subject), data related to the credit and solvency of the data subject, and the combination of data and further processing of data for purposes oth - er than those originally stated by the controller. For this purpose, sensitive data means personal data revealing philosophical or political beliefs,
286 CHAMBERS.COM
Powered by FlippingBook