MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou, Advogados e Notários
Non-compliance with notification of data pro - cessing in breach of the terms set out in Arti - cle 23 of the PDPA, providing false information after notification by the PDPB and maintaining access to open data transmission networks for data controllers which do not comply with the provisions of the PDPA are all punishable by administrative sanction. This will take the form of a fine between MOP2,000 and MOP20,000 for individuals and of between MOP10,000 and MOP100,000 for legal persons; the fines are increased to twice the amount indicated above if the data is subject to previous authorisation. Non-compliance with stipulations of the PDPA regarding: • data quality (Article 5); • right to information, access, objection, right not to be subject to automated individual decisions (Articles 10 to 13); • special security measures (Article 16); • processing by subcontractor (Article 17); and • non-provision of mandatory information pro - vided in Article 24, paragraph 1, involve an administrative sanction of a fine between MOP4,000 and MOP40,000. Non-compliance with stipulations of the PDPA regarding: • conditions for legitimacy of data processing (Article 6); • processing of sensitive data (Article 7); • suspicions of illegal activities, criminal offenc - es and administrative offences (Article 8); • interconnection of personal data (Article 9); and • transfer of data to a destination outside the MSAR and respective exemptions (Articles 19 and 20),
involve an administrative sanction of a fine between MOP8,000 and MOP80,000. Criminal Offences Non-compliance with stipulations of the PDPA regarding: • purposefully omitting the notification/authori - sation indicated in Articles 21 and 22 of the PDPA; • providing false information in the notification/ authorisation requests for the processing of personal data or making modifications in this request not allowed by the instrument of legalisation; • diverting or using personal data, in a manner incompatible with the purpose of the collec - tion or with the instrument of legalisation; • promoting or carrying out an illegal intercon - nection of personal data; • non-compliance with the obligations provided for in this law or in other data protection legis - lation in the period established by the PDPB; and • maintaining access to open data transmission networks for those responsible for the pro - cessing of personal data that do not comply with the provisions of the PDPA, after notifica - tion of the PDPB not to do so, involve a criminal sanction of imprisonment up to one year or a fine up to 120 days. Fines which are set in days are under the discretion of the court – each day’s fine corresponds to an amount between MOP50 and MOP10,000, which the court shall set according to the eco - nomic and financial situation of the convicted person and their personal expenses. The sanc - tion is increased to twice the duration indicated above if the data involved is sensitive (Article 7 of the PDPA) or if illegal activities, criminal offences
288 CHAMBERS.COM
Powered by FlippingBook