MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou, Advogados e Notários
and administrative offences are suspected (Arti - cle 8 of the PDPA). Access in any way to personal data whose access is forbidden to said individual/entity is forbidden. The sanction is increased to twice the duration indicated when access: • is achieved through violation of technical safety rules; • has allowed the agent or third parties to obtain personal data; or • has provided the agent or third parties with a benefit or patrimonial advantage. Such access is punishable with a criminal sanc - tion of imprisonment for up to one year or a fine up to 120 days, unless otherwise provided by special law. The sanction is increased to twice the duration indicated in the cases described. Deletion, destruction, damaging, suppression or modification of personal data without proper authorisation, rendering the data unusable or affecting its ability to be used is punishable with a criminal sanction: imprisonment up to two years or a fine up to 240 days, unless otherwise pro - vided by special law. The sanction is increased to twice the duration indicated if the damage resulting therefrom is particularly serious. If the agent acts with negligence, the sanction is, in both of the cases provided above, imprisonment for up to one year or a fine up to 120 days. Qualified disobedience regarding notification to interrupt, cease or block the processing of per - sonal data, or in cases of: • refusal, without just cause, to co-operate as specifically requested by the PDPB; • refusal to totally or partially destroy personal data; and/or
• refusal to destroy personal data, after the period of conservation provided for in the PDPA, involve a criminal sanction of imprisonment for up to two years or a fine up to 240 days. 1.4 Data Protection Fines in Practice The PDPB publishes summaries of the most relevant cases. In 2023 and 2024, a total of 18 cases were published. One case was deemed a criminal offence and forwarded to the Public Prosecutor. The administrative offence cases involved tele - marketing in breach of the data subjects’ rights, failure to notify the PDPB of processing and/or cross-border transfer of data and disclosure/ posting of personal data on social media with - out consent. Fines ranged from MOP4,000 to MOP30,000 per offence. 1.5 AI Regulation No specific regulation has been enacted in Macau addressing AI. 1.6 Interplay Between AI and Data Protection Regulations In the absence of specific AI regulation, the PDPA is the applicable law in personal data pro - tection issues arising from AI. 2. Privacy Litigation 2.1 General Overview There are no recent cases in privacy litigation in Macau.
289 CHAMBERS.COM
Powered by FlippingBook