MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou, Advogados e Notários
2.2 Recent Case Law There are no recent cases in privacy litigation in Macau. 2.3 Collective Redress Mechanisms There is no collective redress mechanism for protection of the collective interests of data subjects in Macau. Under Article 14 of the PDPA, individuals may file for damages arising from unlawful processing of their personal data. These cases are judged by the civil courts. 3. Data Regulation on IoT Providers, Data Holders and Data Processing Services 3.1 Objectives and Scope of Data Regulation With regard to the internet of things (IoT) projects and the data circulating therein, where data pro - cessed may relate to an identified or identifiable natural person, the processing falls under the provisions of the PDPA. The processing of per - sonal data through any such device must com - ply with the applicable stipulations of the law: • it must be performed in a transparent man - ner and in strict observance of privacy rights and of the rights, freedoms and guarantees enshrined in the Macau Basic Law and in applicable legislation; and • it may only be carried out if the data subject has given their unequivocal consent, or if the processing is necessary for the purposes set out in the law. There is currently no specific legislation on the IoT in the MSAR. Concerned parties should approach compliance from the perspective of personal data protection, where applicable.
3.2 Interaction of Data Regulation and Data Protection Information that is not, initially, deemed personal data may become so by means of cross-refer - encing other databases. Developers and controllers need to be mindful of developments, both in technology and in the market landscape, and take the necessary steps to respect the data subjects’ rights in such an event. Regular reviews and assessments of impact of IoT projects on personal data should be carried out, to minimise the risk of non-compliance with the PDPA. 3.3 Rights and Obligations Under Applicable Data Regulation The rights and obligations arising from the use of IoT services, as long as personal data is involved, are those set out for processing of personal data in the PDPA. 3.4 Regulators and Enforcement In relation to personal data protection, the regu - lator is the Personal Data Protection Bureau, as mentioned in 1.2 Regulators and 1.3 Enforce- ment Proceedings and Fines . A significant part of IoT projects deals with public infrastructures, such as those being researched by the State Key Laboratory of Internet of Things for Smart City, in the University of Macau: Intelligent Sensing and Network Communication, Urban Big Data and Intelligent Technology, Smart Energy, Intelligent Transportation and Urban Safety and Disaster Prevention. Operators in these areas may be deemed private operators of critical infrastruc - tures and be additionally subject to other regula - tors, under the provisions of Macau Cybersecu - rity Law (Law No 13/2019).
290 CHAMBERS.COM
Powered by FlippingBook