MACAU SAR, CHINA Trends and Developments Contributed by: Pedro Cortés and Luís Rôlo, Lektou, Advogados e Notários
The volume of such notifications increased in 2022 and 2023, with more than 1,600 cases each year, up 80% from the nearly 900 in 2021. It is debatable whether the benefits of this system outweigh the administrative burden it imposes. The new challenges posed by the AI tools and their impact on privacy and personal data pro - tection are being addressed worldwide and one may expect that the new PDPB will do the same, either by issuing guidelines or by promoting leg - islation and/or regulation on the subject. Enforcement The PDPB will continue to publish annual reports of activity, offering some insight on its approach to enforcement. Two distinct phases have been observed in this regard in the past. • During the first few years of operation, the OPDP focused on educating the public, conducting a variety of activities intended to foster the awareness of rights and obligations both of data subjects and controllers regard - ing privacy issues. • More recently, the priority has shifted some - what towards enforcement, and this is shown both in the number of investigations conduct - ed and in the number of penalties applied; this is most notable in the field of direct mar - keting or telemarketing. 2023 did not show a significant trend for change in the average number of new investigations (105, compared to 73 in 2022 and 124 in 2021) and in the number of sanctions applied (30 offenders, compared to 18 in 2022 and 24 in 2021). Less than 9% of the investigations were own- motion.
It is yet to be seen whether the PDPB will adopt a more proactive stance, particularly regarding own-motion investigations. Transfer of Personal Data to Jurisdictions outside Macau – “White List” There have been no recent developments on this subject. The apparent provision of Article 19 of the PDPA for adopting a white list of jurisdictions for the purpose of cross-border data transfers does not translate into a practicable mechanism. The PDPB is expected to continue to solve this problem by resorting in every case to Article 20 of the PDPA (Derogations), which allows for transfers, even where “the legal system does not ensure an adequate level of protection”, provid - ed that “the data subject has given his consent unambiguously to the proposed transfer” and in a number of other limited circumstances (as per Article 20 of the PDPA). Any change to this situation depends on the amendment to the relevant provisions of the PDPA. In respect of regional cross-border data flows, the trend sees a close co-operation with the Cyberspace Administration of China, facilitating the flow of personal information in the context of the Greater Bay Area Guangdong-Hong Kong- Macau. In a joint initiative, together with the Econom - ic and Technological Development Bureau of Macau (DSEDT) and the Cyberspace Adminis - tration of China, the PDPB launched the “Stand - ard Contract for cross-border flow of personal information in the Greater Bay Area Guangdong- Hong Kong-Macau (Mainland China – Macau)”.
296 CHAMBERS.COM
Powered by FlippingBook