Notes

Data Protection Laws in Macau
Located on the southern tip of the Pearl River Delta in Asia, Macau is an internationally recognized special administrative region of China. Despite its proximity to China, it maintains a distinct identity, independent tax system and police force and Portuguese is one of the official languages. The GOM is committed to maintaining a transparent, non-discriminatory and free-market economy. In addition to providing a comprehensive regulatory framework, the government offers tax incentives and one-stop service for investors.

The main data protection legislation in the SAR is the Personal Data Protection Act (Law No. 8/2005, or PDPA), which was heavily influenced by European data protection laws. The PDPA states that data processing should be carried out transparently and with strict respect for privacy. The act lays down the general principles for the processing of personal data and establishes a legal framework to guarantee compliance with these principles.

According to the PDPA, data can be processed for the following purposes:

i) Pursuing the legitimate interests of the controller or a third party to whom the data is disclosed, as long as the process does not infringe upon the fundamental rights and freedoms of the data subject. This includes the use of data for marketing communications, provided that the data is not excessive or does not infringe on any privacy or property rights.

The PDPA also sets out a set of exceptions to the above rules. These include the processing of health data or information relating to criminal convictions or offences, as well as biometric data that refers to physical or behavioural human characteristics used for digital identification (e.g., fingerprints, facial patterns, voice or typing cadence). toto togel are considered to be particularly sensitive categories of personal data.

Companies based in Macau that transfer personal data to entities in the EU must comply with the GDPR, unless they can demonstrate that their activities are lawful under a derogation from the regulation (e.g., a contractual agreement with the entity to protect the data). The OPDP may issue such derogation certificates.

In the SAR, cybersecurity is an important area of concern and, like many other jurisdictions around the world, it is facing a growing number of threats. In response, the OPDP has established an Office for Cybersecurity (OCP) and included personal data breaches as notifiable incidents under its Cybersecurity Act (Law No. 13/2019). Notably, though, the law only requires controllers qualified as “operators of critical infrastructure” to notify the incident to designated supervisory authorities. As such, the OPDP does not have a mandate to enforce or oversee data breach notification duties. This is in contrast to the GDPR, which requires that any data breach be notified to all individuals whose personal data has been affected. The OPDP is considering the possibility of extending these obligations to all data processors. Nevertheless, there are also some concerns that the law may not be sufficiently robust in this respect and it is unlikely to be fully effective.
Homepage: https://www.pinoyradioitalia.com/