The Automated Means Criterion is explicitly used to set the scope of applicability for the Macau PDPA. It designates that the law applies to personal data processing conducted wholly or partly by automated means - covering technology-driven or electronic data processing.

Text of Relevant Provision

PDPA Art.3(1):

"This Act shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a manual filing system or which are intended to form part of a manual filing system."

Analysis of Provision

Article 3(1) establishes the scope of the Macau PDPA by expressly referencing processing of personal data wholly or partly by automatic means. This phrase ensures that any operations using technology—such as computers, databases, or automated electronic systems—to handle personal data are brought under the law's purview.

Key elements:

• "wholly or partly by automatic means": Any data processing involving automation, whether fully automated (e.g., a database running without human intervention) or partially automated (e.g., human input into a software that organizes or analyzes data), triggers the law's applicability.
• "processing otherwise than by automatic means of personal data which form part of a manual filing system": The scope also extends to non-automated processing, but only where the personal data are organized in or intended for a manual filing system structured according to specific criteria.

The statutory language is broad in reference to automated means, ensuring coverage regardless of the degree of automation involved.

Rationale

Lawmakers include the automated means criterion to address the reality that modern personal data processing predominantly occurs using electronic systems. The intent is to capture:

• Electronic databases, CRM systems, HR management software, and algorithmic data analysis.
• Any hybrid situations where processes are partly manual and partly automated.

Implications

For Business

• Covered Activities: Any processing of personal data using computers, software tools, automated decision-making, or even semi-automated workflows falls within the PDPA’s scope. For example, storing employee records in a digital HR system or maintaining customer information in a CRM is subject to the law.
• Non-Covered Activities: Purely manual records (e.g., handwritten notes not organized as a structured filing system) that are not intended to be part of an organized manual filing system are not covered under this criterion.
• Examples:
  • A payroll system calculating salaries automatically: Covered.
  • Scanning paper forms into a searchable digital archive: Covered.
  • Physical files sorted by employee name but never digitized or meant to be digitized: Not covered by the automated means criterion but may be covered if structured as a manual filing system.

The criterion brings technological neutrality and legal certainty to the regulation of personal data processing by extending protection to data handled using modern methods.