The filing system criterion in China - Macau PDPA extends the law's applicability beyond automated processing to include manual processing of personal data that forms part of or is intended to form part of a structured manual filing system.

Text of Relevant Provision

PDPA Art.3(1):

"This Act shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a manual filing system or which are intended to form part of a manual filing system."

Analysis of Provision

The provision establishes a dual scope of application covering both automated and manual processing. The phrase "processing otherwise than by automatic means" specifically addresses non-digital processing, while the filing system criterion is defined through the concept of "manual filing system".

The law applies to manual processing in two distinct scenarios: first, when personal data "form part of a manual filing system", covering data already organized within structured manual systems; and second, when data "are intended to form part of a manual filing system", extending protection to data being prepared for systematic organization.

The criterion requires that manual data processing involve systematic organization rather than ad hoc handling. By referencing "manual filing system", the law distinguishes between random, unstructured manual processing (which falls outside the scope) and organized, retrievable manual data storage that mirrors the systematic nature of automated processing.

The rationale for including this criterion stems from the principle that data protection should be technology-neutral. Whether personal data is processed digitally or manually, the privacy risks remain similar when data is systematically organized for easy retrieval and access.

Implications

For businesses operating in Macau, this criterion significantly expands compliance obligations beyond digital systems. Companies maintaining organized paper files, card systems, or other structured manual records containing personal data must comply with the PDPA's requirements, including data protection principles, individual rights, and security measures.

The criterion applies to situations such as:

• Employee files organized alphabetically or by department
• Customer records maintained in systematic paper filing systems
• Manual databases organized by categories or indexes

The law does not apply to:

• Randomly stored documents without systematic organization
• One-off manual processing lacking filing system structure
• Purely temporary manual handling not intended for systematic storage

The inclusion of data "intended to form part of a manual filing system" means that even temporary manual processing activities undertaken as part of building or maintaining organized filing systems fall within the law's scope.