The Personal Data Protection Act (PDPA) of Macau extends its applicability to monitoring activities within the jurisdiction, specifically addressing video surveillance and other forms of data capture involving sound and images that allow for personal identification.

Text of Relevant Provisions

PDPA Art.3(3):

"This Act shall apply to video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified, provided the controller is domiciled or based in the Macao Special Administrative Region (the MSAR) or makes use of a computer or data communication network access provider established on the MSAR territory."

Analysis of Provisions

The PDPA of Macau explicitly includes monitoring activities within its scope of application. Article 3(3) specifically addresses "

video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified

". This provision is significant as it extends the law's applicability to various forms of monitoring technologies that can identify individuals.The provision sets two key conditions for the law's applicability:

1. The nature of the data: The data must be in the form of "sound and images allowing persons to be identified". This broad definition encompasses a wide range of monitoring technologies beyond just video surveillance.
2. The location or technological connection of the controller: The law applies if either:a) "the controller is domiciled or based in the Macao Special Administrative Region (the MSAR)", orb) the controller "makes use of a computer or data communication network access provider established on the MSAR territory".

This second condition is particularly noteworthy as it extends the law's reach to controllers who may not be physically based in Macau but use technological infrastructure within the jurisdiction.The lawmakers' rationale for including this provision likely stems from the recognition of the increasing use of surveillance technologies and the need to protect individuals' privacy rights in public and private spaces. By explicitly mentioning video surveillance and similar technologies, the law ensures that these forms of data collection and processing are subject to the same data protection principles as other forms of personal data processing.

Implications

This provision has several important implications for businesses and organizations operating in or connected to Macau:

1. Broad scope of monitoring activities: Companies using any form of surveillance or monitoring technology that can identify individuals (e.g., CCTV, facial recognition systems, audio recording devices) must comply with the PDPA, regardless of the specific technology used.
2. Extraterritorial reach: Organizations based outside of Macau may still fall under the PDPA's jurisdiction if they use computer systems or network providers located in Macau for their monitoring activities. This could potentially affect cloud service providers or companies with data centers in the region.
3. Compliance requirements: Businesses engaged in monitoring activities must ensure they adhere to all PDPA requirements, including data subject rights, data protection principles, and potentially notifying or obtaining authorization from the Macau data protection authority.
4. Technological considerations: Companies must carefully assess their technological infrastructure and data flows to determine if they fall under the PDPA's jurisdiction, even if they are not physically present in Macau.
5. Potential for broader interpretation: While the provision specifically mentions sound and images, the phrase "other forms of capture" could potentially be interpreted to include other types of monitoring data in the future, such as location tracking or online behavior monitoring.

These implications underscore the importance for businesses to carefully evaluate their monitoring activities and technological infrastructure in relation to Macau, ensuring compliance with the PDPA even if they are not directly established within the jurisdiction.