Macau Data Protection Law: Processing by Local Establishment

The factor of Processing by Local Establishment is used in determining the law's applicability by ensuring that entities domiciled or based in Macau, or using local network access providers, are subject to the Personal Data Protection Act (PDPA) for certain types of data processing activities.

Text of Relevant Provisions

PDPA Art.3(3):

"3. This Act shall apply to video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified, provided the controller is domiciled or based in the Macao Special Administrative Region (the MSAR) or makes use of a computer or data communication network access provider established on the MSAR territory."

Analysis of Provisions

The Personal Data Protection Act (PDPA) of Macau extends its applicability to specific types of data processing activities based on the location or operational characteristics of the data controller. This provision focuses on video surveillance and other forms of audio-visual data capture that allow for personal identification.

Key elements of this provision include:

1. Local establishment: The law applies if the controller is "domiciled or based in the Macao Special Administrative Region (the MSAR)". This clearly establishes the applicability to entities with a physical presence in Macau.
2. Use of local infrastructure: Even if not based in Macau, the law applies if the controller "makes use of a computer or data communication network access provider established on the MSAR territory". This extends the law's reach to entities using Macau's digital infrastructure for data processing activities.
3. Scope of activities: The provision specifically applies to "video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified".

The rationale behind this provision is to ensure that entities processing sensitive audio-visual personal data in or through Macau are subject to the PDPA, regardless of their primary place of establishment. This approach helps to protect the privacy rights of individuals in Macau by covering a wide range of potential data controllers.

Implications

This provision has several important implications for businesses:

1. Local entities: All organizations domiciled or based in Macau that engage in video surveillance or similar audio-visual data processing must comply with the PDPA.
2. Foreign entities using local infrastructure: Companies not based in Macau but using local network providers for data processing activities related to video surveillance or audio-visual identification fall under the law's scope.
3. Scope limitation: The provision specifically applies to audio-visual data that allows for personal identification, potentially excluding other forms of data processing from this particular clause.
4. Compliance requirements: Entities falling under this provision must ensure their video surveillance and audio-visual data processing activities comply with all aspects of the PDPA.
5. Infrastructure considerations: Companies may need to carefully consider their use of Macau-based network providers, as this could bring them under the PDPA's jurisdiction for certain activities.
6. Extraterritorial effect: The law can have an extraterritorial effect by applying to foreign entities that use Macau's digital infrastructure for specific data processing activities.
7. Technology-specific focus: The emphasis on video surveillance and audio-visual identification reflects the law's adaptation to modern data collection technologies and their potential privacy implications.