The Personal Data Protection Act (PDPA) of Macau applies to certain data processing activities within the jurisdiction, specifically focusing on the use of local technological infrastructure rather than the physical location of processing activities.

Text of Relevant Provisions

PDPA Art.3(3):

"This Act shall apply to video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified, provided the controller is domiciled or based in the Macao Special Administrative Region (the MSAR) or makes use of a computer or data communication network access provider established on the MSAR territory."

Analysis of Provisions

The PDPA of Macau does not explicitly use the physical location of data processing activities as a standalone factor for determining its applicability. Instead, Article 3(3) focuses on two key elements that relate to the jurisdiction:

1. The domicile or base of the controller: The Act applies if "the controller is domiciled or based in the Macao Special Administrative Region (the MSAR)". This criterion is based on the establishment of the controller rather than the location of processing.
2. The use of local technological infrastructure: The Act also applies if the controller "makes use of a computer or data communication network access provider established on the MSAR territory". This provision extends the law's reach to controllers who may not be physically based in Macau but utilize local technological resources for their data processing activities.

The lawmakers' approach in this provision appears to focus on the connection to Macau's jurisdiction through either organizational presence or technological infrastructure, rather than the physical location of data processing activities. This approach likely reflects an understanding of the increasingly digital and distributed nature of data processing, where the physical location of processing may be less relevant or more difficult to determine than the use of local resources or the establishment of the controller.

It's worth noting that the provision specifically mentions "video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified". This focus on audiovisual data may indicate a particular concern with these types of processing activities, possibly due to their potential for privacy intrusion.

Implications

The implications of this provision for businesses and organizations are significant:

1. Broad territorial reach: Companies not physically based in Macau may still fall under the PDPA's jurisdiction if they use computer systems or network providers located in Macau. This could potentially affect cloud service providers, data centers, or companies using Macau-based IT infrastructure.
2. Focus on technological infrastructure: Organizations must carefully assess their technological setup and data flows to determine if they fall under the PDPA's jurisdiction, even if they are not physically processing data within Macau.
3. Relevance for audiovisual data: The specific mention of video surveillance and audio-visual data suggests that companies dealing with these types of data should be particularly attentive to compliance with the PDPA.
4. Potential extraterritorial effect: The provision could have an extraterritorial effect, as it may apply to controllers based outside of Macau who use local technological resources.
5. Compliance considerations: Companies operating globally or in the region need to consider whether their use of Macau-based IT infrastructure or network providers triggers compliance obligations under the PDPA, even if their primary operations are elsewhere.
6. Data localization implications: While not explicitly requiring data localization, this provision might incentivize companies to carefully consider the location of their data processing activities and the origin of their IT services to manage their regulatory obligations.

These implications underscore the importance for businesses to carefully evaluate their connections to Macau, both in terms of organizational presence and technological infrastructure, to determine their obligations under the PDPA. The focus on the use of local technological resources rather than the physical location of processing activities presents a nuanced approach to territorial scope that reflects the realities of modern, distributed data processing practices.