The Personal Data Protection Act (PDPA) of Macau extends its applicability to data controllers not established in Macau but using equipment located within the jurisdiction for data processing.

Text of Relevant Provisions

PDPA Art.3(3):

"This Act shall apply to video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified, provided the controller is domiciled or based in the Macao Special Administrative Region (the MSAR) or makes use of a computer or data communication network access provider established on the MSAR territory."

Analysis of Provisions

Article 3(3) of the PDPA establishes the territorial scope of the law, specifically addressing the use of equipment within Macau. The provision extends the applicability of the PDPA to controllers who are not domiciled or based in Macau but utilize equipment located within the jurisdiction for data processing activities.

The law specifically mentions "video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified". This indicates that the provision is particularly concerned with audiovisual data processing that can lead to the identification of individuals.

The key factor for applicability is the use of "a computer or data communication network access provider established on the MSAR territory". This broad language encompasses various types of equipment and technological infrastructure that could be used for data processing activities.

It's important to note that the provision does not explicitly exclude the use of equipment solely for transit purposes, which is a common exception in many jurisdictions. This could potentially lead to a broader application of the law.

Implications

The implications of this provision are significant for businesses operating in or interacting with Macau:

1. Extra-territorial reach: Companies not based in Macau may still fall under the PDPA's jurisdiction if they use equipment located in Macau for data processing activities.
2. Broad interpretation of "equipment": The law's reference to computers and network access providers suggests a wide range of technological infrastructure could be considered.
3. Focus on audiovisual data: While the provision specifically mentions video surveillance and audio-visual data, it may be interpreted to cover other forms of personal data processing using equipment in Macau.
4. Potential impact on cloud services: Companies using cloud services with servers or infrastructure in Macau might be subject to the PDPA, even if they are not directly established in the jurisdiction.
5. Compliance considerations: Organizations processing personal data of Macau residents or using equipment in Macau should assess their activities to determine if they fall under the PDPA's scope and ensure compliance with its requirements.