Macau Data Protection Law: Processing by Entity Registered or Incorporated in Jurisdiction

The factor of Processing by Entity Registered or Incorporated in Jurisdiction is used in determining the law's applicability by ensuring that entities domiciled or based in Macau, or using local network access providers, are subject to the Personal Data Protection Act (PDPA) for certain types of data processing activities.

Text of Relevant Provisions

PDPA Art.3(3):

"3. This Act shall apply to video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified, provided the controller is domiciled or based in the Macao Special Administrative Region (the MSAR) or makes use of a computer or data communication network access provider established on the MSAR territory."

Analysis of Provisions

The Personal Data Protection Act (PDPA) of Macau extends its applicability to specific types of data processing activities based on the location or operational characteristics of the data controller. This provision focuses on video surveillance and other forms of audio-visual data capture that allow for personal identification.

Key elements of this provision include:

1. Scope of activities: The law applies to "video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified."
2. Controller's location: The law applies if the controller is "domiciled or based in the Macao Special Administrative Region (the MSAR)."
3. Use of local infrastructure: Even if not based in Macau, the law applies if the controller "makes use of a computer or data communication network access provider established on the MSAR territory."

This provision ensures that entities processing audio-visual personal data in or through Macau are subject to the PDPA, regardless of their primary place of establishment. The inclusion of network access providers extends the law's reach to entities that might be using Macau's digital infrastructure for data processing activities.

Implications

This provision has several important implications for businesses:

1. Local entities: All organizations domiciled or based in Macau that engage in video surveillance or similar audio-visual data processing must comply with the PDPA.
2. Foreign entities using local infrastructure: Companies not based in Macau but using local network providers for data processing activities related to video surveillance or audio-visual identification fall under the law's scope.
3. Scope limitation: The provision specifically applies to audio-visual data that allows for personal identification, potentially excluding other forms of data processing from this particular clause.
4. Compliance requirements: Entities falling under this provision must ensure their video surveillance and audio-visual data processing activities comply with all aspects of the PDPA.
5. Infrastructure considerations: Companies may need to carefully consider their use of Macau-based network providers, as this could bring them under the PDPA's jurisdiction for certain activities.
6. Extraterritorial effect: The law can have an extraterritorial effect by applying to foreign entities that use Macau's digital infrastructure for specific data processing activities.
7. Technology-specific focus: The emphasis on video surveillance and audio-visual identification reflects the law's adaptation to modern data collection technologies and their potential privacy implications.