Three major food delivery platforms in Macau were fined up to MOP60,000 for violating the Personal Data Protection Law, including for the transfer of user information outside Macau, which “has put the legitimate rights and interests of a large number of data subjects at unnecessary risk.”
According to a statement issued by the Office for Personal Data Protection (GPDP), the delivery platforms were fined MOP20,000, MOP30,000 and MOP60,000 respectively.
According to the office, when several food delivery platforms process personal data, although they may make different personal data protection commitments or guarantees to users through their contractual terms and conditions, in practice they lack sufficient compliance awareness and fail to carry out satisfactory personal data protection.
In terms of protection and compliance work, even the simple procedure of fulfilling notification obligations for automated processing of personal data in accordance with the provisions of the Personal Data Protection Law has not been completed as scheduled.
At the same time, the two platforms failed to perform their notification obligations in accordance with the law regarding the transfer of users’ personal data to places outside the SAR.
In addition, when the GPDP intervened to request corrections and fulfill the notification obligations, “one of the platforms continued to not discharge its compliance obligations and provided false information when fulfilling the notification obligation, which amounted to misleading the office.”
The office pledged to continue to monitor the processing of personal data by various platforms, refer to the regulatory experience of the mainland and international countries, coordinate supervision when appropriate, and do its best to protect the personal data of citizens and tourists.
Meanwhile, as cited in a TDM report, mFood said that it actively cooperates with the relevant compliance obligations under the GPDP, and cooperates during the investigation process. The company also pledged to strictly abide by the law to protect residents’ data. Staff Reporter
