As data privacy and security concerns have grown worldwide, the Macau authorities have increased their focus on the territory’s data protection rights. This is good news for luxury brands and their efforts to ensure that personal data processing is transparent and strictly respects an individual’s privacy.

Macau’s data protection framework

Macau's data protection legal framework draws heavily from European Union legislation, emphasising transparent and respectful processing of personal data under the Personal Data Protection Act. This legislation governs various aspects of data handling, including collection, storage, modification and disclosure. As global concerns about data privacy and security mount, amendments to the Act are anticipated to address evolving technological challenges.

Apart from the Act, luxury brands with operations in Macau must also comply with the General Data Protection Regulation (GDPR) and China’s Personal Information Protection Law (PIPL), given their extraterritorial reach. Compliance obligations arise when a Macau company processes personal data related to individuals within China or the EU for product or service provision.

Under Article 6 of the Act, personal data collection and processing require clear consent from the data subject or adherence to specific legal bases. While explicit consent is vital, the Act permits exceptions, such as data processing for contractual obligations or legal compliance. Notably, there’s no explicit provision for direct marketing, yet data collection must align with lawful purposes, requiring explicit consent from the data subject.

Data protection in practice

Data controllers in Macau are vested with the authority to utilise, process and transfer personal data, but they must adhere to certain obligations, including notification and prior authorisation from the Office for Personal Data Protection (GPDP). Conversely, data processors must strictly follow documented instructions and implement robust technical and organisational measures to protect personal data.

Cross-border data transfers require careful consideration, and must adhere to legal requirements and implement adequate safeguards to protect personal data. While authorisation from the GPDP is typically necessary, exceptions exist under Article 20 of the Act, enabling transfers without prior approval in certain circumstances, such as explicit consent or contractual necessity. Transparency and communication with individuals regarding cross-border transfers are pivotal for maintaining trust and ensuring compliance with data protection regulations.

Entities that, as a result of negligence, neglect their duty to notify the public authority about the processing of personal data, furnish false information, fail to fulfill the notification requirements concerning the submitted information, or continue to grant access to open data transmission networks to data controllers who violate the regulations of this law, commit an administrative offence. This offence is subject to a fine ranging from MOP$10,000 to a maximum of MOP$100,000.

By prioritising compliance and adopting robust data protection measures, luxury brands in Macau can safeguard customer information, uphold privacy standards and fortify their reputation as responsible custodians of personal data in the digital era. Emphasising data protection not only fosters compliance with legal frameworks but also enhances brand reputation and customer loyalty, positioning luxury brands as leaders in the protection of sensitive personal information.

Bruno Nunes is the founder of the Macau and Portuguese business law firm BN Lawyers and practises in the areas of corporate law, intellectual property, gaming law and arbitration. He is a registered lawyer in the Macau Lawyers Association, the Portuguese Bar Association and the Department of Justice of the Guangdong Government (China). To learn more about the legal aspects of doing business in Macau or to receive the BN Macau Luxury Guide, contact Bruno at [email protected].