ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Macau SAR report)

• notice and consent requirements for processing personal data;
• alternative legal bases for processing personal data which permit processing of personal data without consent if the data controller undertakes a risk impact assessment (e.g., legitimate interests); and
• statutory bases for processing personal data without consent and exceptions or derogations from consent requirements in laws and regulations.

1. INTRODUCTION 

2. ROLE OF THE OFFICE OF PERSONAL DATA PROTECTION (“OPDP”)

3. SECTORAL LEGISLATION

4. CONSENT AND PRIVACY SELF-MANAGEMENT IN THE PERSONAL DATA PROTECTION ACT, LAW 8/2005 (“PDPA”)

5. CONDITIONS FOR CONSENT 

    5.1. Definition and forms of consent

    5.2. Withdrawal of consent

    5.3. Bundled consent

6. CONSENT FOR SPECIAL CATEGORIES OR USES OF DATA

    6.1. Children

    6.2. Direct marketing

    6.3. Biometric data

    6.4. Genetic data

    6.5. Financial information

    6.6. Statistics and research

    6.7. Pseudonymized data

    6.8. Location data

7. CONSENT FOR CROSS-BORDER DATA TRANSFERS

8. TRANSPARENCY AND NOTICE

9. SANCTIONS AND ENFORCEMENT 

    9.1. Administrative offenses

    9.2. Criminal offenses

    9.3. Civil liability

10. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT SUBJECT TO A RISK IMPACT ASSESSMENT

      10.1. Processing personal data under the PDPA

      10.2. Combining personal data under the PDPA

11. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT IN OTHER CIRCUMSTANCES DEFINED BY LAW

     11.1. Processing personal data without consent under the PDPA

     11.2. Processing sensitive personal data without consent under the PDPA

     11.3. Transferring personal data across borders without consent under the PDPA 

     11.4. COVID-19