The MSAR Government Portal has established user accounts for the public to log onto the websites of other public departments. For example, through these accounts they can access to the system of the Public Administration and Civil Service Bureau or the Pension Fund. Given both these public departments possess the personal data of the data subjects, but no transfer of personal data was initiated. If only data checks are conducted, can it be regarded as data combination? On the contrary if data combination exists, can data subjects’ uses of the service be understood as giving consent? Or it is necessary to acquire prior consent through written agreement from the data subjects?