In accordance with the provisions on public disclosure of information concerning data processing operations in No. 3 of Article 25 of Law No. 8/2005 (the Personal Data Protection Act), the Personal Data Protection Bureau (Direcção dos Serviços da Protecção de Dados Pessoais, hereinafter referred to as the PDPB) hereby presents to the public a general profile of personal data processing operations under taken by the PDPB.

I. Categories of data subjects; categories of personal data; purposes of data processing; data recipients

 

(I) Personal Data

 

1. Applications processing

 

(1) Categories of data subjects:

Applicants and other persons concerned in an application.

 

(2) Categories of personal data:

- Identification data: Name, address, telephone numbers, fax number, email address, type and number and copy of ID document, etc.;

- Other data: As required by law or with the consent of the data subjects.

 

(3) Purposes of data processing:

Processing the applications to the PDPB by virtue of the Personal Data protection Act.

 

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- When applications processing so requires, data may be disclosed to the persons or institutions involved in the processing, including other data controllers.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

2. Proceedings on inquiries, reports, complaints, and investigations

(1) Categories of data subjects:

Enquirers, reporters, complainants and persons concerned in an investigation.

 

(2) Categories of personal data:

Personal data supplied by data subjects, as well as those collected in accordance with law in the courses of enquiry-report-complaint processing as well as its follow-up investigations.

(3) Purposes of data processing:

Processing inquiries, reports, complaints, and investigations.

 

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- When enquiry-report-complaint processing and its follow-up investigations so require, data may be disclosed to persons or institutions involved therein, including other data controllers.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

3. Recruitment

(1) Categories of data subjects:
Job seekers.

(2) Categories of personal data:

- Identification data: Name, date of birth, place of birth, sex, nationality, address, telephone number, fax number, email address, education, language used, type and number and copy of identification document, etc.;

- Curriculum Vitae;

- Other data: As required by law or with the consent the data subjects.

 

(3) Purposes of data processing:
Recruitment.

 

(4) Data recipients:

Entities to be informed in accordance with law, or as requested by or with the consent of the data subject.

4. Organizing activities

(1) Categories of data subjects:

Participants and persons involved in activities organized (hosted, co-hosted or assisted) by the PDPB.

 

(2) Categories of personal data:

- Identification and contact data: Name, date of birth, place of birth, sex, nationality, address, telephone number, fax number, email address, education, language used, type, number and copy of identification document, occupation, job title, name of employer or school, type and number and copy of student card, photos, etc.; and, where applicable, data of parents or guardian (tutor / curador) if the data subject is a minor or an interdicted person (interdito / inabilitado);

- Activity data: audio and video (such as photos, audio or video recordings) data produced in the activities, performance, assessment, prizes and penalties, etc;

- Financial data: bank account data of persons concerned when payments, including fees and monetary prizes, are involved;

- Other data: Other data related to the activity.

 

(3) Purposes of data processing:

Activity-organising, record keeping and archiving.

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subject.

- Insurance providers involved.

 

5. Registration of visitors

(1) Categories of data subjects: 

Visitors to the PDPB.

 

(2) Categories of personal data:

- Identification data: Name, number of identification document or Staff Card;

- Institution data: Name of the institution provided by the data subjects representing an institution.

 

(3) Purposes of data processing: 

Registration of visitors.

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

6. Website management

(1) Categories of data subjects: 

Visitors to the Bureau's website.

(2) Categories of personal data:

URL of the workstation from which the visitor accesses the website, its IP address and location data; beginning and ending times of access; where visit is via a hyperlink from a third website, the URL of the site, etc.;

 

(3) Purposes of data processing:

Website management, especially statistical analysis.

 

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subject.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.
 

(II) Employees of the PDPB
 

1. Personnel management

 

(1) Categories of personal data:

- Identification data: Name, date of birth, place of birth, sex, nationality, address, telephone number, fax number, email address, education, language used, type and number and copy of identification document, taxation number, Social Security Fund number of the beneficiary, pension or provident fund contribution number of the beneficiary;

- Family information: Marital status, name of spouse, names of children and dependents, and other data for calculations of provision, subsidies or allowances;

- Employment information: Type of employment, working hours and place of work, internal identification card number and date of issue, seniority premium, position category, position category seniority premium, level of salary, contract nature and duration;

- Remuneration-related information: Basic salary, other fixed or non-fixed pay, subsidies, leaves, attendance record, special leaves, and other data related to additional payments, obligatory or non-obligatory amount deductions and tax payment deductions;

- Supplementary information: Level of working incapability of the employee and family members, temporary working incapability caused by industrial accidents or occupational diseases, place of payment, bank account number, identification data and membership number of the association or entity for which the obligatory or non-obligatory deductions are made;

- Disciplinary data: As required by statutory regulations;

- Other data: data collected in accordance with law, or with the consent of the data subjects.

 

(2) Purposes of data processing:

Personnel management; calculations and payments of various remuneration, provision, subsidies and allowances; calculations of obligatory or non-obligatory deductions from remuneration as regulated by legal provisions; execution of judicial decisions or verdicts, and handling of employees' applications; other data processing relating to remuneration, provision, subsidies or allowances.

 

(3) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- Entities responsible for managing the pension or provident fund.

- Insurance companies providing insurance for employees.
 

2. Email & internet monitoring

This section applies only to the employees' utilization of e-mail accounts provided by the PDPB to send and receive e-mails, and of informatics equipments provided by the PDPB to browse the internet, which is subject to the Personal Data Collection Statement and other regulations of the PDPB.

 

(1) Categories of personal data:

- Email addresses, dates and times and subjects and content of emails sent and received by employees;

- Times and URLs and data sent and received by employees when browsing the internet.

 

(2) Purposes of data processing:

Ensuring the quality of service, information security and appraising the performance of employees.

 

(3) Data recipients:

- Data may be disclosed to persons in charge of the disciplinary proceeding for disciplinary purposes.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

3. Biometric fingerprint-reader and hand-reader clocking system for attendance control
 

(1) Categories of personal data:

Employees' biometric finger and palm scanning data, internal identification number, name, position category, and date and time of arrival and departure, recorded by the system.

(2) Purposes of data processing:
Attendance management.

(3) Data recipients:

- Data may be disclosed to persons in charge of disciplinary proceedings for disciplinary purposes.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

(III) Other data

 

1. Telephone monitoring

This section applies only to the utilization of telephones of the PDPB with recording functions, which is subject to the Personal Data Collection Statement and other regulations of the PDPB.

 

(1) Categories of data subjects:

Users of telephones of the PDPB with recording functions, including citizens and employees.

 

(2) Categories of personal data:

Numbers and dates and beginning-and-ending times and voice recordings of outgoing and incoming calls.

 

(3) Purposes of data processing:

Ensuring the quality of service, appraising the performance of employees and guaranteeing the legitimate interests of PDPB.

 

(4) Data recipients:

- Data may be disclosed to persons in charge of disciplinary proceedings for disciplinary purposes.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

2. Video surveillance

This section applies only to the utilization of video surveillance equipments installed in the PDPB, which is subject to the Personal Data Collection Statement and other regulations of the PDPB.

 

(1) Categories of data subjects:

People going through areas installed with video surveillance equipments in the PDPB.

 

(2) Categories of personal data:

Audio and video data of people going through areas installed with video surveillance equipments in the PDPB.

 

(3) Purposes of data processing:

Protecting the PDPB' s assets/properties and other legitimate interests as well as the employees' safety and their other legitimate rights; ensuring the quality of service (restricted to the public reception areas); and appraising the performance of employees (restricted to the public reception areas, entrances and exits of offices, and the check-in/check-out areas with attendance control devices).

 

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- Data may be disclosed to persons in charge of disciplinary proceedings for disciplinary purposes.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

3. Management of suppliers and service providers

(1) Categories of data subjects:
Suppliers and service providers.

 

(2) Categories of personal data:

- Identification data: Name, age or date of birth, sex, language used, address, telephone number, fax number, email address, photograph, taxation number and bank account number.

- Other Data: Forms of payment, financial agency, and the related insurance company and insurance number.

(3) Purposes of data processing:

Managing contacts with the suppliers and service providers, as well as their billing and account data.

 

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

4. Management of incoming and outgoing documents and the archive

 

(1) Categories of data subjects:

Senders and receivers of documents, and people concerned in the documents to be archived.

 

(2) Categories of personal data:

- Identification data: Name, address, telephone number, fax number, email address.

- Other Data: As involved in the documents.

 

(3) Purpose s of data processing:

Management of incoming and outgoing documents and the archive.

 

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

 

5. Public relations

(1) Categories of data subjects:

People with whom the PDPB keep in contact in its public relation work.

 

(2) Categories of personal data:

- Identification data: Name, age or date of birth, sex, nationality, address, telephone number, fax number, email address, language used, occupation, job title, name of institution, and photograph, etc.

- Other Data: As involved in the PDPB's public relations.

 

(3) Purposes of data processing:
Management of public relations.

 

(4) Data recipients:

- Entities to be informed in accordance with law, or as requested by or with the consent of the data subjects.

- Data may be disclosed to the police or judicial authorities for criminal proceedings or prosecution purposes.

II. Data combination (inter-connection) and transfer

The PDPB will not combine (inter-connect) the personal data in its filing systems with those of other data controllers, nor will it combine (inter-connect) its personal data-bases of different purposes.

Unless it is required by law, or requested by or with the consent of the data subject, the PDPB will not transfer the data in its possession to a destination outside the MSAR. Under extraordinary circumstances, the director of the PDPB may allow the PDPB to transfer the data in its possession to a destination outside the MSAR on a case-by-case base, with the consideration on stipulations of Articles 19 and 20 of the Personal Data Protection Act.

III. Rights of data subjects

Data subjects may, in accordance with Articles 10 to 12 of the Personal Data Protection Act, exercise their legal rights of information, to access, to rectify, to object, etc., by using the forms prepared by the PDPB or by a written application to the director of the PDPB, free of charge.

IV. Amendment to this policy

The PDPB reserves the right to delete and revise anything of this policy without prior notice.