DATA PROTECTION LAWS OF THE WORLD of personal data is subject to express and prior consent from the data subject and prior notification to the APD. However, data subject consent is not required in certain circumstances provided by law. With respect to sensitive data processing, collection and processing is only allowed where there is a legal provision allowing such processing and prior authorization from the APD is obtained (please note that the authorization may only be granted in specific cases provided by law). If the sensitive personal data processing results from a legal provision, the same shall be notified to APD. In any case data processing must fulfull the following general principles: transparency, legality, good faith, proportionality, truthfulness, and respect to private life as well as to the legal and constitutional guarantees. It is also mandatory that data processing is limited to the purpose for which the data is collected and that personal data is not held for longer than is necessary for that purpose. There are specific rules applicable to the processing of personal data related to: sensitive data on health and sexual life illicit activities, crimes and administrative offenses solvency and credit data video surveillance and other electronic means of control advertising by email advertising by electronic means (direct marketing) call recording. has given his or her unequivocal consent or if processing is deemed necessary: Execution of an agreement where the data subject is a party, or, at the data subject’s request, negotiation in relation to such an agreement Compliance with a legal obligation to which the data processor is subject Protection of vital interests of the data subject if he or she is physically or legally unable to give his or her consent Performance of a public interest assignment or exercise of public authority powers vested in the data processor or in a third party to whom the personal data is disclosed, or Pursuing a data processor’s legitimate interest (or the legitimate interest of a third party to whom the data is disclosed), provided that the data subject’s interests or rights, liberties and guarantees do not prevail The data subject must be provided with all relevant processing information, including the identification of the data processor, the purpose of processing, and the means and forms available to the data subject for accessing, amending and deleting his or her personal data. Specific rules for the processing of personal data within the public sector also apply. TRANSFER TRANSFER International transfers of personal data to countries with an adequate level of protection require prior notification to the APD. An adequate level of protection is understood as a level of protection equal to the Angolan Data Protection Law. APD decides which countries ensure an adequate level of protection by issuing an opinion to this respect. The transfer of personal data outside Macau can only take place if the recipient country ensures an adequate level of personal data protection, unless the data subject has provided clear consent and the required filings have been made with the OPDP. International transfers of personal data to countries which do not ensure an adequate level of protection are subject to prior authorization from the APD which will only be granted in case specific requirements are fulfilled. In case of transfers between the companies of the same group, the requirement of an adequate level of protection may be 4 | Data Protection Laws of the World | Angola vs Macau | www.dlapiperdataprotection.com