(AAB Appeal No. 7 of 2019)
Installation of CCTV in public corridors – Security of a residential building – Purpose and manner of collection of personal data – Unfair and excessive collection – Retention and security of CCTV footage – Alleged contravention of DPP1 and DPP4 –
Coram:
Dr Lo Pui-yin (Presiding Chairman)
Ms Wendy Yuen Miu-ling (Member)
Mr Lawrence Ng San-wa, M.H. (Member)
Date of Decision : 27 February 2020
The Complaint
The Appellant complained against the Incorporated Owners of a building (in which she was residing) for installation of two CCTVs in the public corridor of every floor of the building. One of the CCTVs on her storey was located in the proximity of her flat. The Appellant claimed, inter alia, that:-
1) the collection of her personal data was unfair and excessive;
2) the Incorporated Owners should adopt other means to achieve the purpose of enhancing safety and security of the building;
3) the Incorporated Owners did not undertake sufficient measures to prevent the CCTV footage from unauthorized access and leakage.
The Incorporated Owners stated that the installation of CCTVs was a measure to enhance safety and security of the building after the happening of some criminal incidents. The decision to install CCTVs had been resolved at the owners’ meeting and conspicuous notices were displayed at the lobby of the building and the public corridors of each floor. The CCTV footage was password-protected and could only be accessed by authorized persons.
The Commissioner's Decision
Relying on the Court of Appeal’s judgment in Eastweek Publisher Limited & Another v Privacy Commissioner for Personal Data [2000] 2 HKLRD 83, the Commissioner took the view that installation of CCTVs should not be regarded as collection of the Appellant’s personal data. When the Incorporated Owners had to review the CCTV footage for identifying a person and collecting evidence in case of suspected crimes or security matters, this would involve collection of personal data. In this situation, the collection would be in relation to the Incorporated Owner’s managerial work and would unlikely amount to unlawful or unfair collection. Further, after the Commissioner’s enquiry, it was noted that notice of CCTV had been given to data subjects; retention period of the CCTV footage was not unreasonable and only authorized persons could have access to the CCTV footage. The Commissioner therefore took the view that there was no prima facie evidence of any contravention of the requirements under the Personal Data (Privacy) Ordinance (the Ordinance) after preliminary enquiry and closed the case by relying on section 39(2)(d) of the Ordinance and Complaint Handling Procedure paragraph 8(e).
Dissatisfied with the Commissioner's decision, the Appellant lodged an appeal to the AAB.
The Appeal
Taking into account parties’ submissions and the available evidence, the AAB affirmed the Commissioner’s decision not to proceed with the Appellant’s complaint. The AAB agreed that the Incorporated Owners installed the CCTVs for security purpose and its intention was not to compile information about the Appellant or any other identified persons. Whilst the AAB took the view that images captured by the CCTV should be regarded as personal data, based on the Eastweek case, there was no collection of personal data by the Incorporated Owners.
In an epilogue, the AAB raised its concerns about the Court of Appeal’s interpretation of “collection of personal data” in the Eastweek case. The AAB took the view that the interpretation was narrowly construed and outdated. That said, the AAB acknowledged that the Eastweek case was still binding for the time being.
The AAB's Decision
The appeal was dismissed.
(Uploaded in March 2020)