Response to Media Enquiry or Report

Date: 7 September 2017

Privacy Commissioner Responses to Media Enquiry on the use of CCTV in Combating Against Illegal Parking

Thank you very much for your enquiry. Our general observations from the perspective of personal data privacy are as follows:
 
·         Our office finds it not appropriate to comment on the legality of certain practice of a data user in the absence of sufficient information or consultation. 
 
·         Under the Personal Data (Privacy) Ordinance (the “Ordinance”), “personal data” is defined as information which relates to a living person and can be used to identify that person. The data exists in a form in which access or processing is practicable.  Apart from written documents, personal data in other forms such as video footages are also covered under the Ordinance.  However, if it is not possible for one to ascertain the identity of the person in the footages, or if it is only a real-time monitoring without recording involved, then the CCTV monitoring would not amount to “collection of personal data” as defined and the matter concerned will fall outside the jurisdiction of the Ordinance.
 
·         All data users (persons who control the collection and use, including disclosure and transfer, of personal data) must comply with the provisions and the six Data Protection Principles (DPPs) under the Ordinance, in particular:-
o   Data users should take all practical steps to notify the data subjects (e.g. drivers) of the purpose of data collection, and the classes of persons to whom the data may be transferred (DPP1(3) – Data Collection Principle).
o   Personal data shall only be used for the purposes for which it was collected or for a directly related purpose (e.g. to monitor illegal parking), unless voluntary and explicit consent with a new purpose is obtained from the data subject (DPP3 – Data Use Principle), or when any applicable exemptions[1]  under the Ordinance apply (e.g. the use of the data is for crime prevention or detection; the apprehension, prosecution or detention of offenders; the prevention, preclusion or remedying (including punishment) of unlawful or seriously improper conduct; and ascertaining whether the character or activities of the data subject are likely to have a significantly adverse impact on anything to which the discharge of statutory functions by the data user relates).
 
  
·         The Privacy Commissioner has issued the “Guidance on CCTV Surveillance and Use of Drones” which offers advice to organisations on determining whether CCTV should be used in given circumstances, and how to use CCTV responsibly, including:
o   Before using CCTV, data users should carry out a privacy impact assessment to decide if the use of CCTV in the circumstances of the case is justified for the performance of the lawful function and activity of the data user and whether there are less privacy-intrusive alternatives.
o   No CCTV cameras should be installed in places where people have a reason to expect privacy (e.g. changing room). 
o   People should be explicitly informed that they are subject to CCTV surveillance. An effective way is to put conspicuous notices at the entrance to the monitored area, and reinforce by affixing further notices inside the area.
o   The notices should contain details of the organisation operating the CCTV system, the specific purpose of monitoring and the person to whom matters relating to personal data privacy issues can be raised.
o   Other recommendations include proper handling of the recorded images, exercising due care when asked to transfer CCTV records to third parties, having transparent policy and practice of handling personal data in place, and conducting regular reviews.
 
·         We acknowledge the public concern that is likely to arise from the said practice, that whilst the stated purpose of the use of CCTV is combating against illegal parking, the possibility of capturing personal data other than that intended for the stated purpose may be collected and used albeit in a public area. The Privacy Commissioner would monitor the development of the issue and its impact to the personal data privacy of the members of the public, and would share the views with the Police when more details on the proposed practice are available.