Response to Media Enquiry or Report

Response to media enquiry on monitoring illegal parking by CCTV system in East Kowloon

• The Personal Data (Privacy) Ordinance (the Ordinance) governs all public and private organisations in Hong Kong, and does not prohibit data users (individuals or organisations) from installing or using CCTV monitoring system.

• In general, if it is not possible for one to ascertain the identity of a person in a video footage, or if it is only a real-time monitoring without recording involved, then the CCTV monitoring would not amount to “collection of personal data” as defined under the Ordinance and the matter concerned will fall outside the jurisdiction of the Ordinance.

• While CCTV monitoring may not be used to target identified individuals, the principle of transparency is strongly encouraged as a good practice of a data user. For instance, conspicuous notices should be put up in the monitored areas notifying drivers or passers-by that CCTV system for monitoring illegal parking purpose is in use.

• If the purpose of the installation is to collect or compile information about identified persons, the data users then must comply with the provisions of the Ordinance and the Data Protection Principles (DPPs), in particular:
  • Data users should take all practical steps to notify the data subjects (e.g. drivers or passers-by) of the purpose of data collection, and the classes of persons to whom the data may be transferred (DPP1(3) – Data Collection Principle).
  • Personal data collected should be deleted as soon as practicable once the purpose of collection is fulfilled (e.g. the recorded images captured by the CCTV system for illegal parking monitoring purpose should be securely deleted regularly if no incident concern is discovered or reported) (DPP 2 – Data Retention Principle).
  • Personal data collected shall only be used (including disclosure and transfer) for the purposes for which it was collected or for a directly related purpose (e.g. transportation or vehicle parking management), unless voluntary and explicit consent with a new purpose is obtained from the data subjects (DPP3 – Data Use Principle), or when any applicable exemptions under the Ordinance apply (e.g. the use of the data is for crime prevention or detection).

• The Privacy Commissioner has issued the “Guidance on CCTV Surveillance and Use of Drones” which offers advice to data users on determining whether CCTV should be used in given circumstances, and how to use CCTV responsibly, including:
  • Before using CCTV, data users should carry out a privacy impact assessment to decide if the use of CCTV in the circumstances of the case is justified for the performance of the lawful function and activity of the data user and whether there are less privacy-intrusive alternatives.
  • No CCTV cameras should be installed in places where people have a reason to expect privacy (e.g. changing room). 
  • People should be explicitly informed that they are subject to CCTV surveillance. An effective way is to put conspicuous notices at the entrance to the monitored area, and reinforce by affixing further notices inside the area.
  • The notices should contain details of the data users operating the CCTV system, the specific purpose of monitoring and the person to whom matters relating to personal data privacy issues can be raised.
  • Other recommendations include proper handling of the recorded images, exercising due care when asked to transfer CCTV records to third parties, having transparent policy and practice of handling personal data in place, and conducting regular reviews.