Response to Media Enquiry or Report

Response to the media enquiry on the disclosure of CCTV footage

Thank you very much for your email enquiry. Our consolidated response from the perspective of personal data privacy is as follows:

• Personal Data (Privacy) Ordinance (PDPO) protects personal data, which refers to information relating to a living individual and that can be used to identify that individual. Examples of personal data include names, addresses, telephone numbers, medical and employment records, recordings, videos and photos.
• Under the six Data Protection Principles of PDPO, a data subject has in general the following rights:
  • to ensure that the collection of the personal data is fair and for a lawful purpose;
  • to be informed of the intended use of the personal data;
  • to provide only personal data that is necessary for the prescribed purpose(s);
  • to reject any use of the personal data other than the prescribed purpose(s);
  • to ensure accuracy and safe retention of his/ her personal data
  • to access and correct his/ her personal data; and
  • to be informed of the data user’s openly available privacy policy.
• Concerning the right of accessing one’s personal data held by a data user, PDPO specifies that data subjects have the right to request access to and correction of their own personal data. In other words, a data subject has the right to request a data user, e.g. a government department or a company, to confirm whether it holds his/ her personal data, and to be supplied with a copy of the requested data. Such a request is called a data access request. PDPO covers the manner and timeframe for compliance with data access requests.
• Besides, under PDPO, a “relevant person” refers to “a person who has parental responsibility for a minor”. A “relevant person” on behalf of the data subject may make a data access request to the data user for obtaining the personal data of the data subject. For example, a parent may make a data access request to obtain the personal data of his/ her child.
• In the case of obtaining CCTV footage, a data subject can request access to the relevant CCTV footage containing his/ her personal data if his/her personal data has been collected and compiled. If the data subject is a minor, his/her parent can act as a ‘relevant person’ to request the personal data on behalf of him/ her.
• If the CCTV footage in question involves other people, their personal data should also be protected, because personal data is not owned by the administrator of the CCTV system (i.e. the data user), but belongs to an individual. Before disclosing the footage to the data subject, the data user should make every effort to prevent the identities of other people from being revealed, such as masking or blurring their facial images in the CCTV footage.
• The CCTV footage should only be used for the collection purposes. If CCTV footage is used for doxxing on the internet and cyberbullying, or individuals’ (including children’s) personal data is disclosed for the unlawful purposes of bullying, incitement and intimidation, and consent of the persons concerned was not obtained, it is certainly unfair and illegal, and causing the data subjects to suffer psychological harm. Persons engaging in such acts may have contravened section 64 (disclosing personal data obtained without consent from data users) of PDPO.