Media Statements

Matters relating to Video-recording of Reporters' Identity Cards, etc.

In relation to media enquiries about a recent incident of video-recording of reporters’ personal data such as their Hong Kong identity cards (HKID cards) in public place, the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD), without commenting on individual cases, responds from the perspective of the Personal Data (Privacy) Ordinance (PDPO) as follows:
 

• Any organisation (as a data user) is required to act in accordance with the law, abide by the rule of law, follow established guidelines and mechanisms, and refrain from making arbitrary or cavalier decisions when collecting and processing personal data during its discharge of duties under the law.
   
• In accordance with Data Protection Principle 1 on the purpose and manner of data collection, the collection of personal data by an organisation shall be for a lawful purpose directly related to its functions or activities, shall not be excessive and shall be in a fair manner. The organisation must also explicitly inform the person from whom data is being collected (as the data subject) of the purpose of data collection, the purpose for which the data will be used, the classes of persons to whom the data may be transferred, etc. Otherwise, the means of data collection may be unfair.
   
• Privacy is not an absolute right and can be lawfully restricted. If any law enforcement agency conducts inquiries under the law on reasonable grounds to suspect that there are illegal activities, such collection of personal data for the purposes of investigation and prevention of crime will be exempted even if it contravenes the data protection principle. However, if there are no reasonable grounds to suspect that there are illegal activities, the collection of the personal data may be unnecessary and unlawful.
   
• The Basic Law, the Bill of Rights Ordinance and the PDPO protect privacy as a fundamental right of an individual aiming at safeguarding the dignity of the individual, which is one of the driving forces behind the newly amended European Union’s General Data Protection Regulation. As Professor Joseph Cannataci, the United Nations Special Rapporteur on the Right to Privacy, stated in the Human Rights Council on 9 March 2016, dignity is an overarching fundamental right, and privacy is one of those rights that enables human beings to exercise dignity. With the informational convergence brought about by modern digital technologies, it is also potentially dangerous for privacy and human dignity and a new balance is therefore needed.
   
• As regards means of data collection, recording a HKID card with video camera is considered as a relatively more privacy-intrusive means of collecting personal data. Organisations should consider and assess whether this means is necessary and fair under the practical circumstances in question, and whether there is other less privacy-intrusive means to collect data.
   
• HKID card number is sensitive personal data. According to the “Code of Practice on the Identity Card Number and Other Personal Identifiers” issued by the Privacy Commissioner, organisations should treat copies of HKID card (including video records of HKID cards) as confidential documents, collect and keep them under reasonably secure conditions to avoid unnecessary or intentional public display or disclosure.
   
• Any person who believes that his personal data has been collected or used unlawfully, unfairly or excessively, and can provide prima facie evidence, may complain to the PCPD. The PCPD will follow up and enforce the law in accordance with the powers conferred by the PDPO.
   
• As of 5:00pm on Monday, 11 May 2020, the PCPD did not receive any complaint or enquiry concerning the incident of video-recording of reporters’ HKID cards and other personal data.