Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

23 / 192

“collection of personal data”, the Eastweek case contains other dicta that seem to
confine the scope of the Ordinance. Examples were quoted in the judgment (92G to I)
of photos taken and published in the newspaper by the business editor in order to
illustrate a social phenomenon, such as a crowd jostling in a queue for an initial public
offering of shares or the purchase of flats in a new property development. A features
editor may also publish photographs of teenagers smoking cigarettes in an article on
health concerns. Likewise, a sports editor may publish a picture of racegoers at Happy
Valley to illustrate attendance in record high numbers. Though the persons being
photographed in these situations might not like the idea of having pictures containing
their images published, insofar as their identities are not known to the publisher and
there is no evidence to prove that their identities are of relevant concern to the
publisher, it does not amount to collection of their personal data, according to the dicta
in the Eastweek case.
3.21 Particularly noteworthy is the following passage in Ribeiro JA’s judgment (92J) after
quoting the examples mentioned above:
. . . in none of those cases is the publisher or editor in question seeking to collect personal data
in relation to any of the persons shown in the photographs and, in my view, the taking of such
pictures and their use in such articles would not engage the data protection principles . . .”
[emphasis added]
3.22 Of the six data protection principles in Schedule 1 of the Ordinance, DPP1 deals with the
collection of personal data. It follows that, without collection of personal data, DPP1
would not be engaged. Where DPP1 is not engaged (i.e. there has not been a
collection of personal data) in a given situation, the Ordinance is not applicable.
3.23 The Court’s judicial interpretation of the term “collect” clarifies the regulatory remit.
Given the very wide definition of “personal data” in section 2(1), the application of the
requirements under the Ordinance in a mechanical manner could lead to practical
difficulties, not to mention anomalies in relation to activities where the handling of
personal data is not in issue.
Practical Example: Whether the Use of CCTV4 for Security or Monitoring Purposes
Amounts to Collection of Personal Data
3.24 The use of CCTV devices for monitoring purposes is a prevalent practice in Hong Kong,
for a variety of reasons. For instance, law enforcement agencies may install CCTV to
prevent and detect the crime of dropping objects from a height, or to monitor
pedestrians and traffic flow at busy and strategic locations. Banks may install CCTV at
bank premises for security reasons, and employers may install CCTV for both security
reasons and to monitor staff attendance. The management company of a building may
also install CCTV inside lifts to ensure the personal safety of the residents and visitors.
3.25 Three scenarios are considered below to illustrate whether there is collection of personal
data. The first scenario relates to the installation of CCTV which does not have a
4 See Privacy Guidelines: Monitoring and Personal Data Privacy at Work, available on the Website: