Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

recording function or where the operator of the CCTV does not activate the recording

function. The sole purpose of installation is for deterring crime. In these cases, the

Ordinance does not apply since the activities of the individuals are not recorded at all

and hence no personal data is involved.

3.26

The second scenario concerns the use of CCTV which records the activities of individuals

who are within its recording range, but the operator does not intend to collect any

particular individual’s images as he is indifferent to the identities of the persons whose

images are being recorded. It is only when an incident happens or is reported that the

operator may seek to identify the individuals concerned for the purpose of taking

immediate or follow-up action. For example, a bank may install a CCTV overlooking an

ATM machine. The recorded images will be erased regularly or the tapes will be

overwritten at certain time intervals. However, if a robbery which happened within the

viewing range of the cameras is reported, the police may view the recorded images to

identify the suspect and gather evidence about the crime. As held in the Eastweek case,

there is collection of personal data where the police (not the bank) intend to collect

personal data of the suspect, the victim and other related parties.

3.27

In AAB No. 5/2011, the complainant complained about the installation of CCTV in a

community centre which recorded his activities without his knowledge. The AAB upheld

the Commissioner’s findings that there was insufficient evidence to show that the centre

had collected the personal data of the complainant. The CCTV was installed by the

centre for security and management purposes only. The operation of the CCTV did not

target the complainant or any particular person and the identities of the persons whose

images were recorded by the CCTV were not of interest to the centre.

3.28

In AAB No. 50/2014, the complainant complained about his neighbour's installation of

CCTV which would possibly capture images of the complainant and his family entering

or leaving their premises. The AAB adopted the test laid down in the Eastweek case and

concluded that the installation of the CCTV was for security purposes and not aimed at

collecting the personal data of the complainant and his family. Hence, the data

protection principles were not applicable.

3.29

The third scenario is the case where the use of the CCTV is explicitly for the purpose of

collecting personal data. If personal data is collected by the recording devices, the

operator should take heed of the requirements under the Ordinance and implement

appropriate personal data protective measures.

It is not uncommon for employers to

use CCTV to monitor and record the attendance of their employees. This amounts to

collection of personal data of the employees concerned. It is good practice for the

employers to conduct a privacy impact assessment before deciding to engage in

monitoring activities and to resort to the use of less privacy intrusive alternatives

whenever applicable.

See

Guidance on CCTV Surveillance and Use of Drones

, available on the Website: