Complaint Case Notes

編號: 0112/2015/IP

標題: CCTV cameras installed outside a shop

立案原因: Complaint


    This case stemmed from a complaint that cameras were installed outside Shop A that captured images from the residents of the building nearby, in which also the Complainant of this case lived.  The Complainant believed that there could be excessive recordable areas and requested the Office for Personal Data Protection to investigate.


    The investigation revealed that Shop A, for its premises security, installed eight cameras altogether.  The data processing of Shop A is subject to the Personal Data Protection Act (PDPA) according to its Article 4(1)(1) and 3(1). 
  The surveillance system installed for the Shop premises aimed at safeguarding its property and other legitimate interests, which were lawful and legitimate purposes according to Article 6(5), with regard to the criteria for making data processing legitimate.  The cameras, originally installed outside Shop A, were designated to capture images from the pedestrians, roads, the buildings at the other side of the road and the shops nearby; Shop A has significantly reduced the recordable areas of those cameras outside the shop, after having been reminded by the GPDP.  Notices were also been displayed in proper places to tell people that they might be recorded. 
  Later, Shop A informed that all the cameras were no longer in operation and the console and some of the cameras had been removed.  In other words, these cameras ceased to operate and did not involve any automatic data processing and the PDPA therefore does not apply.  Although these cameras were not operating, they might still lead to consequences that could affect Shop A, for instance, data subjects might believe that these cameras were still operating and they might exercise the rights as legally allowed.  As a consequence the GPDP reminded Shop A that these cameras should be covered up before they were completely removed.  The GPDP also informed Shop A that camera removal should be completed as soon as possible, as well as the deletion of all the captured images.  Shop A, afterwards, informed that all the cameras had been removed as well as all the captured images had been deleted.  


    After being reminded, Shop A removed all the cameras and deleted all the captured images and this case was closed.  

Please refer to Article 3, 4, and 6 of the Personal Data Protection Act.