Complaint Case Notes

編號: 0128/2015/IP

標題: Private CCTV cameras installed by flatowner

立案原因: Complaint


    This case stemmed from a number of CCTV cameras installed along the bottom edge of a balcony.  These cameras, as the Complainant claimed, pointed towards a public street and therefore asked the Office for Personal Data Protection (Gabinete para a Protecção de Dados Pessoais/GPDP) to investigate. 


    Personal data, according to the PDPA (Personal Data Protection Act, Law 8/2005), shall mean information of any type, irrespective of the type of medium involved, including sound and image, relating to an identified or identifiable natural person (“data subject”). 
  The investigations revealed that the balcony, as the Complainant reported, projected from a residential flat as owned by A.  No owners’ committee has been formed for the building that A lived in, nor building administrators or management companies have been consigned to oversee it.  A expressed that earlier he had money disputes and led to threat at his life which he reported to the police.  For his own security and protecting his family, he installed a number of CCTV cameras inside and outside his flat.  These cameras captured images from his flat areas, the flat entrance on the communal corridor, the building entrance and the street that extends from the said building to the main road. 
  In regards to the cameras installed inside the flat and in the corridor that pointed towards his flat entrance, since they only captured images from the flat area or his flat flat entrance, their installation was for household security and not intended to capture images of any particular persons.  In addition, according to Article 3(2) of the PDPA, it does not apply to the data processing arisen from the said cameras since the captured images were not sustained by the available evidence that they had been used for systematic communication and dissemination.  On the other hand, for those installed in the corridor outside his flat, as corridor walls are qualified as communal areas according to the Civil Code, as approved by Decree Law 39/99/M, the management and use of such communal areas are subject to the decision of the Condominium Owners’ Meeting.   
  With regard to those cameras installed on the walls of the balcony, not only they captured images from the neighbours’ balconies but also from the entrance of the opposing buildings and the entire street.  In other words, images of the passers-by and cars on the street were captured – apparently an excessive coverage in relation to the purpose of A’s household security.  This justified that it is not a situation where Article 3(2) of the PDPA applies, but rather is subject to Article 3(1) of the same Law. 
  As long as the PDPA applies, a data controller should meet the requirements of Article 6 of the same Law, in order to legitimatize its data processing.  In fact, obtaining unambiguous consent from everyone who had been captured by the said cameras was impossible, also out of the question was A had fulfilled any of the criteria laid down by paragraph (1) to (4) of Article 6 of the same Law to legitimize his data processing.  For Article 6(5) to apply, it is necessary to consider the legitimate interests of A and those of the data subjects (all those whose images had been captured), which are competing interests, and to decide which of them can override. 
  Normally speaking, whenever cameras are installed for security, they can, to a certain extent, prevent crime and assist criminal investigations, if any.  In the same way, it could not rule out that A did not have any legitimate interests with regard to these cameras.  If A, however, was using the cameras to capture images from the public area namely for his personal interests, without proper consideration of the interests and the rights of other data subjects – a reason that A could not rely on as the legitimate interests grounds, given in Article 6(5) of the PDPA, for his processing.  As a consequence, the GPDP ordered A to remove all the cameras that were contrary to the PDPA requirements.  


    Originally A installed the mentioned cameras for his household security, which was in compliance with Article 3(1) of the PDPA.  Some of the cameras, however, excessively captured images from where other than A’s lodging spaces, including the balconies of his neighbours, entrance of the opposing buildings and the public street.  This showed that this was an excessive capturing of images and the data processing arisen from these cameras, therefore, was subject to the PDPA.  
  Since these cameras were subject to the PDPA and they were capturing images from where other than A’s lodging spaces and for his personal interests, without proper consideration of the interests and rights of other data subjects, the data processing of these cameras, therefore, could not be legitimized under Article 6(5) of the PDPA.  Therefore, the GPDP asked A to remove all the cameras that were contrary to the PDPA requirements and this case had closed after the removal.  

Please refer to Article 3, 4, and 6 of the Personal Data Protection Act and the Civil Code.