Complaint Case Notes

編號: 0008/2011/IP

標題: A commercial enterprise publicly displaying the photos and recordings of suspected shoplifters

立案原因: Reports


    A citizen reported that two branches of Company A(a commercial enterprise) might have violated the Personal Data Protection Act by publicly displaying photos and recordings, in which suspected shoplifters were easily recognized, therefore filed a report with GPDP.


    According to Articles 4(1)(1) and 3(1) of the Personal Data Protection Act, the data processing involved in this case falls within the regulatory scope of the said Act.
  Company A replied, in writing, that it displayed publicly the aforementioned personal data because it urged for a quick solution to the negligence of some of its branch supervisors and the frequent instances of shoplifting.
  In GPDP’s opinion, Company A, out of security consideration, installed video surveillance system in its commercial premises, aims to protect its properties or other legal interests. In contrast, the personal interests of the involved parties did not overweigh the legitimate interests of Company A, and the latter are in conformity with the legitimacy as provided by Article 6(5) of the Personal Data Protection Act. However, Company A had deviated from the security purpose by publicly displaying the photos and recordings of the suspected shoplifters from the data the company captured.
  Back in 2008, Company A has been informed of GPDP’s decisions on the same sort of complaint. Obviously, regarding its video surveillance system, Company A has yet to formulate any relevant policies for its branch supervisors to comply with. Company A should be responsible for its negligence in guiding and supervising its staff.
  In summary, Company A violated Article 5(1)(2) of the Personal Data Protection Act by publicly displaying the personal data of the suspected shoplifters.


    This has been the second time Company A publicly disclosing suspected shoplifters’ personal data, wherein two of its branches were involved, and one of them even screened the concerned video recordings in public. Taking the above into account, in accordance with Articles 33(1) and 35(1) of the said Act, GPDP decided to impose a fine of MOP10,000, and this punishment has been implemented.

Please refer to "Personal Data Protection Act", articles 3,4,5,6,33,35 .