Complaint Case Notes

編號: 0004/2014/IP

標題: Taking pictures of colleagues during work

立案原因: Complaint


    Citizen A works for Bureau X. Colleague B took pictures of A during work without his consent and displayed it to his supervisors, C and D; the picture showed that A fell asleep at work.
  A believed that B might have violated the Personal Data Protection Act (PDPA, or Law 8/2005) and thus filed a complaint to the Office for Personal Data Protection (GPDP).


    According to Article 3(2) of the PDPA, this Law shall not apply to the processing of personal data carried out by a natural person in the course of a purely personal or household activity, save those with the purposes of systematic communication and dissemination. Referring to the Statement of the Working Party on current discussions regarding the data protection reform package for Directive No.95/46/EC, Article 29 Working Group of EU, the GPDP provided the following recommendations on how to determine whether a particular processing falls within the scope of personal or family activity: 1) Is the personal data disseminated to an indefinite number of persons, rather than to a limited community of friends, family members or acquaintances? 2) Is the personal data about individuals who have no personal or household relationship with the person posting it? 3) Does the scale and frequency of the processing of personal data suggest professional or full-time activity? 4) Is there evidence of a number of individuals acting together in a collective and organised manner? 5) Is there the potential adverse impact on individuals, including intrusion into their privacy?
  In GPDP’s opinion, B showed the pictures he took to C and D, which meant those who could view the photo were definite. As superior-subordinate relationships did not exist between B and A, B was not taking the picture, which showed that A felt asleep, for managing his works. No information showed that B was joining others to take the picture and thus it showed that this [taking picture] was only a personal decision that B made and was not related to his works or professions, nor for any designated tasks. Bureau X indicated that the act of B was not for the performance of any instructions or order he had been given, and A also pointed out that C and D had not collected B’s photo. Therefore, the fact that B took A’s photo and processed the latter’s imagery data had no relations to Bureau X and should be regarded as a personal behavior of B. As A mentioned that C and D knew that he felt asleep at work because he was ill, and therefore they did not collect his photo nor imposed to him any punishment.  The available information, at the same time, did not justify that what B did caused negative impact to A.
  To sum up, B took pictures of A and showed that to C and D, and this was only his personal behaviour. In addition, no system communication or transmission was involved. Therefore, it is a case specified in Article 3(2) of the PDPA whereby this Law did not apply.


    The GPDP has informed Citizen A and Bureau X the investigation outcomes and this case was closed.

Please refer to “Personal Data Protection Act”, article 3.