Complaint Case Notes

編號: 0010/2014/IP

標題: Installation of cameras around the school

立案原因: Complaint


    Citizen A reported that School X had several cameras installed around its school building. As almost all these cameras captured images from public roads, citizens passing by would also be covered, too, which brought disturbances to A and other citizens. In addition, Citizen A did not find any notices informing the video recording posted by the School X near the cameras.
  Citizen A believed that School X might have violated the Personal Data Protection Act (PDPA, or Law 8/2005) and thus filed a complaint to the Office for Personal Data Protection (GPDP).


    According to Article 4(1)(1) and Article 3(1) of the PDPA, the data processing involved in this case shall be governed by the same Law.
  School X had cameras installed around the school with the purposes to protect the safety of its students and properties; it has the right to decide for the purposes and methods of processing the video data. Therefore, School X shall be deemed as the data controller, as specified in Article 4(1)(5) of the PDPA. As the above purpose was in compliance with the principle of good faith, lawfulness and was legitimate, in addition that the personal interests of the data subjects did not precede the legitimate interests of the school, so School X established the legitimacy as specified in Article 6(5) of the PDPA.
  However, School X should also comply with the principle of proportionality as defined in Article 5(1)(3) of the Personal Data Protection Act. When assessing whether the specific video surveillance is appropriate and with minimum intervention, the number of video recording devices, the installation locations and the camera covering range, should be all taken into account. After investigations, School X was found with a large campus, which was mainly separated from the public streets by walls or wire meshes. In addition, as it was mainly an open-air campus, where high trees have been planted near some of the walls, therefore more security concern arises.  Each camera as installed, therefore, has a specific covering range, whereby captured images are basically not overlapped and the number of cameras installed around the school is acceptable. With regard to the installation locations, the cameras were installed at a certain height above the ground, recording images with fixed focus and without sound recording facilities. With regard to the covering range, some cameras may cover the public streets, pavements and other buildings and thus captured overlapping images. After being reminded by the GPDP, School X has narrowed the covering range of these cameras and also removed three cameras. At present excessive covering range no longer exist.
  Although School X had put up short notices to inform the data subjects of the recording, it may be found necessary for its large campus to have an appropriate number of notices in areas that covered by the cameras, as well as data processing policies should be established, in order to be in compliance with Article 10 and 11 of the PDPA. After being reminded by the GPDP, School X put up a number of notices around the campus, which were visible to people passing by in order to inform them that School X is the data controller.  This could help inform the data subjects that the processing was necessary for security purposes.  In order to avoid dispute, School X should specify the processing purposes, for instance, by pointing out that “[the processing] was conducted for security purposes”.  Moreover, School X should also formulate its own Personal Data Collection Statement or data processing policies, which will be available to the data subjects and for its staff to comply with.
  Though School X had taken certain security measures to protect the video data, data leakage would still arise due to fact that the display screens were installed in an area where public can access the unlocked CCTV system, in addition that only glass doors were installed there.  After being reminded by the GPDP, the School adopted technical measures to avoid the said problems, which was in line with Article 15 of the PDPA.
  To sum up, by installing video recording cameras around the campus School X did not commit any administrative offence, but further improvements should be made.
  In addition, under Article 21 of the PDPA, School X should submit an application of personal data processing to the GPDP as soon as possible.


    After being reminded by the GPDP, School X has introduced improvements and the case was closed.

Please refer to “Personal Data Protection Act”, articles 3, 4, 5, 6, 10, 11, 15 and 21.