Complaint Case Notes

編號: 0020/2014/IP

標題: Video surveillance system installed in the shop

立案原因: Report


    Citizen A found that cameras were installed over the entrances of Block One and Block Seven of Garden X. These cameras might also capture images of occupants and passers-by. A suspected that these cameras were installed by Company K, which was a shop in that area.
  A thought that Company K might have violated the Personal Data Protection Act (PDPA, or Law 8/2005) and thus reported to the Office for Personal Data Protection (GPDP).


    According to Article 4(1)(1) and Article 3(1) of the PDPA, the data processing found in this case shall be governed by the same Law.
  Investigations proved the said cameras were installed by Company K, which is the entity that had the right to decide for the [processing] of the imagery data captured. According to Article 4(1)(5) of the PDPA, Company K is the data controller of the personal data processing.
  Company K installed the video surveillance system in the buildings where it ran its business, with the purpose to protect the property and other lawful interests thereof.  Its purposes were lawful and legitimate, which were in accordance with the legitimacy as required by Article 6(5) of the PDPA.  According to the Civil Code of Macao, the management and use of the communal facilities of condominiums are decided by the building general assembly (assembleia geral do condomínio) and, therefore, Company K should also comply with respective legal provisions.
  According to GPDP’s investigations, the cameras were installed by Company K at the entrance of its shop and on the top of the entrance of Garden X. As a consequence these cameras could take images of those individuals and vehicles passed by, which meant the covering range was too wide.  Having been requested by the GPDP, Company K adjusted the said cameras and these cameras, at present, reduced its covering range to less capture images of the streets nearby and the building occupants. This was in line with the principle of proportionality as defined in Article 5(1)(3) of the PDPA.
  Notices, to inform the video recording, were only posted inside Company K, but not any other places where cameras were also installed and therefore the right to information of the data subjects was not satisfied.  Having been informed by the GPDP, it posted notices in places where appropriate, which was in compliance with Article 10(1) of the PDPA. 
  The computer which Company K used for storing the imagery data was installed in the room of its manger, who, normally, is the only person who has access to there and has the right to view the captured images. Moreover, the computer system requires the person to use his passwords and username to log in. This showed that Company K has taken corresponding security measures to protect the images collected by the video surveillance system. No evidence proved that Company K violated Article 15 of the PDPA.
  After being informed by the GPDP, Company K has performed its obligation to notify the GPDP with regard its automatic processing of personal data by the video surveillance system for the purpose of security according to Article 21(1) of the PDPA.
  To sum up, no evidence justified that Company K had violated the PDPA.


    The GPDP has informed Citizen A and Company K the investigation outcomes and this case was closed.

Please refer to “Personal Data Protection Act”, articles 3, 4, 5, 6, 10, 15 and 21.