Enquiry Case Notes

編號: 0006/2014/PA

標題: Installing electronic surveillance cameras


    Bureau A intends to install electronic surveillance cameras in School C, which is managed by Bureau B, and therefore consulted the Office for Personal Data Protection (GPDP).


    According to Article 4(1)(1) and 3(1) of the Personal Data Protection Act (PDPA, or Law 8/2005), processing of the concerned data should be governed by this Law.
  According to Article 4(1)(5) of the same Law, ‘“controller” shall mean the natural or legal person, public entity, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data’.  Any entity considered as the controller should undertake the legal obligations to safeguard the rights of persons involved, take appropriate security measures and send notifications [to the GPDP].  For this reason, Bureau A should determine whether it is the data controller, or should consider both itself and Bureau B are data controllers.
  In addition, Article 6 to Article 8 of the PDPA laid down the conditions for legitimacy for personal data processing.  As long as any of the conditions last mentioned is fulfilled, then the data controller can process personal data.  As a consequence Bureau A should first determine whether legitimacy is established for processing the personal data.
  Under Article 5 ibid, the processing of personal data should comply with the principles of legitimacy and proportionality.  Therefore, before setting up the said electronic surveillance cameras, the data controller should review the features of the system, including camera positions, covering range, numbers and the technical aspects of the cameras.  This would help prevent the cameras from breaching the laws governing private life in residences or the coverage is overlapped or excessively split. 
  Finally, if Bureau A applies to the GPDP for its legal opinion, it should provide the related information according to Article 23 of the Personal Data Protection Act.

Please refer to "Personal Data Protection Act", articles 3, 4, 5, 6, 7, 8, 10, 11, 12, 13, 14, 15, 21 and 23.