個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0079/2016/IP

Title: Surveillance cameras mounted outside a shop

Reason: Complaint

Brief:

    The current case stemmed from a complaint, stating that Shop A installed two surveillance cameras outside its shop area.  However, the cameras were found mainly covering the sidewalks rather than the shop area.  Images taken from the shop area only took up 1/3 of the image frames and they were displaced in a screen inside the shop.  The Complainant believed that it was an excessive coverage of images and asked the GPDP to follow up.

Analysis:

    The investigations revealed that Company B, for security purpose, installed two cameras outside Shop A.  According to Article 4(1)(1) and 3(1) of the PDPA (Personal Data Protection Act), Company B’s processing of data captured by its surveillance system is subject to the same Law.
  For security, Company B installed the surveillance system in its business area, aiming to protect its property therein and other lawful interests, which are lawful and legitimate purposes and are in compliance with Article 6(5) of the PDPA that governs legitimate data processing. 
  Although the said cameras captured images from the sidewalks, roads and shops across the road, they were only used for security purposes.  In addition, they are not equipped with zooming lenses and are also unable to record sound.   After being reminded by the GPDP, these cameras were re-adjusted and reduced its viewing angles to avoid capturing the pedestrians and cars that passed by.  Due to the fact that Shop A is located on the ground floor, it is inevitable that images from the adjoining sidewalks are captured. 
  On the other hand, Company B, after being reminded by the GPDP, has already put up notices in appropriate places to notify the surveillance recordings, but the controller’s identity and the purposes of recordings were not specified therein.  For this, the GPDP has already informed Company B, in writing, that it should amend the notice content in order to comply with Article 10(1) of the PDPA.
  The equipment that Company B is using for image storage is placed inside Shop A, and only the shop owner has access to such images.  After being reminded, Company B has switched off the screen that placed adjacent to the glass façade of the shop, to avoid data leaks caused by anyone passed by to take images from it.  Violations against Article 15 of the PDPA, which governs the processing security, were not found in the current case.  To avoid system images captured by passers-by while the shop owner was accessing the system images with the said screen, the GPDP, has already reminded, in writing, Company B to introduce proper measures while accessing the stored images, for instance, covering the glass façade. 
  Company B has already notified the GPDP of its automatic data processing, undertaken by its surveillance system, according to Article 21 of the PDPA. 
  To sum up, no evidence substantiated Company B violated the PDPA. 
 

Result:

    Having been reminded by the GPDP, Company B has already introduced improvement.  Afterwards, the GPDP also informed Company B, again, in writing, to introduce further measures to address any deficiencies still found. 

Reference:
Please refer to Article 3, 4, 6, 10, 15 and 21 of the Personal Data Protection Act.

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116