個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0008/2008/IP

Title: Construction site management company collected images for monitoring

Reason: Complaints

Brief:

    Construction site management company A’s proxy company B took some pictures on the sites, which included image data of the workers on site. A dispute over the picture-taking arose because B’s cameramen did not explain why they were taking the pictures.
  Worker X believed that the conduct of A and B violated the Personal Data Protection Act, and filed a complaint with this Office (GPDP).

Analysis:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  It was later explained that the picture-taking on the construction site was about taking pictorial notes of the operation and progress of the engineering project, and the pictures taken would only be used as internal record.
  In GPDP’s opinion, judging by Article 6.(5) of the Personal Data Protection Act, it was appropriate for company A to take pictures on its construction site for oversight purposes and to ensure the legal rights and interests of the institution concerned, without obtaining the consent of the data subject (the workers or other people on site). Given that company B was working on behalf of company A, so by the same reasoning, it was also appropriate for company B to take pictures on the sight, without the need of obtaining consent of those present.
  While company B might take the pictures of the on-site according to company A’s managerial requirement, it also processed the photos that contained the image data of the data subject, and only passed those photos to company A when needed. Therefore GPDP believed that company B was the data controller too.
  According to Articles 10 and 11 of the Personal Data Protection Act, before taking the pictures, companies A and B should have told the data subject about how their personal data might be collected and handled. Company B had the duty to respect the data subject’s right to information and right of access, and when taking pictures that would involve personal image data, especially when questioned, to explain the purposes and uses to which the pictures would be put. It was exactly company B’s failure to tell the workers on site about the purposes and uses of the photos that gave rise to the ensuing dispute.
  In summary, although the behavior of A and B might be not in compliance with Articles 10 and 11 of the Personal Data Protection Act, it did not constitute an administrative offence. However, there was room for improvement.

Result:

    GPDP therefore demanded that the said companies amend their practice in the following ways – company A may well post notices on eye-catching places in the site, clearly indicating the purposes and uses of pictures taken on site. For example, its notice should state “taking on-site pictures by the management company or the project undertaker company is what the on-site project oversight and operation require; and the pictures taken will be used for general internal record purposes”, to ensure the right to information of the data subject. Company A was required to advise company B and other related companies that, when taking on-site pictures and if the data subject question, B’s staff should identify themselves and the photo-taking company, and explain the purpose and uses of the photos taken.
  The companies followed GPDP’s instruction and made improvements.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,6,10,11 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116