個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Enquiry Case Notes
Print

No: 0647/C/2011

Title: Video monitoring system

Content:

    Company A asked whether installing a 24-hour video monitoring system outside the company gate would violate the Personal Data Protection Act.

Result:

    In the absence of detailed case information, the following is a reply only to general data processing:
  Under Articles 4(1)(1) and 3(1) of the Personal Data Protection Act (Law 8/2005), this Law governs the data processing aforementioned.
  Under the said Law, Company A could only process personal data when meeting any legitimacy conditions given in its Articles 6 to 8. Company A must, beside from the legitimacy, comply with all the principles laid down by Article 5 thereof, such as the principle of proportionality. In other words, whether the personal data collected is necessary to achieve certain purposes, and whether too much personal data has been collected, etc.
  In general, Company A could, for safeguarding its legitimate interests and ensuring smooth operations, use the said system to monitor its area. As to the video monitoring system, Company A should provide the a brief notice with the information listed in the Articles 10(1)(1) and 10(1)(2) of the Law previously mentioned. In addition, it must also prepare detailed policies in case data subjects would like to access their personal data. These policies must also include the information laid down in Article 10 of the same Law. Should Company A fail to fulfill such obligation, then administrative offence is caused.
  Since the video monitoring system is also likely to capture images of its staff, therefore, Company A is recommended consult The document the Principles Concerning the Protection of Personal Data in the Workplace: Guidelines for Employee Monitoring, issued by the GPDP. Therein includes issues to be dealt with, the principles and the laws that apply to video monitoring system.
  Moreover, as Article 21 of the same Law regulates that if personal data is processed by automated means, this should be notified to the GPDP, in writing, within 8 days after the initiation of the data processing.
  At last, as case information provided is limited and insufficient as concrete case information (for example, nature of the company, purposes of installing the video monitoring system, etc.), the GPDP could not determine whether the personal data processing as mentioned violated the Personal Data Protection Act.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,5,6,7,8,10,21,33 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116