個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Enquiry Case Notes
Print

No: 0039/2011/RP

Title: Installing video surveillance system

Content:

    Association A asked whether installing a video surveillance system in its subordinate organization, Center B, is required to apply to GPDP for an authorization.

Result:

    According to Articles 4(1)(1) and 3 of the Personal Data Protection Act (Law 8/2005), it applies to the processing in the current case.
  Articles 5(2) and 22 of the same Law have already provided for the cases that authorization is needed. According to the information Association A provided, as its installed system involves personal data processing. Therefore, Association A, according to Article 21(1) of the same Law, must notify GPDP in writing, within eight days after the processing started. Therefore, for its installation Association A is not necessary to apply to GPDP for authorization, but to notify within the aforementioned notice period.
  According to the Personal Data Protection Act, Association A should have the processing legitimacy before starting to process personal data. From the data provided by Association A, the monitoring objects of the system include service users, parents and employers, etc. Therefore, generally, the data monitored by the above system may involve non-sensitive data or the personal data being suspected of unlawful activities, criminal and administrative offences. If Association A complies with one of the legitimacy conditions in Article 6 of the said Law, it can process the relevant data.
  Moreover, Association A also points out that as its service users include adults suffering moderate to severe mental retardation and students receiving special education. For them, the data captured by the surveillance system is considered as sensitive health data (Article 7(1) of the Law last mentioned). In view of this, Association A could process the data if it “guarantees the non-discrimination principle”, adopts “the security measures given in Article 16”, and “when data subjects have given their explicit consent for the processing” (Article 7(2)(3) of the same Law). Furthermore, this Association can also process the data if meeting the conditions in Article 7(4) of the same Law.
  Even given the legitimacy to process, Association A should also comply with other provisions of the Personal Data Protection Act, especially Articles 5(1)(2) and 5(1)(3), as well as adopting the safety measures governed by Articles 15 and 16 thereof.
  For the installation of the video surveillance system, Association A could also consult the document issued by GPDP, “The Principles Concerning the Protection of Personal Data in the Workplace: Guidelines for Employee Monitoring”.

Reference:
Please refer to "Personal Data Protection Act", articles 3,4,5,6,7,15,16,21,22 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116