Enquiries and Complaints

Topical Issues

[Image of Topical Issues]


[Image of Question] Can government departments install closed-circuit televisions at gambling and hawker blackspots in housing estates, such as pavilions and parks, to tackle the problems?
[Image of Answer] We will not comment on individual cases before understanding the specific situation.

According to the Personal Data (Privacy) Ordinance ("the Ordinance"), "personal data" are any data relating to a living individual, which are stored in recorded form making access to or processing practicable and from which it is practicable for the identity of the individual to be directly or indirectly ascertained from it. Generally speaking, to constitute an act of collection of personal data by the data user, there should be compilation of information about an individual, whose identity must have been identified by the data user, or the data user intends or seeks to identify the identity of the individual.

In general, if a monitoring and recording system is installed in a public place merely for the sake of security, it may not constitute collection of personal data (unless the data of a certain or some particular individuals are collected) and it may not be subject to the Ordinance. However, collection of personal data may take place under some special circumstances. For example, after a special incident has happened, the Authority concerned may need to review the video records for the purpose of ascertaining the identity of the individuals involved in the incident and it may then amount to collection of personal data. Therefore, organizations which intend to install monitoring and recording systems should, at least, post a notice in a prominent position near the installation, stating that the area is being monitored, the purposes of monitoring, as well as the ways of handling the records.

Broadly speaking, organizations can install monitoring and recording systems only if it is necessary for fulfilling their legitimate functions or activities, such as for security reasons, the monitoring of illegal acts (e.g. throwing objects from height, installation of closed-circuit televisions at hygiene blackspots by Team Clean), etc. Before an organization installs a monitoring and recording system, it is suggested that it should establish the collection purposes, evaluate the risks of monitoring, and consider if there is any other substitute that is less privacy intrusive in order to strike a balance between the protection of privacy rights of individuals and the smooth operation of the organizations.

When an organization has decided to install a monitoring and recording system, it is suggested that in the interest of transparency it should post a notice in a prominent position near the installation (the notice should be as close to the installation as practicable; the words should be clear and noticeable) so that sufficient notice is drawn to the public or the people affected hat their activities may be recorded and the reasons for collection of their personal data. The organizations concerned are suggested to formulate policies on video monitoring, and the persons who can access and view the contents of the tapes. Moreover, the organizations should also prescribe the retention period of the tapes and delete the data in the tapes accordingly, and steps shall also be taken to ensure that the tapes are securely kept.

In conclusion, when using monitoring and recording devices in public place, it is our view that a proper balance should be struck between the protection of public interests and personal data privacy. Data users should handle the issue in a fair and transparent mannergiving due regards to the rights of personal data privacy.

[Image of Question] I read from the news that a telephone company would provide its subscribers' telephone numbers and address information to the Fire Services Department ("FSD") to facilitate its handling of emergency calls more efficiently. Has it contravened the Personal Data (Privacy) Ordinance (the "Ordinance")?
[Image of Answer] Having approached both organizations, it was clarified that the telephone company would only provide to FSD the telephone number and installation address of the numbers concerned, i.e. the building or the estate from which the call is made. No full address and name of the subscriber would be disclosed to FSD.

According to section 2 of the Ordinance, personal data means any data relating directly or indirectly to a living individual and from which it is practicable for the identity of the individual to be directly or indirectly ascertained. As the information passed over by the telephone company to FSD do not contain any personal identifying particulars such as name and full address, these data are not regarded as personal data and this arrangement would not be in breach of the Ordinance.

Click here to learn more about this issue

End of Page

[Complaint Handling Policy] [Common Questions] [Games] [Personal Information Collection Statement]

[About PCPD] [The Ordinance] [PCPD Activities] [Information Centre] [Privacy Zone for Youngsters (Games)]
[Publications & Videos] [Enquiries & Complaints] [Case Notes] [Contact Us] [Search] [Site Directory] [Graphical Version]
[Chinese Version]

Notice/Copyright 2001 Office of the Privacy Commissioner for Personal Data, Hong Kong. All rights reserved. Disclaimer

[Image of Question] Can employers monitor employees' e-mails and phone calls?
[Image of Answer] Before deciding to monitor, employers should first assess whether it is really necessary to conduct such activity having regard to the business risks that they seek to manage and the impact on personal data privacy of its employees. Employers should consider alternatives available in order to lessen the adverse impact brought by the monitoring activity. In carrying out monitoring, employers should also implement clear Employee Monitoring Policy and communicate it to the staff affected. The use, retention and processing of personal data collected should also be kept under control so as not to contravene the requirements under the Personal Data (Privacy) Ordinance.

[Image of Question] Can employers of domestic helpers install surveillance cameras at home?
[Image of Answer] The same assessment process as mentioned above also applies. Given that the workplace is also the place of rest for the domestic helpers, employers should seriously consider whether it is really necessary to engage in such activity, the reasonableness as well as the openness of the activity. They should therefore inform their helpers of such practice, restrict monitoring to targeted areas (not toilets or other private areas) and make clear the purpose of monitoring and the retention period for the taped records.

[Image of Question] Can employers install pinhole cameras?
[Image of Answer] Covert monitoring is not encouraged especially when it is being used as preventive measure only. Unless justified by existence of relevant special circumstances, such as "a reasonable suspicion" of unlawful activity and there is no reasonable alternative, this should only be engaged in as a last resort.

[Image of Question] What can employees do if they find employers not following the "Privacy Guidelines: Monitoring and Personal Data Privacy at Work"?

[Image of Answer] They can complain to the Privacy Commissioner, who can follow up with the employer and examine the case by reference to the recommended good practices suggested in the Guidelines. If the employer is uncooperative and the law on personal data protection has been breached, the Commissioner may serve an enforcement notice on the employer directing for remedial action, which, if not complied with, can attract criminal sanction.

[Image of Question] I am a customer of "Bank A". Recently I received a phone call from a staff member of this bank marketing its investment products to me. I am really annoyed at this kind of direct marketing calls. Is there a way to stop organizations using my personal data for direct marketing purposes?

[Image of Answer] In respect of direct marketing, section 34 of the Personal Data (Privacy) Ordinance (the "Ordinance") provides that a data user who for the first time uses personal data for direct marketing purpose should inform the data subject that he has the right to ask the data user cease using his personal data for direct marketing purposes. When the data subject has made such a request, the data user is required, without charge to the data subject, to cease to so use those data. It is stated in the Ordinance that any direct marketing by means of mail, electronic mail, facsimile transmission, or phone calls made to a specific person is subject to the above provision.

That is to say, when "Bank A" uses your personal data for direct marketing for the first time, it should inform you that you can request it to cease using your personal data for direct marketing. If you have made such a request, "Bank A" should cease sending you any direct marketing information.

Although it is not explicitly specified in the Ordinance of how the consumer should raise such a request, the PCPD is of the view that it should preferably be done in writing. If, after you have made such a request, the organization still keeps on using your personal data for direct marketing purpose, there may be contravention of the Ordinance on the part of the organization. In this case, you may lodge a complaint to the PCPD. Please click here for details of procedures to lodge complaints to the PCPD.

For further information about the use of personal data for direct marketing purposes, please refer to the "Fact Sheet -- Personal Data Privacy : Guidelines on Cold-Calling" published by the PCPD.