Date: 11 May 2017
Privacy Commissioner Issues “Physical Tracking and Monitoring Through Electronic Devices” Information Leaflet
(11 May 2017) Privacy Commissioner for Personal Data, Hong Kong (“Privacy Commissioner”) today issued the
“Physical Tracking and Monitoring Through Electronic Devices” Information Leaflet (the “Information Leaflet”) to highlight the possible risks of personal data privacy associated with physical tracking or monitoring through electronic devices. It also suggests best practices in carrying out privacy impact assessments (“PIAs”) for any relevant tracking or monitoring projects, and provides data protection recommendations for the manufacturers of electronic devices.
It is becoming increasingly common in using the Internet of Things (“IoT”) technologies nowadays. An individual’s whereabouts, profile or behaviour may be tracked or monitored directly or indirectly by electronic devices carried or installed at home or workplace, or even by goods with wireless communications components such as a Wi-Fi transmitter or a radio frequency identification (“RFID”) tag. Privacy Commissioner Mr Stephen Kai-yi WONG said, “The application of IoT technologies increases the connectivity among people, their belongings and their environment. It improves efficiency and wellbeing, but at the same time raises possible risks on personal data privacy. It may be possible to identify and profile individuals by combining anonymous data collected through physical tracking or monitoring arrangements with other data. In that case, the data as a whole would fall within the realm of the Personal Data (Privacy) Ordinance.”
Adverse effects on the individuals may also result from profiling and labelling of the individuals concerned, for example, adverse decisions or even discrimination based on profiling. Anyone who plans to track or monitor individuals through electronic devices should consider carrying out a PIA at the design stage. This new Information Leaflet states the following key steps to identify and reduce personal data privacy risks to individuals:
-
critically assess the necessity of monitoring and tracking, and minimise the extent and sensitivity of data being collected;
-
provide sufficient notice to the affected individuals before tracking and monitoring, and offer the individuals with meaningful choice to opt out; and
-
devise appropriate measures to prevent leakage and misuse of the data.
Manufacturers of devices that can be used for physical tracking or monitoring (e.g. smartphones, IoT devices and wearable devices), as well as manufacturers of products that contain RFIDs are advised to assess the privacy impact of their products, and adopt “Privacy by Design” in order to safeguard the personal data of the users. A new infographic was created to highlight those recommendations stated on the Information Leaflets for the manufacturers.
The Information Leaflet together with its infographic are now available for download at the PCPD website:
– End –