20 April, 2019
The news of two Hong Kong celebrities having intimate actions inside what might have been a taxi have swept across the media in the past two days, raising discussions as to the appropriateness of image collection by car cameras installed inside public vehicles.
Section 4 of the Personal Data (Privacy) Ordinance (PDPO) provides that a data user shall not do an act, or engage in a practice, that contravenes a data protection principle unless the act or practice is required or permitted under the PDPO. There are 6 data protection principles under the PDPO (DPPs).
According to DPP 1(1), personal data shall not be collected unless (a) the data is collected for a lawful purpose directly related to a function or activity of the data user who is to use the data; (b) the collection of the data is necessary for that purpose; and (c) the data is adequate but not excessive in relation to that purpose.
The question then is, whether the installation of CCTV or car camera fall within the ambit of collection of personal data under the PDPO?
According to the Guidance on CCTV Surveillance and Use of Dronesissued by the Privacy Commissioner for Personal Data, whether the domestic or personal use of CCTV systems covering semi-public (e.g. inside a taxi) or public area is regulated by the PDPO would depend on whether the purpose of the installation is to collect or compile information about identified persons.
In the case of Eastweek Publisher Ltd and Another v Privacy Commissioner for Personal Data [2000] 2 HKLRD83, the Court of Appeal took the view that the gathering of information (including taking of photos) about the anonymous subject would not constitute the collection of personal data within the meaning of the PDPO. However, if someone’s photographs are taken with a view to its inclusion as a part of a dossier being compiled about him as an identified subject, the act of photography would clearly be an act of personal data collection.
Therefore, it is important to ascertain the purpose of the installation of the car camera. It is common nowadays for drivers to install car camera for prevention of crime or collection of evidence in case of car accidents. If a car camera merely records the images of anonymous passengers for the aforesaid purposes, then arguably it does not constitute a collection of personal data under the PDPO. On the contrary, if the driver in this case was aware of the identity of the two artists, and he collected the footage for the purpose of recording their actions in the car, then it is likely that the driver’s action would amount to a collection of the artists’ personal data, and the PDPO must be complied with.
DPP 1(2) further provides that personal data shall be collected by means which are lawful and fair. It is therefore important to put up clear signs in the vehicle informing passengers of the existence of a car camera. The news did not disclose if there was such a sign in the present case.
According to DPP 3, personal data shall not, without the prescribed consent of the data subject, be used for a new purpose. If the images of passengers are collected for the purpose of prevention of crime or as evidence in case of car accident, such images cannot be used for a different purpose. In the present case, even if the images of the two artists were collected for the above lawful purposes, disclosure of the same to the media would not have been a purpose for which the data was originally collected and therefore would be a breach of DPP 3.
In fact, apart from the DPPs discussed above, there are also other DPPs data users need to pay attention to. It is important for data users to comply with the DPPs to prevent a breach of the PDPO.
For further information, please contact:
Elsie Chan, Partner, Deacons
elsie.chan@deacons.com.hk
