Privacy Commissioner’s Office Issues New Guidance and Leaflets on the Use of CCTV System and Video Cameras on Drones and Vehicles

Privacy Commissioner's Office Issues New Guidance and Leaflets
on the Use of CCTV System and Video Cameras on Drones and Vehicles

With the advancement of technology, the use of CCTV systems for purposes such as security and surveillance has become increasingly common across different industries. In tandem, the HKSAR Government has been actively driving the development of low-altitude economy. Pursuant to the strategic directions as set out in the Chief Executive's 2025 Policy Address, the Government is dedicated to building a low-altitude economy ecosystem and formulating the Action Plan on Developing Low-Altitude Economy, to propel Hong Kong as an Asia-Pacific hub for innovative low-altitude applications. In addition, the Government also plans to complete the installation of in-vehicle cameras in all taxis by 2026 to improve the overall quality of taxi services and protect the safety and interests of both drivers and passengers. The Privacy Commissioner for Personal Data, Ms Ada CHUNG Lai-ling, said, "In view of the rapid development of low-altitude economy and smart surveillance technologies, the Office of the Privacy Commissioner for Personal Data (PCPD) today published a "Guidance on the Use of CCTV Surveillance" and a "Guidance on the Use of Video Cameras on Drones and Vehicles" to provide practical guidance on how to use CCTV systems, drones and in-vehicle cameras responsibly, so as to assist data users to make effective use of technology while ensuring the protection of personal data privacy in compliance with the relevant requirements under the Personal Data (Privacy) Ordinance (PDPO)." The "Guidance on the Use of CCTV Surveillance" provides an overview of the considerations for deploying CCTV systems and covers topics such as the lawful and fair collection of personal data, the necessity, proportionality and transparency of the use of CCTV systems, as well as the requirements for retention and security of CCTV footage. The guidance also offers practicable recommendations on conducting privacy impact assessments, providing clear notices, and the appropriate circumstances for using CCTV footage. On the other hand, the "Guidance on the Use of Video Cameras on Drones and Vehicles" outlines the privacy risks associated with these video camera-based devices and sets out practicable guidance on avoiding excessive collection of personal data, notifying affected individuals and the security of recorded footage. The guidance also provides a sample sticker on the notice for in-vehicle cameras for use in passenger carrying vehicles. Furthermore, to assist the public in understanding the key points regarding the use of CCTV systems, drones and in-vehicle cameras, the PCPD also published two information leaflets titled "Tips on the Use of CCTV Surveillance" and "Responsible Use of Drones and In-Vehicle Cameras" summarising the key points to note for data users (See Annex 1 for details). Download the "Guidance on the Use of CCTV Surveillance": https://www.pcpd.org.hk/english/resources_centre/publications/files/guidance_cctv_surveillance.pdf Download the "Tips on the Use of CCTV Surveillance" information leaflet: https://www.pcpd.org.hk/english/resources_centre/publications/files/tips_on_cctv_surveillance.pdf Download the "Guidance on the Use of Video Cameras on Drones and Vehicles": https://www.pcpd.org.hk/english/resources_centre/publications/files/guidance_cameras_vehicles.pdf Download the "Responsible Use of Drones and In-Vehicle Cameras" information leaflet: https://www.pcpd.org.hk/english/resources_centre/publications/files/responsible_vehicle_cameras.pdf

The PCPD issued a "Guidance on the Use of CCTV Surveillance" and a "Guidance on the Use of Video Cameras on Drones and Vehicles" along with two information leaflets.

The PCPD issued a sample sticker on the notice for in-vehicle cameras.

－End－
Summary of "Tips on the Use of CCTV Surveillance" and
"Responsible Use of Drones and In-Vehicle Cameras"

1. Install CCTV for a lawful purpose: collect personal data only for a lawful purpose directly related to the function or activity of the data user.
2. Avoid unfair surveillance: avoid using CCTV to collect personal data under unfair circumstances, for example, CCTV should not be installed in places where individuals would have a reasonable expectation of privacy (e.g. changing rooms or bathrooms).
3. Consider less privacy-intrusive alternatives: assess whether the use of CCTV in the circumstances of the case is justified for achieving the relevant purpose and whether there are any less privacy-intrusive alternatives that could achieve the same purpose.
4. Configure CCTV system carefully: before enabling the recording function, assess whether continuous recording is necessary, whether the use of high-resolution equipment or advanced features such as facial recognition technology is justified, and whether the extent of monitoring is proportionate.
5. Be transparent: take all practicable steps to inform potentially affected individuals that they are subject to CCTV surveillance by, for example, putting up conspicuous notices in the vicinity of the monitored areas.
6. Delete CCTV footage in a timely manner: ensure personal data is not kept longer than is necessary for the purpose for which the data is or is to be used, including regularly and securely deleting CCTV footage that is no longer needed.
7. Adopt robust security measures: implement adequate security measures to ensure that the CCTV system and the recorded footage containing personal data is protected against unauthorised or accidental access, processing, erasure, loss or use.
8. Abide by limitations in data use: unless the data subject gives express consent voluntarily or an exemption under Part 8 of the PDPO (such as for the prevention and detection of crime) applies, recorded footage should only be used for the purposes for which it was collected or for a directly related purpose.

• Flight path - Carefully plan the flight path to avoid flying close to individuals or private premises;
• Recording - Pre-define the recording criteria, including what, where and when to record, as well as the quality and resolution of the footage captured, to avoid excessive collection of personal data;
• Retention - Establish a personal data retention policy to facilitate the timely erasure of irrelevant recordings;
• Security - Implement access control to prevent the recordings from falling into the wrong hands in the event that the drone is accidentally lost or stolen; and
• Notice - Notify potentially affected individuals of the intended drone operation in advance, such as pre-announcing the drone operation by putting up conspicuous notices in the vicinity of the areas concerned and/or via public channels.

• Security - Use encryption for wireless transmission of images to avoid interception or unauthorised access, and safeguard the storage of the recorded footage with robust security measures;
• Notice - Inform potentially affected individuals that drone operation is in progress by, for example:

1. Using flashing lights to indicate the operation of drone and that recording is taking place;
2. Putting corporate logo on the drone;
3. Requiring crew members to wear clothing that identifies the organisation; and
4. Putting up notices or large banners with the Personal Information Collection Statement and contact details at launch sites.

• Providing adequate justification - Provide adequate justifications for continuous recording;
• Notice and transparency - Notify passengers of the existence and functions of in-vehicle cameras;
• Data security - Ensure that recordings are properly secured through physical and technical measures to prevent unauthorised or accidental access or copying; and
• Handling and retention of recordings -
  1. Establish a personal data retention policy which stipulates the retention period of recordings;
  2. Delete recordings containing personal data, in which no incidents have arisen or been reported, in a timely manner.