In Hong Kong, it is not unusual to see closed circuit television (CCTV) systems installed in public places, common areas of private buildings and in road vehicles. Whilst CCTV surveillance for security reasons or for deterrence of crimes is generally considered to be legitimate, the use of any personal data collected by CCTV must be within the bounds of data privacy laws. Improper use of such personal data collected is against the law and can attract civil liability, as demonstrated by the recent case of Tsang Po Mann v. Tsang Ka Kit¹.

In Tsang Po Mann, the Hong Kong Court awarded damages to a victim of misuse of a CCTV system. This case involved a defamation claim brought by an English teacher with respect to certain statements made by the Defendants (who were the Plaintiff’s neighbours) in their letter to the Plaintiff’s colleagues/supervisors. Four photographs of the Plaintiff captured by the Defendants’ CCTV cameras (which were installed at the Defendants’ flat) were enclosed with the letter.

The Plaintiff sued the Defendants. Following trial, the court rejected the Plaintiff’s defamation claim, holding that the relevant statements were not defamatory. However, the Plaintiff did succeed in her claim under section 66 of the Personal Data (Privacy) Ordinance (Cap. 486) (the PDPO) for compensation for injury to her feelings for the Defendants’ misuse of the photographs captured by their CCTV cameras. Specifically, section 66(1) of PDPO provides that an individual, who suffers damage by reason of a contravention of a requirement under the PDPO by a data user which relates to personal data of which that individual is the data subject, shall be entitled to compensation from that data user for that damage. Section 66(2) of PDPO states that the damage referred to in subsection (1) may be or may include injury to feelings.

In ruling that the Defendants contravened the PDPO, the court found that the CCTV cameras were installed for the security of the Defendants’ matrimonial home and, therefore, the publication of the photographs constituted use of personal data collected for a new purpose, for which consent of the data subject, i.e. the Plaintiff, should be (but was not) obtained. The court accordingly allowed the Plaintiff’s claim under the PDPO and assessed the appropriate amount of compensation at HK$70,000, having taken into account the gravity of the injury to the Plaintiff’s feelings and the manner in which the photographs were misused.

This case serves as a reminder that the use of personal data collected by CCTV must be for necessary and lawful purposes in compliance with the PDPO. One must also ensure that there is no excessive retention of personal data and that there are safeguards to ensure that the personal data held is protected against unauthorised/accidental access, processing, erasure, loss or use. Ideally, the scope and extent of the use of CCTV systems should be regularly reviewed.

1. [2021] 1 HKLRD 1301, [2021] HKDC 208.