“There’s always someone watching!” (Ocean’s 11). Updated Privacy Commissioner guidance on CCTV, drone, and in-vehicle camera use

Hong Kong is actively pushing to become a global innovation hub. Plans include installing cameras in all taxis by 2026, as well as promoting a low-altitude economy of camera-equipped drones. However, such initiatives come with privacy and data concerns. The use of CCTV surveillance, and cameras in drones and passenger-carrying vehicles, are among them.

Hong Kong’s Privacy Commissioner for Personal Data (“PCPD”) has issued two new guidance documents on camera use. The first concerns use of CCTV surveillance, and the second on use of video cameras on drones and vehicles (jointly the “Camera Use Updates”). The Camera Use Updates explain how businesses/ employers and the public should comply with the law when deploying CCTV systems, drones, and in-vehicle cameras. We summarise the key considerations below.

The Camera Use Updates and the law

A first point to note is that the Camera Use Updates are guidance notes only, not new legislation. They do not create additional legal obligations, they only explain how existing legal provisions apply to modern technologies and everyday scenarios. The Camera Use Updates help employers and the public to interpret and apply the law and adopt best practices, ensuring compliance in respecting individual privacy. They are helpful documents to help readers avoid legal liability in a safe and efficient way.

The Personal Data (Privacy) Ordinance (“PDPO”) is Hong Kong’s primary data protection law. It sets out legally binding requirements for the collection, use, and handling of personal data, enforced through six Data Protection Principles. For Tanner De Witt’s article on Hong Kong Market Entry, Data Protection, and the PDPO, please click here.

CCTV Surveillance

The CCTV guidance note sets out that CCTV should only be used when necessary and only in a proportionate way. Transparency is essential. People must know when they are being recorded, and clear notices should be displayed at entry points and monitored areas.

Data retention and security are critical concerns. Footage should not be kept longer than needed and must be stored securely to prevent leaks or misuse. Businesses should conduct Privacy Impact Assessments before installation to identify risks and mitigation measures.

The CCTV guidance note warns against covert surveillance, except as a last resort. Cameras should never be placed in private spaces such as changing rooms or rest areas. Misuse of footage, including sharing on social media, may breach the PDPO and lead to criminal liability.

Camera Use in Drones and Vehicles

For drones, operators should plan flight paths carefully to avoid private premises. Recording criteria should be defined in advance, and technology should be used to blur faces where possible. Wireless transmissions should be encrypted and stored on secure storage devices. Drone owners are reminded that lost drones can expose sensitive data if safeguards are weak.

Transparency is, once again, of utmost importance. The drones and vehicles guidance note suggest creative approaches such as QR codes on notices, flashing lights on drones, and banners at drone launch sites. These measures both inform the public and build trust with the drone owner.

For in-vehicle cameras, justification is key. Continuous inward-facing recording should only be used when necessary, because passengers expect privacy in taxis and private cars. Notices should be placed both inside the vehicle and on the exterior in a conspicuous way. The PCPD has provided a sample sticker here for this purpose.

Footage retention policies must also be clear. Recordings should be deleted promptly if no incidents occur and stored securely with encryption and access controls. Non-removable storage media should be considered, to reduce risk of theft or misuse.

Best Practices for Businesses

1. Assess necessity: Use cameras only when there is a clear need.

2. Ensure transparency: Inform people through notices and policies.

3. Limit data collection: Record only what is required for the purpose of your camera use.

4. Secure data: Protect footage from unauthorized access.

5. Review retention: Delete data when it is no longer needed.

6. Conduct privacy impact assessments: Identify and reduce risks before deployment.

Conclusion

Following the guidance outlined in the Camera Use Updates will reduce legal risk and protect a business’s reputation. CCTV, drone, and in-vehicle camera users should review their current practices now, update relevant policies, and implement new staff training.

Camera Use Updates, supplementary materials

For the PCPD’s media statement made for the launch of the Camera Use Updates, please click here.

For the PCPD’s document on “Guidance on the Use of CCTV Surveillance”, please click here.

For the PCPD’s supplementary information leaflet on CCTV titled “Tips on the Use of CCTV Surveillance,” please click here.

For the PCPD’s document on “Guidance on the Use of Video Cameras on Drones and Vehicles,” please click here.

For the PCPD’s supplementary document on “Responsible Use of Drones and In-Vehicle Cameras” information leaflet, please click here.

If you would like more information on employment related legal matters, please contact:

Russell Bennett

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.