The Lift Lobby Footage
You look after a 12-camera CCTV system in a mixed-use building in Sham Shui Po. The DVR sits in the guard room and overwrites on a 14-day cycle; it is now Monday 10:00. Resident A says his car was keyed in the car park on Saturday night and wants to see the footage so he can 'find the guy and deal with him'. Resident B says her ex-boyfriend followed her into the lift on Sunday and wants the clip to send to her lawyer and to post on Facebook. At 11:00 a uniformed police constable says he is investigating the car damage and asks you to play the recording while he films the screen on his phone; he gives a name but no written request, no incident number and no warrant. At 11:20 your manager calls and says 'give them whatever they want, we don't need complaints'.
1. Is this CCTV footage 'personal data', whose obligations are engaged, and what may you release on your own authority?
Read the worked answer
Yes. Footage in which an individual is identifiable - by face, build, clothing, vehicle plate or context - is personal data under the Personal Data (Privacy) Ordinance (Cap. 486). The data user is the organisation operating the system (the owners' corporation or the security company acting for it), not the guard personally, but the guard's handling is how the organisation complies or fails.
Principles in play:
- DPP1 - collection for a lawful purpose (building security) and no excessive collection; the car park and lift cameras must be justified and signposted.
- DPP2 - accuracy and a retention limit. The 14-day cycle is your retention policy, which is exactly why Saturday's footage is already close to being overwritten.
- DPP3 - access requests: a data subject may request access to their own personal data, in writing, and the data user must respond within 40 days. It does not mean showing the tape at the counter.
- DPP4 - security: only authorised staff view it, the monitor is not customer-facing, the DVR is locked, exports are logged.
On your own authority, you release nothing. Not to Resident A, not to Resident B, not to a constable standing at the counter. Your role is to preserve, verify, record and escalate. The section 58 exemption for crime prevention and detection exists, but applying it is a management and data-protection decision, not a gatehouse decision.
2. Handle Resident A, Resident B and the constable. What do you actually say and do with each?
Read the worked answer
Resident A (wants to 'deal with him'). The stated purpose is retaliation. Showing him footage so he can identify and confront someone creates a real risk of a further offence and makes the building complicit. Explain that you cannot show recordings at the counter, hand him the written access-request procedure, take his details and the exact time window (Saturday night, car park, which bay), and log the request. Preserve the relevant segment now - if it is Saturday footage on a 14-day loop it will be gone by the following weekend.
Resident B (lawyer and Facebook). Two problems: the clip shows her and also her ex-boyfriend and possibly other residents. Releasing it for public posting would disclose third-party personal data and could enable harassment. Advise her to report the following to police; if she wants the footage, it goes through the written access route and the organisation decides, with legal advice, what to release and under what conditions. Never let her film the screen with her phone.
The constable. Be cooperative but not uncritical. Verify identity against the warrant card, take his name, rank, number and station, ask which incident and for an incident or report number, and ask for the request in writing. Then call the manager or data-protection officer and let them authorise. If authorised, export only the minimum: the specific camera and the specific time window, not the whole DVR, and never by letting him film the monitor - that copies unrelated third-party footage. Give a receipt and record what was handed over. Police have no general power to seize CCTV without consent, a warrant or another lawful basis, but a written request is normally met; the point is that it is documented.
3. The manager says 'give them whatever they want'. What records must exist by the end of the day, and what does the 14-day cycle require you to do?
Read the worked answer
Records by close of day:
- An access request log: who asked, when, capacity (resident or police), what they asked for, the time window and camera requested, and what was provided or refused and why.
- A preservation record: the exact segment exported, by whom, at what time, the file name or hash, where it is stored, and who has the key.
- The manager's instruction in writing - an email or text confirming what he authorised, so that the decision is his and not yours. The instruction 'give them whatever they want' is not an authorisation; it is a request to breach DPP3 and DPP4. Ask him to put it in writing and copy the data-protection officer.
- The incident reports for both residents, with times.
- A note of the retention risk: Saturday footage will be overwritten on the 14-day cycle; if it matters, export today.
The retention point is the exam's real trap. A 14-day DVR is designed to delete evidence. Once anyone says 'my car was keyed' or 'he followed me', the segment becomes potentially relevant, and the organisation has a duty to preserve it rather than let the machine do its work. A guard who says 'come back next week' has destroyed the evidence and created a complaint about the guard, not just about the car. Export, seal, log - then escalate.