By Jeffrey Chan
Hong Kong, 27 February 2026: Following the recent article by our Managing Partner Alex Liu regarding video surveillance complaints, we can take a closer look the use of CCTV in the workplace and how it intersects with the Personal Data (Privacy) Ordinance, Cap 486 (“PDPO”).
As CCTV systems become more advanced and more widely deployed across both public and private spaces, an important question arises: does the installation of CCTV in the workplace without an employee’s consent amount to a breach of personal data privacy?
This issue was examined in the recent District Court decision of Chan Long Ning, Christine v MTR Corporation Limited [2025] HKDC 450, in which the Plaintiff lodged a notice of appeal against an order striking out her claim and dismissing the action. The court heard that the Defendant owned and managed The Southside, a shopping mall, and had contracted Dragon Guard to provide customer service and security services. Dragon Guard in turn employed the Plaintiff as a concierge supervisor.
The issue lay in the CCTV cameras and audio recording device installed by the Defendant in a public area near the concierge counter to monitor the performance of its employees. The Plaintiff claimed the surveillance infringed upon her privacy rights because the data was not collected for a lawful purpose, was not collected by lawful and fair means, and had not been collected with her consent.
The court rejected these arguments. First, it held that the data was collected for a lawful purpose, namely to evaluate employee performance, including whether the Plaintiff interacted with visitors in a hospitable manner. The court also emphasised that the surveillance took place in a public area where the Plaintiff had no reasonable expectation of privacy, so therefore data was collected by lawful and fair means.
Further, the court dismissed the argument relating to consent. Under Data Protection Principle 1(3), a data user must take all practicable steps to inform the data subject of the purpose of data collection. However, the law also provides an exemption where giving such notice would likely prejudice the purpose of the data collection, provided that the purpose is one of those listed in Part 8 of the PDPO.
In the present case, the Plaintiff had been informed of the audio recording device installed to monitor conversations between customers and staff for performance assessment. Such notification satisfied the requirement for employers to take practicable steps. Furthermore, informing the Plaintiff in advance of the CCTV monitoring would have undermined the purpose for CCTV surveillance, so the exemption applied. Consequently, the Plaintiff’s claim failed and her notice of appeal was struck out.
Although the judgment makes clear CCTV surveillance for legitimate business purposes will not automatically violate employees’ privacy rights, the broader issue remains complex. Employers must carefully balance their business interests against the personal data protection rights guaranteed to employees under the PDPO. Recognising the sensitivity of employee monitoring, the Privacy Commissioner for Personal Data released Privacy Guidelines: Monitoring and Personal Data Privacy at Work (revised in April 2016), offering a comprehensive framework for employers to understand how the PDPO applies to workplace monitoring.
Particular attention is given to CCTV surveillance. Employers are encouraged to consider whether continuous monitoring is truly necessary or whether more limited forms of monitoring, such as selective or random checks, would suffice. Continuous surveillance may be justified in areas where the protection of persons or property is a priority; however, it may not be needed in all situations.
A clear and well defined CCTV policy should set out matters such as the retention period for recordings and the criteria for reviewing footage. The existence and purpose of CCTV surveillance should be proactively communicated to employees and signage should be prominently displayed near cameras to ensure that individuals are aware that monitoring is taking place.
Ultimately, the key lies in striking an appropriate balance. Employers must be mindful of their legitimate need to supervise and safeguard their operations, while employees remain entitled to the protections afforded to them under the PDPO. Responsible, transparent and proportionate monitoring practices will continue to be essential in maintaining such balance.
Jeffrey Chan has been a Partner in BC&C since 2015 and leads the firm’s Insurance and Personal Injury team which advises on legal matters and handles court cases for insurance companies and/or their insured parties. He practices all areas of civil litigation with a particular emphasis on personal injuries and property damage claims, employees’ compensation legislation and insurance-related disputes. He can be contacted at jeffrey@boasecohencollins.com.
Trainee Solicitor Irene Wong contributed to this article.
