NPC Issuance Wiki

NPC Advisory Opinion No. 2018-080 — Viewing and/or Release of CCTV Footages

Issued Advisory Opinion

Official opinion tags

Text

26 November 2018

RE: VIEWING AND/OR RELEASE OF CCTV FOOTAGES

Dear [Redacted],

We write in response to your inquiry which sought to clarify whether a joint viewing or releasing of a copy of your closed-circuit television (CCTV) camera footages to a customer is in accordance with the provisions stated of the Data Privacy Act of 20121 (DPA), its Implementing Rules and Regulations (IRR) and relevant issuances of the National Privacy Commission (NPC).

Discussion

In your letter, you stated that you are in the business of operating restaurants. Due to the traffic of customers coming in and going out of the establishment, the installation of a CCTV camera is indeed useful in monitoring and securing your daily operations. You also mentioned that a customer and her legal counsel sent a letter request seeking for a joint viewing and/or provision of a copy of the footages, to aid in pursing the individual/s liable for the loss of the customer’s cellular phone.

A CCTV is a camera surveillance system that captures images of individuals or information relating to individuals.2 If the camera surveillance footage is of sufficient quality, a person with the necessary knowledge will be able to reasonably ascertain the identity of an individual from the footage.3 Thus, the footage and images are considered personal information and the provisions of the DPA will apply.

Given that the entity is processing4 personal data, it is bound to comply with the duties and responsibilities of a personal information controller (PIC),5 including the adherence to the principles of transparency, legitimate purpose and proportionality.6 It should have informed and clearly notified the customers and the public in general, through a privacy notice or prominent signs at the entrance of the surveillance system’s zone, that the establishment is being monitored by a CCTV camera, how data is being collected and its definite purpose for installing such equipment, as well as the relevance of the footages to be obtained in achieving or fulfilling the specified purpose of surveillance.7

Moreover, as a PIC, the entity is bound to implement reasonable and appropriate organizational, physical, and technical measures to protect the personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.8 It must issue a guidelines or policies on how footages can be viewed, or acquired, who are authorized to access, when data can be shared or transferred and the corresponding retention period.

Given the crucial responsibility to secure personal information, the purpose and extent of disclosure requested by the customer and her counsel must be thoroughly evaluated based on the criteria for lawful processing of personal information in Section 12 of the DPA, to wit:

a. The data subject has given his or her consent; b. The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; c. The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; d. The processing is necessary to protect vitally important interests of the data subject, including life and health; e. The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or f. The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

Based on the provision above, the viewing or disclosure of footages to the customer and her legal counsel, for identification of the person liable for the loss of personal property, can be considered as processing necessary for the legitimate interests of the third party or parties to whom the data is disclosed.

To determine if there is “legitimate interest” in processing personal information, PICs must consider the following:9

  1. Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve.
  2. Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test - The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PICs or third party, considering the likely impact of the processing on the data subjects.

In view of the foregoing, the viewing and/or disclosure of footages should be limited to the following:

  1. Specific date of the incident;10
  2. Particular time and duration of stay of the data subject in the establishment;11
  3. If there are several CCTV cameras being operated, viewing only of the camera positioned at the precise location of the data subject during the incident;12 and
  4. Viewing only by the data subject, and other persons permitted by the data subject.13

This advisory opinion is based on the limited information provided in the questions, and may vary based on additional information or when the facts are changed or elaborated. Please be advised that the NPC may issue further guidelines on this matter.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. See: Office of the Privacy Commissioner (New Zealand). Privacy and CCTV: A guide to the Privacy Act for businesses, agencies and organizations (2009), available at https://www.privacy.org.nz/assets/Files/Brochures-and-pamphlets-and-pubs/Privacy-and-CCTV-A-guide-October-2009.pdf (last accessed Oct. 16, 2018). ↩

  3. See: Office of the Information Commissioner (Queensland). Camera Surveillance and Privacy (2009), available at https://www.oic.qld.gov.au/__data/assets/pdf_file/0010/28099/guideline-camera-surveillance-and-privacy.pdf (last accessed Oct. 16, 2018). ↩

  4. Data Privacy Act of 2012, § 3 (j). ↩

  5. Id. § 3 (h). ↩

  6. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 §17 (2016). ↩

  7. Id. § 18. ↩

  8. Data Privacy Act of 2012, § 20. ↩

  9. See generally, Data Privacy Act of 2012, § 12(f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed on June 11, 2018). ↩

  10. Supra note 3. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. ↩

Backlinks