Privacy watchdog warns gym after mispositioned CCTV risked filming men’s restroom

Hong Kong’s privacy watchdog has issued an advisory letter to a 24-hour chain fitness center after a mispositioned closed-circuit television (CCTV) camera at its Ma On Shan branch risked capturing images inside a men’s restroom. The camera has since been removed.

The Office of the Privacy Commissioner for Personal Data (PCPD) said on Wednesday it received a complaint in mid-July from a member of the gym, who raised concerns about a CCTV camera installed near the men’s restroom and feared that users could be recorded while using the facilities. The complainant said the situation caused unease.

Following the complaint, the PCPD conducted an investigation and sent an advisory letter to the fitness center.

The watchdog said officers carried out an on-site inspection at the branch the day after receiving the complaint, made three rounds of inquiries, and reviewed explanations and materials provided by the operator.

The investigation found that the men’s restroom area was connected by a public passageway leading to three separate restroom cubicles. The gym explained that about a week before the branch officially opened, its contractor had mistakenly installed a wooden door intended for one of the restroom entrances at the entrance to the public passageway instead. As a result, the affected men’s restroom was left without a door at the time.

Under those circumstances, the PCPD said that if recording functions had been activated, the position and angle of the CCTV camera could have allowed images of the restroom’s interior to be captured.

The fitness center told the PCPD that the camera was still in the installation and system testing stage at the time and that neither video nor audio recording functions had been activated, nor had any footage been collected.

After receiving inquiries from a member, the operator removed the camera the following day and temporarily hung a black curtain at the intended location of the restroom door as an interim measure, it said.

After the PCPD intervened, the gym took further remedial steps. These included installing a proper wooden door to fully block the restroom’s interior, removing the incorrectly installed door at the entrance of the public passageway, placing men’s restroom signs outside each of the three cubicles, and relocating the CCTV camera to the ceiling outside the restroom area to ensure that its coverage would not include any interior space.

The Privacy Commissioner, Ada Chung Lai-ling, said organizations should avoid collecting personal data through CCTV in unfair circumstances, including installing cameras in locations where individuals have a reasonable expectation of privacy, such as restrooms or changing rooms.

While the incident appeared to stem from an installation error involving the restroom door, the commissioner noted that the gym had failed to properly assess the appropriateness, positioning, and angle of the camera before instructing the contractor to install it.

This demonstrated insufficient caution in configuring the CCTV system and a lack of sensitivity toward the protection of personal data privacy, she said.

Taking into account the circumstances of the case, the PCPD said it believed that if the member had not raised concerns, the camera’s recording and audio functions might have been activated at a later stage, potentially capturing images of members inside the men’s restroom.

Although the camera did not involve the collection of “personal data” at the time of the incident because recording functions had not been activated, the PCPD nevertheless issued an advisory letter to remind the fitness center to comply with the Personal Data (Privacy) Ordinance when installing CCTV systems.