CCTV at Hong Kong malls and the police SmartView programme

Hong Kong's Secretary for Security said in a television interview on 18 October that some CCTV cameras at private shopping malls will be connected to the Hong Kong Police Force's SmartView programme, and that talks with the malls had reached their final stage. He did not name the malls. According to HK01, he also said the public may not need to be told that cameras have been connected, depending on each mall's practice. People travelling to Hong Kong for leisure or business may appear on connected cameras when passing through public areas of malls, and places outside Hong Kong are not affected.

According to a paper the Security Bureau and the police submitted to the Legislative Council in February, SmartView is a government-led programme to install CCTV in public places with high crime rates and heavy pedestrian flow, with aims including safeguarding national security, preventing crime, assisting investigations and managing crowds. The first phase was completed at the end of 2025, with about 5,000 cameras installed by the police and about 6,000 cameras of other government departments and organisations connected. According to the paper, about 60,000 cameras are planned across the city by 2028 and about 6,500 more between 2028 and 2031, and from its launch in April 2024 to January 2026 the programme helped the police detect 899 cases. According to The Collective HK, the Legislative Council's Finance Committee approved funding of about HK$4.06 billion on 27 March.

The same paper lists AI functions including crowd size estimation and number plate recognition, and the Secretary told the Legislative Council in February that facial recognition would be added so the system could track suspects across cameras automatically. According to Dim Sum Daily, he said in the 18 October interview that facial recognition is being piloted in parts of the system. The Commissioner of Police said in an interview in February that the public would be informed before it is deployed. According to Sing Tao Daily, the Commissioner hopes to introduce it by 2027 at the latest, with the timing depending on conditions including a legal framework.

According to Hong Kong Free Press, the Secretary said that whether police can see live footage or only download it afterwards would depend on the location's crime risk. He told the Legislative Council in February that third-party connections are one-way, so third parties cannot obtain data from the system. He also said footage on the government system is generally kept for 31 days and then deleted automatically, unless a designated officer of a higher rank decides on other use. On the arrangements for malls, Dim Sum Daily reported the Secretary as saying in October that they would follow each mall's existing policies.

Perspective

Our inference is that once cameras are connected, police could view or retrieve through the system footage that each mall previously stored on its own. Based on the Secretary's description to the Legislative Council in February, adding facial recognition would turn the search for a suspect from reviewing footage clip by clip by hand into automatic tracking across cameras. Under the October 2025 CCTV guidance from Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD), facial identification and tracking of individuals are not normally expected by the public, so their use must be supported by strong justification.

In 2019 the Hong Kong government disabled three functions on smart lampposts over privacy concerns, and in 2020 a technical advisory committee recommended more privacy-friendly technologies in place of the lampposts' cameras and Bluetooth detectors. As of 23 October, the places listed on the police SmartView page for installing cameras include ordinary lampposts and smart lampposts.

According to Hong Kong Free Press, the Secretary said that many malls already display signs warning of recording, so the public may not need to be told separately that cameras are connected to the police system. The notice for third-party cameras shown on the police SmartView page is posted at the discretion of the property owner. Under the PCPD's guidance, notices should name the data user operating the system and the specific purpose of the surveillance.

According to the minutes of the Legislative Council Panel on Security's February meeting, members raised concerns about how the cameras would safeguard the public's privacy and personal data security, and in the same minutes members supported proceeding with the second and third phases. According to a Hong Kong Free Press report from October 2025, Hong Kong had no rules on how law enforcement could use AI, and the PCPD had declined to tell AFP whether it had been consulted. As of 23 October, we could not find any public response from the PCPD to SmartView, nor a legal framework specific to facial recognition.

According to the police SmartView page, cameras installed under the programme capture only public places, and an independent consultancy was commissioned to conduct a privacy impact assessment. There is no mention on the page of whether third-party cameras also capture only public places or are covered by that assessment. The Commissioner of Police said in a February interview that the government is working on a legal framework for facial recognition. The Secretary told the Legislative Council in February that the AI analysis then under discussion all took place after a crime and would not systematically intrude on privacy, and that the Department of Justice and the Privacy Commissioner for Personal Data had been consulted.

People caught on camera, including visitors, can use the form specified by the PCPD to make a data access request to the organisation holding the footage, and requests to the police can be made at a police station, by post or online. The organisation must respond within 40 days and may ask for proof of identity and charge a fee, and the form's identity field also accepts a passport number. According to the PCPD's practical guide, data held for preventing or detecting crime can be exempted under section 58 of the Personal Data (Privacy) Ordinance where giving access would be likely to prejudice that purpose. According to the same guide, a data user must have sufficient evidence that the data is held for these purposes, and a mere general assertion is not enough.

We, a community based in Taiwan, compared three other places in Asia on the same points as Hong Kong, using laws we read on 23 October. On who can draw on cameras that police do not own, Taiwan's Police Power Exercise Act lets police collect data with existing recording equipment in public places or places open to the public, which we read as including malls, where crime is frequent or reasonably expected, though we did not check whether privately owned cameras are covered. In mainland China, shopping centres are among the places covered by the State Council's regulations on public security video systems, in force since 1 April 2025, and state organs retrieving that footage for law enforcement must follow the authority and procedures set by laws and administrative regulations.

In South Korea, those with proper authority, such as malls, may install cameras in public places for facility safety and management under the Personal Information Protection Act. Under Article 18(2) of the same act, they may provide footage to others with the person's separate consent or where another law makes special provision, unless this would unfairly infringe the interests of the person or a third party. The provision on disclosure for criminal investigations (Article 18(2) item 7) applies only to public institutions, and we did not check which provisions of laws such as the Criminal Procedure Act apply.

On notices, South Korea requires signs giving the purpose and location, the area and hours filmed and a contact for the person in charge, while Taiwan's Article 10 contains no provision on notices. Mainland China's regulations require a conspicuous notice without setting its content, and its measures on facial recognition, in force since 1 June 2025, require operators to tell people beforehand, in a conspicuous way, matters such as the operator's name and contact details, the purpose and the retention period, unless laws or administrative regulations allow otherwise. For mainland China we did not check internal rules on police use of facial recognition.

On retention, according to the Secretary, footage on Hong Kong's government system is generally kept for 31 days and then deleted automatically. Mainland China's Article 17 sets a minimum for the units managing public security video systems, malls included, which must keep footage for at least 30 days before deleting what has served its purpose. Taiwan's Article 10 sets a maximum for data collected by police, which must be destroyed within one year unless needed to investigate a suspected crime or other violation. We did not check South Korea's retention rules.

Readers can weigh the programme with a few questions. First, on the effect the government wants, whether figures on cases solved will be published after malls are connected. Second, on the safeguards Legislative Council members raised, whether what is announced before facial recognition is deployed includes the legal basis and retention rules. Third, on the notices called for in the PCPD's guidance, whether connected malls let passers-by know their footage goes to the police.

Next, it is worth watching when the police announce the timing and legal framework for facial recognition, whether the connected malls are made public, and whether the PCPD responds to SmartView.