Facial recognition and mall cameras in Hong Kong's SmartView programme

At a media briefing on 5 November, the Hong Kong Police Force said facial recognition is expected to be added to SmartView within November, and that cameras at the first shopping malls could be connected by the end of the year. SmartView is the police's CCTV network, linking police cameras and cameras of other organisations into one system, and the police also said connecting the malls complies with Hong Kong's privacy law. The police statements are known only through media reports, as we could not find a government press release, and as of 8 November neither facial recognition nor the mall connection had been announced as launched. People who live in Hong Kong or travel there for leisure or business may have their images fed into SmartView when they pass through a connected mall, and places outside Hong Kong are not affected.

As our previous article covered, the Secretary for Security said in an interview on 18 October that CCTV at some malls would be connected to SmartView, and that the public might not need to be told separately. According to Sing Tao Headline, once the cameras are connected, officers can view mall footage from their offices instead of going to the mall in person and completing the paperwork to retrieve it. According to sources cited by HK01, the first four are Olympian City, Tuen Mun Town Plaza, Kwai Chung Shopping Centre and Sierra Life in Fanling. The Collective HK reported that Olympian City and Tuen Mun Town Plaza belong to Sino Group, while Kwai Chung Shopping Centre and Sierra Life belong respectively to the Hong Kong Housing Authority and the Hong Kong Housing Society, two public housing bodies.

Sing Tao Headline, relaying the police explanation, described two ways facial recognition will be used. One is a retrospective search, in which police enter a suspect's facial features into the system and search specified clips, cameras or time periods for whether that person appeared. The other is real-time tracking: for example, after family members provide a recent photo of a high-risk missing elderly person and authorise its use, the system raises an alert as soon as that person appears on camera.

According to Hong Kong Free Press (HKFP), a senior superintendent in the police Operations Bureau said facial recognition would not operate round the clock, and each use would need approval from an officer ranked inspector or above. am730 and Sing Tao Headline quoted the same officer as saying the system can run 24 hours a day to help with searches. Our inference is that the two accounts may refer, respectively, to the system not routinely matching faces across all cameras and to continuous matching once a use is approved. Sing Tao Headline and The Standard also quoted a superintendent in the Operations Bureau as saying that, because of limited computing resources, facial recognition will not be activated on every camera, but resources can be directed to specific cameras for round-the-clock analysis when needed.

On how facial recognition relates to mall cameras, the only explanation we found was in a report by ID Tech. As quoted by ID Tech, a superintendent said the feature can be activated on police cameras and on connected third-party feeds (cameras of malls and other organisations), but will only be triggered when investigating crimes or searching for high-risk missing people.

According to am730 and The Collective HK, during a trial in October the police entered into the system a photo of an elderly person in their eighties who had gone missing after leaving a care home, and found the person within an hour and a half of the report. Figures provided by the police and relayed by am730 show that, as of 31 October, SmartView had helped detect 2,192 criminal cases and arrest 2,831 people.

Footage is generally deleted automatically after about a month: HKFP and Sing Tao Headline say 30 days, while HK01 and ID Tech say no more than 31 days. Sing Tao Headline and The Standard add that this does not apply where keeping the data is in the public interest. Data related to facial recognition is kept longer than footage, up to 180 days according to most reports, some of which attribute the figure to sources. HKFP and The Collective HK describe this data as records such as times and locations, while ID Tech says it also includes photos of faces.

Perspective

According to sources cited by HK01, even after footage has been deleted, the police can use the 180 days of data to establish when and where, and on which camera, a person they searched for appeared. Sing Tao Headline relayed the police reasoning that feature data takes up very little storage, that some criminal cases may have happened six months or a year earlier, and that keeping the data longer improves investigations and cost-effectiveness.

According to HKFP and i-CABLE, the police said that, based on assessments by their legal team and the Office of the Privacy Commissioner for Personal Data (PCPD, the statutory body responsible for personal data protection), connecting the malls complies with Hong Kong law. am730 also reported that the police had asked a third-party body to review the arrangement. The PCPD's general CCTV guidance, issued in October 2025 before the briefing, says facial identification and tracking of individuals are not normally expected by the public, so their use must be supported by strong justification. On this connection, i-CABLE quoted an officer as saying the Privacy Commissioner had told the police there was "absolutely no problem, legally or in terms of regulation" (our translation).

According to Sing Tao Headline, the police said their talks with malls had received a very positive response. On 20 October The Collective HK asked the groups that own 16 malls whether they would take part and whether they would put up additional notices; two groups replied that they had no further information, and several, Sino Group among them, did not reply. As of 8 November the police SmartView page still says that notices near third-party cameras are posted at the discretion of the property owner, and HK01 likewise relayed the police as saying there is no requirement and it depends on each mall's practice. Sing Tao Headline relayed the police reasoning that malls already display notices that CCTV is in use, and that after consulting the Department of Justice and the PCPD the police concluded SmartView notices need not be required under every camera, though they would encourage malls to post them.

Sing Tao Headline and The Standard relayed the police position that the system is used only to safeguard national security, prevent and detect crime, and maintain public safety and order, and that officers must pass two internal tests before accessing footage (whether SmartView is essential, and whether the cameras and time periods match the purpose of the investigation). The police also said the cameras capture only public places, and that operating procedures were set based on an independent privacy impact assessment (a review, before launch, of how a system affects personal data) and discussions with the PCPD.

In its report, the Economic Digest added its own comment that specific privacy safeguards, the scope of data use and the oversight mechanism have not yet been disclosed. As of 8 November, the reports do not say whether the 180 days of data covers only the people searched for or everyone who passes a camera, whether the connected mall cameras also capture only public places, or whether data generated by facial recognition can be requested by the people concerned. The PCPD's view is known only through the police account, and we could find no statement from the PCPD or reply to the media (the press release page on the PCPD's website could not be loaded). Nor could we find any public position on the briefing from mall owners, Legislative Council members, academics or civil society groups.

People who neither live in Hong Kong nor plan to travel there do not need to do anything. The police have not said which malls beyond the four named in the media will be connected, and notices depend on whether each mall posts them, so our inference is that people passing through a mall may not be able to tell in advance which cameras feed into SmartView. People caught on camera, including visitors, can use the PCPD's prescribed form to make a data access request to the organisation holding the footage, and requests to the police can be made in person at a police station, by post or online. As our previous article also noted, the police can claim an exemption under section 58 of the Personal Data (Privacy) Ordinance where giving access would be likely to prejudice the prevention or detection of crime.

We compared rules on facial recognition in three other places in Asia. In mainland China, measures on facial recognition in force since 1 June 2025 require that facial recognition equipment in public places be necessary for public security and marked with a conspicuous notice, though the text does not say whether this applies in practice to systems the police build themselves. In Taiwan, we found no law expressly governing police use of facial recognition in the two laws we searched (the Police Power Exercise Act and the Personal Data Protection Act; other laws were not checked), and Article 10 of the former, which lets police coordinate the installation of CCTV cameras or use existing recording equipment to collect data in public places, says nothing about notices or facial recognition.

In Japan, according to government answers in the Diet in 2021, police in individual cases obtain suspects' face images from security cameras under the Code of Criminal Procedure, with the cooperation of the cameras' managers, and compare them with suspect photos the police hold. For private businesses, a FAQ from Japan's Personal Information Protection Commission says operators of face-identification camera systems in shops, stations or airports must make clear that facial identification is being used, because the cameras' appearance does not reveal it. The same FAQ recommends posting notices at entrances or camera locations naming the operator, the purpose and a contact, a rule for businesses that does not cover the Japanese police. In Hong Kong, according to the police, SmartView notices at connected malls are left to each mall.

Readers can weigh the programme with a few questions. First, on figures for effectiveness and safeguards, whether the police will publish how often facial recognition is used, how many people are found and cases solved, and how many applications are refused. Second, on oversight, whether any body outside the police force reviews the usage records beyond the inspector's approval and the internal tests. Third, on notices, whether connected malls let passers-by know their images go to the police.

Next, it is worth watching for an announcement that facial recognition has formally launched, the timing and list of the first connected malls, and whether the PCPD responds publicly.