CCTV in co-living landed house

[Ernesto79]

The contract also doesn't mention their ability to collect personal data

Have you bothered to notice the fact that the MRT Stations and almost every major intersection in the city has dozens of CCTV cameras everywhere? Oh, So does the airport and all are connected to mainframe computers in underground caverns here and all are equipped with facial recognition software? If a home security camera gives you the hebee-jebees you are in the wrong country.

If course but many of them come with signs saying "CCTV in Operation", at least I've seen those signs at the entrances of most MRT stations.

Co-living companies are businesses/organizations so as far as I know PDPA rules apply as such they need to obtain consent for collection of our personal data, no?

[sundaymorningstaple]

What personal data are they collecting? As long as they are not streaming it online or publishing it anywhere, you are barking up the wrong tree. That would mean anybody with a smart phone couldn't use it. Sorry, but you are way off base.

[x9200]

Thank you all for the insightful feedback so far.

A few things...
- The house is not owned by the co-living company renting it. They rent it from the owner and rent it to their "members". A lot of the comments have been around the owner being able to have CCTV.

It does not mater as long as they have legal rights to manage the common place where they installed the camera.
And regardless, you still have no rights to mess with their property with perhaps some few exception unlikely applicable to your case.

- I have no doubt CCTV in common spaces is legal. My question is if they need to inform those living on the property or not?

IMHO, depends on the setting. Same applies to whether this is "legal" or not. A camera placed in a common space pointing to your window may be considered not acceptable.

- There is no mention of them taking and collecting video of the inhabitance within the contract or T&C's.

Now imagine two different scenarios, first, you live in a blockhouse, like HDB or a bigger condo. Cameras in such places are to be expected so nobody is going to explicitly mention it to you.
And now a terrace house you share with 2-3 other tenants. Are cameras there common and one should be expected by the tenants? Not really.

- The video camera is unmarked so can unplugging an unmarked video camera equate to "removal of effects or anything in the common areas and the unit"? That's the clause being used to evict and keep my deposit.

I think you are approaching the issue from a wrong side. The question to ask is whether your misconduct was significant enough to terminate the contract. In my opinion it was not, but I am not a lawyer so if you want to fight a battle you may need to consult one.

[Ernesto79]

What personal data are they collecting? As long as they are not streaming it online or publishing it anywhere, you are barking up the wrong tree. That would mean anybody with a smart phone couldn't use it. Sorry, but you are way off base.

PDPA states the below. The organization (definition of an organization would indicate a co-living company qualifies) has to get consent just for collection of personal data. I've never said they can't, I'm just wondering if others also understand PDPA as I do, that they need to get consent?

Consent required
13. An organisation must not, on or after 2 July 2014, collect, use or disclose personal data about an individual unless —
(a) the individual gives, or is deemed to have given, his or her consent under this Act to the collection, use or disclosure, as the case may be; or
(b) the collection, use or disclosure (as the case may be) without the individual’s consent is required or authorised under this Act or any other written law.

Deemed consent by notification
15A.—(1) This section applies to the collection, use or disclosure of personal data about an individual by an organisation on or after 1 February 2021.
(2) Subject to subsection (3), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if —
(a) the organisation satisfies the requirements in subsection (4); and
(b) the individual does not notify the organisation, before the expiry of the period mentioned in subsection (4)(b)(iii), that the individual does not consent to the proposed collection, use or disclosure of the personal data by the organisation.
(3) Subsection (2) does not apply to the collection, use or disclosure of personal data about the individual for any prescribed purpose.
(4) For the purposes of subsection (2)(a), the organisation must, before collecting, using or disclosing any personal data about the individual —
(a) conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to the attention of the individual:
(i) the organisation’s intention to collect, use or disclose the personal data;
(ii) the purpose for which the personal data will be collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable manner by which, the individual may notify the organisation that the individual does not consent to the organisation’s proposed collection, use or disclosure of the personal data; and
(c) satisfy any other prescribed requirements.
(5) The organisation must, in respect of the assessment mentioned in subsection (4)(a) —
(a) identify any adverse effect that the proposed collection, use or disclosure of the personal data for the purpose concerned is likely to have on the individual;
(b) identify and implement reasonable measures to —
(i) eliminate the adverse effect;
(ii) reduce the likelihood that the adverse effect will occur; or
(iii) mitigate the adverse effect; and
(c) comply with any other prescribed requirements.

[x9200]

What personal data are they collecting? As long as they are not streaming it online or publishing it anywhere, you are barking up the wrong tree. That would mean anybody with a smart phone couldn't use it. Sorry, but you are way off base.

PDPA states the below. The organization (definition of an organization would indicate a co-living company qualifies) has to get consent just for collection of personal data. I've never said they can't, I'm just wondering if others also understand PDPA as I do, that they need to get consent?

Consent required
13. An organisation must not, on or after 2 July 2014, collect, use or disclose personal data about an individual unless —
(a) the individual gives, or is deemed to have given, his or her consent under this Act to the collection, use or disclosure, as the case may be; or
(b) the collection, use or disclosure (as the case may be) without the individual’s consent is required or authorised under this Act or any other written law.

Deemed consent by notification
15A.—(1) This section applies to the collection, use or disclosure of personal data about an individual by an organisation on or after 1 February 2021.
(2) Subject to subsection (3), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if —
(a) the organisation satisfies the requirements in subsection (4); and
(b) the individual does not notify the organisation, before the expiry of the period mentioned in subsection (4)(b)(iii), that the individual does not consent to the proposed collection, use or disclosure of the personal data by the organisation.
(3) Subsection (2) does not apply to the collection, use or disclosure of personal data about the individual for any prescribed purpose.
(4) For the purposes of subsection (2)(a), the organisation must, before collecting, using or disclosing any personal data about the individual —
(a) conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to the attention of the individual:
(i) the organisation’s intention to collect, use or disclose the personal data;
(ii) the purpose for which the personal data will be collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable manner by which, the individual may notify the organisation that the individual does not consent to the organisation’s proposed collection, use or disclosure of the personal data; and
(c) satisfy any other prescribed requirements.
(5) The organisation must, in respect of the assessment mentioned in subsection (4)(a) —
(a) identify any adverse effect that the proposed collection, use or disclosure of the personal data for the purpose concerned is likely to have on the individual;
(b) identify and implement reasonable measures to —
(i) eliminate the adverse effect;
(ii) reduce the likelihood that the adverse effect will occur; or
(iii) mitigate the adverse effect; and
(c) comply with any other prescribed requirements.

Nothing to do with your case. This is about collecting specific data in database like fashion. Cctv footage alone is nothing of this type.

[Ernesto79]

Thank you all for the insightful feedback so far.

A few things...
- The house is not owned by the co-living company renting it. They rent it from the owner and rent it to their "members". A lot of the comments have been around the owner being able to have CCTV.

It does not mater as long as they have legal rights to manage the common place where they installed the camera.
And regardless, you still have no rights to mess with their property with perhaps some few exception unlikely applicable to your case.

- I have no doubt CCTV in common spaces is legal. My question is if they need to inform those living on the property or not?

IMHO, depends on the setting. Same applies to whether this is "legal" or not. A camera placed in a common space pointing to your window may be considered not acceptable.

- There is no mention of them taking and collecting video of the inhabitance within the contract or T&C's.

Now imagine two different scenarios, first, you live in a blockhouse, like HDB or a bigger condo. Cameras in such places are to be expected so nobody is going to explicitly mention it to you.
And now a terrace house you share with 2-3 other tenants. Are cameras there common and one should be expected by the tenants? Not really.

- The video camera is unmarked so can unplugging an unmarked video camera equate to "removal of effects or anything in the common areas and the unit"? That's the clause being used to evict and keep my deposit.

I think you are approaching the issue from a wrong side. The question to ask is whether your misconduct was significant enough to terminate the contract. In my opinion it was not, but I am not a lawyer so if you want to fight a battle you may need to consult one.

Yes, very good point. I do have a lawyer who's very familiar with the situation having lived in the house previously. Their (in my opinion) very loose interpretation of their own contract and confiscation of deposit (not to mention fines not covered in the contract) make it clear they want to get as much money from me as possible, get me out asap and rent it for a higher price to the next person. This is only but one part of the story.

[Ernesto79]

What personal data are they collecting? As long as they are not streaming it online or publishing it anywhere, you are barking up the wrong tree. That would mean anybody with a smart phone couldn't use it. Sorry, but you are way off base.

PDPA states the below. The organization (definition of an organization would indicate a co-living company qualifies) has to get consent just for collection of personal data. I've never said they can't, I'm just wondering if others also understand PDPA as I do, that they need to get consent?

Consent required
13. An organisation must not, on or after 2 July 2014, collect, use or disclose personal data about an individual unless —
(a) the individual gives, or is deemed to have given, his or her consent under this Act to the collection, use or disclosure, as the case may be; or
(b) the collection, use or disclosure (as the case may be) without the individual’s consent is required or authorised under this Act or any other written law.

Deemed consent by notification
15A.—(1) This section applies to the collection, use or disclosure of personal data about an individual by an organisation on or after 1 February 2021.
(2) Subject to subsection (3), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if —
(a) the organisation satisfies the requirements in subsection (4); and
(b) the individual does not notify the organisation, before the expiry of the period mentioned in subsection (4)(b)(iii), that the individual does not consent to the proposed collection, use or disclosure of the personal data by the organisation.
(3) Subsection (2) does not apply to the collection, use or disclosure of personal data about the individual for any prescribed purpose.
(4) For the purposes of subsection (2)(a), the organisation must, before collecting, using or disclosing any personal data about the individual —
(a) conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to the attention of the individual:
(i) the organisation’s intention to collect, use or disclose the personal data;
(ii) the purpose for which the personal data will be collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable manner by which, the individual may notify the organisation that the individual does not consent to the organisation’s proposed collection, use or disclosure of the personal data; and
(c) satisfy any other prescribed requirements.
(5) The organisation must, in respect of the assessment mentioned in subsection (4)(a) —
(a) identify any adverse effect that the proposed collection, use or disclosure of the personal data for the purpose concerned is likely to have on the individual;
(b) identify and implement reasonable measures to —
(i) eliminate the adverse effect;
(ii) reduce the likelihood that the adverse effect will occur; or
(iii) mitigate the adverse effect; and
(c) comply with any other prescribed requirements.

Nothing to do with your case. This is about collecting specific data in database like fashion. Cctv footage alone is nothing of this type.

Are you certain about that? The definition given for an organization is the following...

“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not —
(a) formed or recognised under the law of Singapore; or
(b) resident, or having an office or a place of business, in Singapore;

[x9200]

PDPA states the below. The organization (definition of an organization would indicate a co-living company qualifies) has to get consent just for collection of personal data. I've never said they can't, I'm just wondering if others also understand PDPA as I do, that they need to get consent?

Consent required
13. An organisation must not, on or after 2 July 2014, collect, use or disclose personal data about an individual unless —
(a) the individual gives, or is deemed to have given, his or her consent under this Act to the collection, use or disclosure, as the case may be; or
(b) the collection, use or disclosure (as the case may be) without the individual’s consent is required or authorised under this Act or any other written law.

Deemed consent by notification
15A.—(1) This section applies to the collection, use or disclosure of personal data about an individual by an organisation on or after 1 February 2021.
(2) Subject to subsection (3), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if —
(a) the organisation satisfies the requirements in subsection (4); and
(b) the individual does not notify the organisation, before the expiry of the period mentioned in subsection (4)(b)(iii), that the individual does not consent to the proposed collection, use or disclosure of the personal data by the organisation.
(3) Subsection (2) does not apply to the collection, use or disclosure of personal data about the individual for any prescribed purpose.
(4) For the purposes of subsection (2)(a), the organisation must, before collecting, using or disclosing any personal data about the individual —
(a) conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to the attention of the individual:
(i) the organisation’s intention to collect, use or disclose the personal data;
(ii) the purpose for which the personal data will be collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable manner by which, the individual may notify the organisation that the individual does not consent to the organisation’s proposed collection, use or disclosure of the personal data; and
(c) satisfy any other prescribed requirements.
(5) The organisation must, in respect of the assessment mentioned in subsection (4)(a) —
(a) identify any adverse effect that the proposed collection, use or disclosure of the personal data for the purpose concerned is likely to have on the individual;
(b) identify and implement reasonable measures to —
(i) eliminate the adverse effect;
(ii) reduce the likelihood that the adverse effect will occur; or
(iii) mitigate the adverse effect; and
(c) comply with any other prescribed requirements.

Nothing to do with your case. This is about collecting specific data in database like fashion. Cctv footage alone is nothing of this type.

Are you certain about that? The definition given for an organization is the following...

“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not —
(a) formed or recognised under the law of Singapore; or
(b) resident, or having an office or a place of business, in Singapore;

Not the organization is the problem but the personal data. They would be under this statute if the take photos of the people, combine it with their NRIC/FIN, or DoB, or anything else that could be used to identify the person and gather all this information in any systematic manner. CCTV footage alone is just footage and not personal data.

Edited: but if you really look for a relation to PDPA then the other way to look at it whether the personal data recorded by cctv are publicly available.
"a video camera near the front entrance of the house which faces the house entrance and front yard. " Is it possible to obtain similar footage from outside of the property? Or, is the camera recording information that is also available from public area outside? If yes, then 1st or 2nd Schedule to PDPA excepts it from the requirement of informing/consent about the camera.

[sundaymorningstaple]

If Ernesto79 was correct in his warped interpretation then it would be against the law to have security camera hook up to your door viewer as so many people do (the one that record 24/7 and subsequently after the ssd is full it erases the oldest data and records over it? After all, Many people have registered home based businesses. I had one of my own many years ago. In his interpretation, of the rules, all the security viewer companies would be out of business. Lots of these systems are motion based activation in order to save storage space as well. You can buy waterproofed systems that run off apps on you phone (I've had one for the past 6 or 7 years). I can be in my office and view my property both from within or outside my unit in the corridor, in colour, with full pan & tilt functions very common here. nobody has CCTV or surveillance camera notices installed and can even be bought in places like Challenger.

[x9200]

Ernesto IMO confuses personal data with with general privacy protection. This is not the same law although both are of course related.
Personal data protection act governs collection and processing of data that can be used to identify person as well as gathering information about the person. "Organization" is mentioned in that context otherwise having your own contact book with addresses of your friends and family would be also illegal. Generally this act was created to prevent various companies from uncontrolled collection of private data. Think about insurers for examples.

Privacy itself is more general term also referring to ones right to have her/his aspects of private life protected, so for example, not disturbed by other people.

For cameras in public space it often depends on circumstances. One good example where there are not even cameras involved is LRT with the side windows of the trains getting blind because otherwise the passengers could stare at someones windows.
For the peephole cameras I think it is a bit grey area but if all the neighbors have it then there should be not a big issue. It often boils down to the term reasonably expected. You have no reason to expect a camera pointing from outside to your bathroom window, but you should expect a street camera covering part of your property. Even at private home, in private bedroom, you have guests, and they temporary use the bedroom. Should they be informed about the camera? Of course they should because there is no way they could expect it there (and they may not notice it) and do things they would not normally do (changing cloths etc.). So again, all is circumstantial.

Majority of the situations falls under civil law so whether something is legal or not is for the court to decide and only if one takes an action (sue the camera operator). Many people simply do not bother but this does not mean all the cameras we see in public space are ok.

[smoulder]

If Ernesto79 was correct in his warped interpretation then it would be against the law to have security camera hook up to your door viewer as so many people do (the one that record 24/7 and subsequently after the ssd is full it erases the oldest data and records over it? After all, Many people have registered home based businesses. I had one of my own many years ago. In his interpretation, of the rules, all the security viewer companies would be out of business. Lots of these systems are motion based activation in order to save storage space as well. You can buy waterproofed systems that run off apps on you phone (I've had one for the past 6 or 7 years). I can be in my office and view my property both from within or outside my unit in the corridor, in colour, with full pan & tilt functions very common here. nobody has CCTV or surveillance camera notices installed and can even be bought in places like Challenger.

And what about dash cams fitted in vans belonging to businesses....

[malcontent]

Have you seen these police cars that have like 20 cameras on them?

[sundaymorningstaple]

I thought they were google map cars!!!! LOL