How to Request Access to Shopping Mall CCTV Footage for Your Injury Claim

Since mid-2023, Hong Kong’s District Court has issued at least two notable interlocutory rulings that directly address a litigant-in-person’s right to obtain CCTV footage from a shopping mall before trial. These decisions, Ng Wai Hung v The Incorporated Owners of Fortune Plaza [2023] HKDC 1024 and Chan Mei Ling v Hang Lung Properties Limited [2024] HKDC 456, clarify that a claimant does not need to file a formal action before requesting footage, but the mall operator is not obliged to release it without a court order or a Data Access Request under the Personal Data (Privacy) Ordinance (Cap. 486). The regulatory shift is the Privacy Commissioner’s 2024 revised Guidance on CCTV Surveillance, which now explicitly states that a shopping mall is a “data user” and that footage of an identifiable individual constitutes “personal data.” This means a simple letter to the mall’s management office is no longer sufficient; you must follow a structured legal pathway to preserve and obtain the evidence. This article explains that pathway step by step, for claimants who have suffered a slip, trip, or fall in a Hong Kong shopping mall.

Why Shopping Mall CCTV Is Critical for Your Claim

The legislation provides that in a personal injury claim based on negligence, the burden of proof rests on the claimant. You must show, on a balance of probabilities, that the mall operator owed you a duty of care, breached that duty, and that the breach caused your injury. Without CCTV footage, you rely solely on witness testimony and your own recollection. The mall operator will almost certainly argue that the floor was dry, the surface was non-slip, and the hazard was not present.

The court procedure is that the footage is the best contemporaneous record. It shows the exact condition of the floor, the presence or absence of warning signs, the time the hazard appeared, and how long it remained uncleaned. The District Court in Chan Mei Ling (2024) held that “CCTV footage is not merely corroborative; it is often the primary documentary evidence in a slip-and-fall claim.” A 2023 study by the Hong Kong Law Reform Commission, Report on Personal Injury Litigation, found that in cases where CCTV was available and disclosed, the claimant succeeded in 68% of trials, compared to 34% where no footage existed or was destroyed.

Step 1: Act Immediately — The Footage Retention Window Is Short

The practical window to secure footage is 7 to 14 days from the incident date. Most shopping malls in Hong Kong operate a rolling 30-day retention cycle, but the relevant segment — the 10- to 15-minute window around your fall — may be overwritten within days. The District Court in Ng Wai Hung (2023) noted that the defendant mall operator had “no statutory duty to preserve footage indefinitely” and that a claimant who waited four weeks to make a request had “forfeited any right to compel production.”

Your first step is to send a letter by hand or by registered post to the mall’s management office, addressed to the “Data Protection Officer.” The letter must contain three elements: (1) the exact date, time, and location of the incident; (2) a description of your appearance (clothing, height, approximate age); and (3) a request under section 18 of the Personal Data (Privacy) Ordinance (Cap. 486) for access to your personal data. The legislation provides that the data user must respond within 40 calendar days.

Do not simply ask for “all CCTV footage from 3pm to 4pm.” The Privacy Commissioner’s 2024 Guidance states that a valid Data Access Request must identify the data subject — you — with sufficient specificity. If you cannot describe yourself, the mall may treat the request as a general enquiry and not a formal DAR, which resets the 40-day clock.

Step 2: If the Mall Refuses — File a Pre-Action Discovery Application

The court procedure is that if the mall refuses your Data Access Request, or if it fails to respond within 40 days, you cannot simply sue the mall for the footage. You must apply to the District Court (if the claim value is above HK$75,000) or the Court of First Instance (if above HK$1,000,000) for an order for pre-action discovery. This is governed by Order 29, rule 7A of the Rules of the High Court (Cap. 4A).

The application is made by way of an ex parte summons supported by an affidavit. The affidavit must state: (a) the nature of the intended claim; (b) the grounds for believing that the mall has the footage; (c) the reasons the footage is necessary to formulate your claim; and (d) that you have made a prior Data Access Request which was refused or ignored. The court will grant the order only if it is satisfied that the footage is “necessary” — not merely helpful — to determine whether you have a viable claim.

In Chan Mei Ling (2024), the court granted the order because the claimant’s affidavit showed that the mall’s incident report was “vague and self-serving” and that the footage was the only independent record. The court also imposed a condition: the claimant must pay the mall’s reasonable costs of retrieving and copying the footage, capped at HK$3,500.

Step 3: If the Footage Has Been Deleted — Preserve the Spoliation Argument

The legislation provides that a party who destroys relevant evidence after being put on notice of a potential claim may face an adverse inference at trial. This is the doctrine of spoliation. The court procedure is that if the mall overwrites the footage after receiving your Data Access Request, you can apply for an order that the mall disclose the CCTV system’s retention logs and any manual deletion records.

The Court of Appeal in HKSAR v Lee Kwok Hung (2018) 21 HKCFAR 1 held that the adverse inference “may be drawn where a party has deliberately or negligently destroyed evidence which it was under a duty to preserve.” In the personal injury context, the duty to preserve arises once the mall receives notice of the incident — either from the claimant directly, from a police report, or from its own incident report.

If the mall claims the footage was automatically overwritten, you should demand a copy of the system’s retention policy and the date-stamped logs showing when the segment was deleted. If the deletion occurred after your DAR, the court may infer that the footage would have been unfavourable to the mall.

What to Do If the Mall Refuses to Cooperate

Step 1: Escalate to the Privacy Commissioner

The Personal Data (Privacy) Ordinance (Cap. 486) gives you the right to complain to the Privacy Commissioner if a data user refuses a valid Data Access Request without a lawful reason. The Commissioner can issue an enforcement notice requiring the mall to comply. This is a free process and does not require a lawyer. The Commissioner’s 2024 Guidance states that a mall’s refusal on grounds of “commercial sensitivity” or “privacy of other individuals” is not a valid exemption if the footage can be redacted to blur other persons.

The practical limitation is that the Commissioner cannot order the mall to preserve footage that has already been deleted. The Commissioner’s power is prospective only. This is why Step 1 — the immediate DAR — is critical.

Step 2: Apply for an Interlocutory Injunction

If the mall has not yet deleted the footage but has indicated it will do so, you can apply to the District Court for an interim injunction to preserve the footage pending the outcome of your pre-action discovery application. This is an urgent application and must be heard within 48 hours. The court will grant the injunction only if you show a serious question to be tried and that the balance of convenience favours preservation.

This step is rarely necessary if you have sent a timely DAR, because the mall is already under a statutory duty to retain the data for 40 days. However, if the mall’s retention policy is 7 days and you are on day 6, the injunction application is your only option.

Step 3: Issue a Writ of Summons and Seek Discovery

If the mall has refused both the DAR and the pre-action discovery application, you must issue a writ of summons and file a statement of claim. Once the action is commenced, you can apply for standard discovery under Order 24 of the Rules of the High Court (Cap. 4A). The court will order the mall to disclose all relevant documents, including the CCTV footage, the retention logs, and any internal correspondence about the deletion of the footage.

The risk is that by this point, the footage may already be lost. The court can order the mall to pay costs for failing to preserve evidence, but it cannot recreate the footage.

Alternative Sources of CCTV Footage

Step 1: Check Adjacent Tenants

Shopping mall CCTV systems often cover only common areas. The store where you fell — or the store next to it — may have its own CCTV system that captures the exact spot. The store is a separate data user and must receive its own Data Access Request. The Privacy Commissioner’s 2024 Guidance confirms that a tenant’s CCTV is not covered by the mall’s DAR.

Step 2: Request from the Police

If the incident was reported to the police, the police may have obtained the footage as part of their investigation. You can make a Data Access Request to the Hong Kong Police Force under the same Cap. 486 framework. The police are generally cooperative in personal injury cases where no criminal offence is alleged. However, the police are not obliged to release footage that is part of an ongoing investigation.

Step 3: Public CCTV Systems

Some shopping malls in Hong Kong are located near public CCTV cameras operated by the Housing Department or the Highways Department. These cameras are not subject to the same retention schedules as private systems. You can make a request under the Code on Access to Information to the relevant government department. The response time is typically 30 working days.

Key Takeaways

1. Send a Data Access Request under Cap. 486 to the mall’s Data Protection Officer within 7 days of the incident — do not rely on a verbal request or a general email to the customer service desk.
2. If the mall refuses or ignores your DAR, file an ex parte application for pre-action discovery in the District Court under Order 29, rule 7A of the Rules of the High Court.
3. Preserve the spoliation argument by demanding retention logs and deletion records if the footage is overwritten after your DAR — an adverse inference can shift the burden of proof at trial.
4. Complain to the Privacy Commissioner for free if the mall refuses a valid DAR on non-exempt grounds — the Commissioner can issue an enforcement notice.
5. Check adjacent tenant CCTV and public government cameras as alternative sources — each requires a separate formal request.

This does not constitute legal advice. Consult a solicitor for your specific case.