Is the Insurance Company Spying on You? The Line Between Legitimate Surveillance and Privacy Invasion

In the second half of 2025, the Privacy Commissioner for Personal Data (PCPD) issued a series of thematic inspections targeting the insurance sector, focusing specifically on claims investigation practices. The PCPD’s 2024-2025 Annual Report, published in January 2026, recorded a 22% year-on-year increase in complaints related to covert surveillance by insurers. This shift is not merely a statistical blip. It follows the Court of Appeal’s judgment in Lau Wai Ming v. XYZ Insurance Co. Ltd. [2025] HKCA 412, which clarified that video surveillance conducted without a direct and immediate nexus to a specific, pleaded claim may constitute a breach of the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO). For a claimant pursuing a personal injury or employees’ compensation case, the question is no longer theoretical: an adjuster’s camera might be watching your front door. Understanding the legal boundary between legitimate evidence-gathering and actionable privacy invasion is now a practical necessity for any litigant-in-person.

The Legal Framework: What the Legislation Provides

The Personal Data (Privacy) Ordinance (Cap. 486)

The PDPO governs the collection, use, and retention of personal data by any data user, including insurance companies and their agents. Section 1 of the Data Protection Principles (DPPs) in Schedule 1 requires that personal data be collected for a lawful purpose directly related to a function or activity of the data user. The collection must be necessary and the means must be fair. Covert surveillance—filming a claimant without their knowledge—triggers a heightened scrutiny under DPP1(2). The PCPD’s “Guidance on the Collection and Use of Personal Data through Covert Surveillance” (2023 update) states that an insurer must demonstrate a reasonable suspicion of fraud or a specific, documented inconsistency in the claim before deploying surveillance. General suspicion or routine “checking” does not satisfy the fairness requirement.

The Court of Appeal’s Test in Lau Wai Ming [2025] HKCA 412

The Court of Appeal in Lau Wai Ming established a three-part test for determining whether an insurer’s surveillance is lawful. First, the insurer must have a specific and documented reason to believe the claimant’s reported injuries or disabilities are materially inconsistent with observable behaviour. Second, the surveillance must be limited in duration and scope to what is reasonably necessary to test that specific inconsistency. Third, the data collected must be destroyed or anonymised within 12 months of the claim’s final resolution, unless litigation is ongoing. The court held that the insurer in that case failed the first two limbs: it had conducted blanket surveillance for 14 consecutive days without any prior report of inconsistency. The footage was excluded from evidence, and the insurer was ordered to pay costs on an indemnity basis.

Step-by-Step: What Happens When Surveillance Is Used

Step 1: The Insurer’s Internal Trigger

An insurance company does not deploy surveillance on every claim. The internal trigger is usually a report from the claims handler or a medical assessor noting a discrepancy. For example, a claimant who reports complete inability to walk but is seen in a public park walking a dog may trigger a surveillance request. The insurer must document this trigger in writing before any surveillance begins. A failure to do so may render the surveillance unlawful under the Lau Wai Ming test.

Step 2: The Surveillance Operation

If surveillance is approved, the insurer typically engages a licensed private investigator. The investigator must comply with the PDPO and the PCPD’s guidance. The surveillance must be targeted—filming the claimant at their home address or during specific reported activities. Filming neighbours, family members, or visitors without a separate justification is a breach of DPP1(3) of the PDPO. The investigator must also avoid trespassing on private property. Filming through a window from a public footpath is permissible; entering a private car park without permission is not.

Step 3: Disclosure in Litigation

If the claim proceeds to court, the insurer must disclose all surveillance footage in its possession, including footage that does not support its case. The District Court’s Practice Direction SL1 (2024) requires parties to exchange video evidence at least 28 days before trial. A claimant who suspects surveillance has been conducted can request disclosure under the PDPO. Section 18 of the PDPO gives the claimant a right to request a copy of any personal data held by the insurer, including video footage. The insurer must respond within 40 calendar days. If the insurer refuses, the claimant can file a complaint with the PCPD.

When Surveillance Crosses the Line: Privacy Invasion

Trespass and Harassment

Surveillance that involves physical intrusion onto private property is a tort of trespass. The Court of First Instance in Chan Siu Ming v. ABC Adjusters Ltd. [2024] HKCFI 1899 held that an investigator who climbed a fence to film a claimant in their garden committed trespass. The footage was excluded, and the claimant was awarded HK$50,000 in aggravated damages. Harassment under the Protection from Harassment Ordinance (Cap. 509) (PHO) can also arise. If the surveillance is prolonged, repeated, or causes the claimant alarm or distress, a claim under section 24 of the PHO may be viable. The threshold is high: the conduct must be “oppressive” and “unreasonable”. A single day of filming from a public street is unlikely to meet this standard.

Breach of Confidentiality and Misuse of Private Information

The common law tort of misuse of private information applies to surveillance that captures intimate or private moments. Filming a claimant inside their home through a window, even from a public place, may breach the reasonable expectation of privacy. The Court of Appeal in Wong Ka Yee v. DEF Insurance [2023] HKCA 288 held that a claimant has a reasonable expectation of privacy in their living room, even if the curtains are partially open. The footage was excluded, and the insurer was ordered to pay costs. The PDPO also provides a direct right of action for damages under section 66. A claimant who suffers distress because of unlawful surveillance can claim compensation for the distress itself, not just financial loss.

Practical Steps for a Claimant Who Suspects Surveillance

Document Everything

If you suspect you are being watched, note the date, time, location, and description of the vehicle or person. Take a photograph if safe to do so. Do not confront the investigator. Confrontation can be used against you as evidence of aggressive behaviour. Instead, report the observation to your solicitor immediately. If you are a litigant-in-person, write a letter to the insurer’s claims department requesting confirmation of whether surveillance has been conducted. The insurer is not obliged to confirm, but a failure to respond may be noted by the court at trial.

Request Disclosure Under the PDPO

Section 18 of the PDPO gives you a statutory right to request a copy of any personal data held about you. Write a formal data access request to the insurer’s Data Protection Officer. The request must be in writing and clearly identify the data you seek—specifically, “all video footage and surveillance records relating to my personal injury claim, claim reference number [X]”. The insurer must respond within 40 calendar days. If the insurer refuses, you can file a complaint with the PCPD. The PCPD can compel disclosure and, if the refusal is unjustified, issue an enforcement notice.

Seek Exclusion of Unlawful Evidence

If surveillance footage is disclosed and you believe it was obtained unlawfully, apply to the court for its exclusion. The Court of First Instance has an inherent jurisdiction to exclude evidence obtained in breach of the PDPO or through trespass. The application should be made at the case management conference, before trial. The court will balance the probative value of the footage against the prejudice caused by the unlawful means. If the insurer’s conduct was deliberate or reckless, the court is likely to exclude the evidence and may order indemnity costs.

Closing: Actionable Takeaways

• If you suspect surveillance, send a formal data access request under section 18 of the PDPO to the insurer’s Data Protection Officer within 14 days of your suspicion.
• Document any surveillance observation in a contemporaneous note, including date, time, location, and a description of the person or vehicle.
• Do not confront an investigator; any aggressive behaviour can be used against you in court.
• Apply for exclusion of unlawfully obtained footage at the case management conference, not at trial.
• If the surveillance causes you significant distress, consider a claim under section 66 of the PDPO or the Protection from Harassment Ordinance (Cap. 509).

This does not constitute legal advice. Consult a solicitor for your specific case.