The Code of Practice on the Identity Card Number and other Personal Identifiers and its compliance guide for data users (issued by the Privacy Commissioner’s Office) came into force on 19 December 1998 . Any breach of the Code may be used as evidence in any legal proceedings relating to the Ordinance against the relevant data user.

The Code gives practical guidance to data users on the application of the Ordinance in relation to the collection, accuracy, retention, use and security of: (a) identity card (“ID card”) numbers and copies of ID cards; and (b) other personal identifiers that uniquely identify individuals, e.g. passport numbers, employee/staff numbers, examination candidate numbers and patient numbers.

Where a data user has collected an ID card number or copy of an ID card for a purpose allowed under the Code, the data should generally be used ONLY for that purpose. The records of ID card numbers or ID card copies should not be kept for longer than is necessary to fulfill the purpose for which they were collected.

Data users should also implement adequate security safeguards for data that they hold or transmit. Specifically, the Code requires that a copy of an ID card in paper form should be marked “copy” across the image of the ID card. Records of ID card numbers and ID card copies should also be treated as confidential documents which should be kept in locked cabinets or secure areas when they are not in use.

Due to advances in easy-to-use technology and lower costs, fingerprint data for personal identification has been put to use for purposes other than the investigation of crime. To regulate the use of this sensitive personal data, the Commissioner revised the note entitled Guidance on Collection of Fingerprint Data in May 2012.

NOTE:

The above questions and answers only highlight the general points of the Code. For further information, please refer to the whole content of the Code on the PCPD webpage . It is recommended that you contact the PCPD or consult a lawyer if you have any queries about the Code.

1. Generally speaking, under what circumstances can a person ask me to provide my ID card number or ID card copy?

ID card number

Unless authorized by law, no data user may compel an individual to provide his or her ID card number. A data user may request an individual to provide his or her ID card number under the circumstances where the collection of the ID card number is permitted by the Code. The following list contains some daily examples (this is not an exhaustive list):

• Where there is an Ordinance which requires data users to collect ID card numbers, e.g. section 17K of the Immigration Ordinance ( Cap. 115 ) requires employers to keep a record of the number of the document, which is usually an ID card, by virtue of which each employee is lawfully employable.
• Where the use of the ID card number is necessary for any of the purposes mentioned in section 58(1) of the Ordinance, which includes the prevention or detection of crime, and the assessment or collection of any tax or duty.
• To enable the data user to identify the individual concerned or to attribute data to him or her where any of the following is necessary:
  • to advance the interests of the individual, e.g. to ensure that the correct medical record is referred to when treating a patient;
  • to prevent any third party other than the data user from suffering a detriment, e.g. to ensure that someone else is not given the wrong medication because the wrong medical record is referred to;
  • to enable the data user to safeguard against damage or loss that is more than trivial, e.g. drivers involved in a traffic accident may exchange ID card number in order to identify each other when pursuing a claim arising from the accident.
• For inclusion in a document that establishes or is evidence of any legal or equitable right or interest or legal liability that is not trivial, e.g. in documents that establish an individual’s right of ownership of a flat.
• As the means of future identification of an individual who is permitted to enter premises where monitoring of the activities of the individual inside the premises is not reasonably practicable, e.g. entry to a commercial building outside office hours.
• As a condition for allowing an individual to have custody or control of property which is of a value that is more than trivial, e.g. rent a flat or car.

ID card copy

Again, no data user may compel an individual to provide a copy of his or her ID card unless authorized by law. A data user may request an individual to provide a copy of his or her ID card under the circumstances where the collection of the copy is permitted by the Code. The following list contains some daily examples (this is not an exhaustive list):

• To carry out any of the purposes mentioned in section 58(1) of the Ordinance, which includes the prevention or detection of crime, and the assessment or collection of any tax or duty.
• To provide proof of compliance with any statutory requirement, e.g. an employer may collect a copy of an ID card to prove compliance with the requirement of section 17J of the Immigration Ordinance ( Cap.115 ) to inspect the ID card of an individual when the employer intends to confirm the employment of that person.
• To comply with a requirement to collect an ID card copy which is included in any code, rules, regulations or guidelines applicable to the data user and which requirement has been endorsed in writing by the Privacy Commissioner, e.g. banks may collect copies of the ID cards of their customers according to the Money Laundering Guidelines issued by the Hong Kong Monetary Authority.
• To collect or check the ID card number of the individual, but only if the individual has been given the choice of presenting his or her ID card in person instead (e.g. Transport Department is permitted to collect copies of ID cards for this purpose in relation to applications for driving licences made by post, as individuals are given the choice of presenting their ID cards in person).
• For the issuing of an officially recognised travel document, e.g. the BN(O) passport.

Collection of copies of ID cards is specifically NOT permitted in the Code under the following circumstances:

1. merely to safeguard against a clerical error in recording the name or ID card number of the individual (i.e. the copy should not be collected in order only to enable the person to check the accuracy of the record that has been made of the individuals name or ID card number); or
2. merely in anticipation of a prospective relationship with the individual (e.g. it would not be permissible for an employer to collect a copy of the ID card of an individual only because the employer may wish to offer him or her employment at a later stage).

2. Can the security staff of a building ask me to enter my ID card number in a visitors’ log book at the entrance of a building?

This depends on whether the monitoring of your activities inside the building is feasible or not (e.g. is it feasible to arrange a security guard to accompany you inside the building). If this is feasible, the security staff should not collect your ID card number. If such monitoring is not feasible, they are allowed to collect your ID card number.

However, the security staff should take appropriate security measures to ensure that such entries in a visitors’ log book are concealed from subsequent visitors who enter their details. If you are unwilling to provide your ID card number, you can suggest other alternatives. Examples of such alternatives include identification by another identification document (e.g. a staff card), or identification by someone known to the security staff (e.g. by a resident in the case of a residential building).

It is recommended by the Privacy Commissioner’s Office that in normal circumstances, entries in the visitor log book can be retained for a period of not more than one month. If there are any valid grounds justifying a longer retention period (e.g. where the records are required for evidentiary purposes or to assist a police investigation of detected or reported unlawful activities), the security staff can retain the data for more than one month. For more guidelines on this matter, please refer to the PCO’s publication ” Personal Data Privacy: Guidance on Property Management Practices “.

3. Can a police officer ask me to show him/her my ID card?

A request to show your ID card, without the requester making a record of any information on the card, is not covered by the Code. Generally, however, if police officers or other public officers (e.g. an immigration officer) ask to record your ID card number in your dealings with them, you should let them do so, as these officers have statutory powers to require individuals to furnish their ID card numbers in dealings with the Government.

For further information about the power the police have to check ID cards, please go to another topic Police and Crime under the CLIC website.

4. Can a prospective employer record my ID card number or collect a copy of my ID card when I attend a job interview?

In order to check whether you have applied for or held a position in the company before, the prospective employer can collect your ID card number. However, a copy of your ID card should not be collected unless and until you become an employee of that company.

5. If I have accepted an employment offer, can my employer collect a copy of my ID card?

Yes, as a copy of your ID card is evidence of your employer’s compliance with the requirements of the Immigration Ordinance to inspect your ID card before employing you. However, companies are required by the Code to mark the word “copy” across the image of copies of ID cards to reduce the chance for misuse and abuse.

6. Can a club ask me to provide my ID card number and a copy of my ID card if I apply to be a member?

Generally speaking, collection of ID card numbers of its members by a membership club may be permitted under the Code to enable the club management to check membership. However, there appears to be no justification to collect copies of members’ ID cards.

7. Can companies providing mobile phone services record my ID card number or collect a copy of my ID card if I apply for their services?

These companies operate on the basis of deferred payment (i.e. customers are usually required to make monthly payment after using their services). Hence, they require a means of proving the identity of their customers in order to obtain payment. Moreover, they face the problem that the services concerned are not provided to a fixed location. On the other hand, there have been a number of reported cases of individuals fraudulently obtaining such services using another person’s name and address, and of the salespersons opening accounts for fictitious persons to defraud their company. For these reasons, the collection of the ID card numbers and copies of the ID cards is generally justified under the Code. However, these companies should mark the word “copy” across the image of the copies.

8. Can banks/insurance companies collect a copy of my ID card when I apply to be their customer?

Yes, because they are required to do this under the guidelines issued by the relevant regulatory bodies. These requirements have been endorsed by the Privacy Commissioner. However, the word “copy” should be marked across the image of the copies of their customers’ ID cards.

9. What should I be aware of before I provide my ID card number or ID card copy to other persons?

The Code requires organizations or persons (the data users), before recording an ID card number, to consider alternatives that are less privacy intrusive. If you are not happy about a request to provide your ID card number, suggest to the requestor/data user alternatives that are reasonable and acceptable to you. For example, try to arrange for identification of yourself by someone else who is already known to the organization. An organization may be contravening the Code if it refuses to accept an alternative without a good explanation.

Compared to ID card numbers, stricter limits are imposed on the collection of ID card copies because of the greater dangers they carry in relation to possible fraud or other misuse. Generally speaking, this gives you greater justification in querying a request to provide a copy of your ID card.

The Code generally requires the data users to mark photocopies of ID cards they keep with the word “copy”. This marking should be made across the entire image of the ID card. The only exception to this marking requirement you are likely to encounter is where the photocopy is going to be converted into some other form, e.g. microfilm.

If you provide a photocopy of your ID card in person to a data user, you can insist that it must be marked “copy” in your presence.

Unless otherwise required or permitted by law, data users should ensure that an ID card number and the name of the holder are not displayed together publicly.

One common situation in which a breach of the above requirement may occur is the publication of notices including individuals’ names and ID card numbers in a newspaper (e.g. notices carrying the result of a lucky draw or a competition). Another is the display of notices containing individuals’ names and ID card numbers on a notice board in places such as a school, an office, or the lobby of a residential building. A further one is the inadvertent disclosure of the names and ID card numbers of visitors to subsequent visitors to a building in a visitors’ log-book.

Where you encounter a situation such as those described above, ask the organization/data user to stop displaying or disclosing those data (or else to justify the display/disclosure). An organization is likely to have contravened the Code if it cannot provide good justification.

10. Under what circumstances can a person ask me to provide other personal identifiers (e.g. staff number, passport number or patient number)?

In general, the requirements of the Code in relation to ID card numbers also apply to other personal identifiers. In other words, other personal identifiers may be collected only under the circumstances and by the means permitted for ID card numbers and are subject to similar requirements as regards retention and use.

However, the above does not apply to the collection or use of such other personal identifiers for a purpose that is directly related to the functions and activities of the person that assigned the identifier to the individuals concerned. For example, a staff number may be collected and used for purposes directly related to the functions or activities of the employer that assigned the number, such as managing employee records and the payment of employee salaries.

Data users that assign personal identifiers to individuals should take all reasonably practicable steps to ensure the security of the system under which this is done. Such steps should include security measures to safeguard against the unauthorized assignment of the identifier or production of any document (e.g. the unauthorized production of a staff card with a false staff number printed on it).

11. Complaint Case Notes from the PCPD – A property management company collected identity card numbers of residents who were applying for electronic entrance cards gaining access to the building. Is this viewed as an excessive collection of personal data?

Please read the answer provided by the PCPD website .