III. Use of ID card numbers and ID card copies
The Code of Practice on the Identity Card Number and other Personal Identifiers and its compliance guide for data users (issued by the Privacy Commissioner's Office) came into force on 19 December 1998 . Any breach of the Code may be used as evidence in any legal proceedings relating to the Ordinance against the relevant data user.
The Code gives practical guidance to data users on the application of the Ordinance in relation to the collection, accuracy, retention, use and security of: (a) identity card ("ID card") numbers and copies of ID cards; and (b) other personal identifiers that uniquely identify individuals, e.g. passport numbers, employee/staff numbers, examination candidate numbers and patient numbers.
Where a data user has collected an ID card number or copy of an ID card for a purpose allowed under the Code, the data should generally be used ONLY for that purpose. The records of ID card numbers or ID card copies should not be kept for longer than is necessary to fulfill the purpose for which they were collected.
Data users should also implement adequate security safeguards for data that they hold or transmit. Specifically, the Code requires that a copy of an ID card in paper form should be marked "copy" across the image of the ID card. Records of ID card numbers and ID card copies should also be treated as confidential documents which should be kept in locked cabinets or secure areas when they are not in use.
Due to advances in easy-to-use technology and lower costs, fingerprint data for personal identification has been put to use for purposes other than the investigation of crime. To regulate the use of this sensitive personal data, the Commissioner revised the note entitled Guidance on Collection of Fingerprint Data in May 2012.
- Generally speaking, under what circumstances can a person ask me to provide my ID card number or ID card copy?
- Can the security staff of a building ask me to enter my ID card number in a visitors' log book at the entrance of a building?
- Can a police officer ask me to show him/her my ID card?
- Can a prospective employer record my ID card number or collect a copy of my ID card when I attend a job interview?
- If I have accepted an employment offer, can my employer collect a copy of my ID card?
- Can a club ask me to provide my ID card number and a copy of my ID card if I apply to be a member?
- Can companies providing mobile phone services record my ID card number or collect a copy of my ID card if I apply for their services?
- Can banks/insurance companies collect a copy of my ID card when I apply to be their customer?
- What should I be aware of before I provide my ID card number or ID card copy to other persons?
- Under what circumstances can a person ask me to provide other personal identifiers (e.g. staff number, passport number or patient number)?
- Complaint Case Notes from the PCPD – A property management company collected identity card numbers of residents who were applying for electronic entrance cards gaining access to the building. Is this viewed as an excessive collection of personal data?
- Complaint Case Notes from the PCPD – A person requested a refund of a tour fee and charges from a travel service agent. In processing the request, the travel agent required him to provide a photocopy of his Hong Kong identity card. Is this viewed as an excessive collection of personal data?
The above questions and answers only highlight the general points of the Code. For further information, please refer to the whole content of the Code on the PCPD webpage . It is recommended that you contact the PCPD or consult a lawyer if you have any queries about the Code.