A data user should not issue to any individual any card bearing the ID card number of that individual.
Q: In our office, we have issued a large quantity
of staff cards, which bears on it the staff's ID card numbers.
(a) Is it in order for us to retain the old
staff cards if the staff give his/her written consent to display
his/her ID card number on the card?
(b) Can we take an administrative step to
ask the staff to conceal their ID card number printed on the staff
card, say, by covering it with a sticker?
(c) If (b) is positive, what is the responsibility
of the department and our staff member under the Code? If the
staff do not follow the advice to conceal his/her ID card number
or do not maintain good condition of the sticker thereby leaving
the ID card number exposed, who is accountable for the non-compliance
with the Code?
A: (a) There is no provision
for the requirements of paragraph 2.8 of the Code to be overridden
with the consent of the staff members concerned. This is because
the said paragraph is intended to give practical effect to data
protection principle 4 ("DPP4") in Schedule 1 to the Ordinance
the requirements of which may not themselves be so overridden.
(b) You ask whether you may request staff
to cover the ID card numbers on existing staff cards with stickers.
Paragraph 2.8 of the Code does not make specific provision with
respect to measures to be taken in relation to existing cards
bearing ID card numbers. However, DPP4 requires, in essence, that
all reasonably practicable steps are to be taken to ensure security
with respect to personal data. It seems to us that the use of
stickers that are reasonably adhesive and render the ID card numbers
illegible even with close examination should meet this requirement.
However, as a matter of good practice you may nevertheless consider
instituting a programme of replacing existing cards with the new
ones not bearing the ID card numbers. The use of stickers could
then be an interim measure pending completion of that replacement
programme.
(c) So long as all reasonably practicable
steps are taken to ensure the stickers are properly affixed to
the cards, you would not be liable for the omissions or acts of
individual staff members in relation to this matter. In order
to meet this test you may consider assigning to certain staff
members the duty of fixing the stickers on the cards. Card holders
could be asked to hand their cards to the designated staff members
according to a timetable for the fixing of the stickers. This
should ensure that all existing cards have the stickers by 19
December 1998.
