Collection of customers' ID card number and ID card copy for in-house charge card.

Q: We are a department store issuing in-house charge card to our customers for shopping convenience. We collect ID card number and copy of ID Card to identify our customers to maintain day-to-day operation. Are we allowed to collect ID card number and ID card copy from our customers and retain such copies in our computers software? We also refer to paragraph 2.5.2 of the Code of Practice on the ID Card Number and other Personal Identifiers ("the Code"). Please also clarify whether we should erase personal data records of our delinquent accounts which are used to detect doubtful accounts in new account processing.

A: The justification for collection of ID number and copies of ID mentioned in your question is the prevention of fraud and the enforcing of bad debts. On this basis, paragraphs 2.3.2.2 and 2.3.3.3 of the Code may be applicable to your collection of ID card numbers, although you should have regard to paragraph 2.2. As to your collection of copies of ID cards, paragraph 3.2.1.2 of the Code may be applicable. If the relevant paragraphs of the Code are applicable, and that is a matter for you to decide with due reference to the specific circumstances of the case, such collection by you will not contravene the Code.

In your question you also raise an issue related to erasure of delinquent accounts and refer to paragraph 2.5.2 of the Code. The said paragraph, however, is concerned solely with the erasure of records of ID card numbers collected in relation to giving an individual custody or control of property. It is not applicable to records of delinquent charge card accounts with which your enquiry is concerned. The retention of such records is governed by the general provisions of data protection principle 2(2) and section 26 of the Ordinance. In summary, these require that personal data should be erased when the data are no longer required for the purposes for which they were used, or directly related purposes.