Collection of personal data permitted for a lawful purpose directly related to a function or an activity of a data user.
Q: I am an administrator of a university. Our security guards on campus are required to record the personal data of private road users who violate the regulations relating to traffic and parking on the campus area. Under the current regulations, we have the right to impound/immobilise and tow away any vehicles for parking on the Main Estate without authorization or valid University parking label, etc. Recently, we have been challenged by those violators who claimed that we have no right to ask them to provide personal data. As a result, we encounter difficulties in enforcing the regulations. Do we have the right to ask those who claim to be the owners of the impounded vehicles to present their ID cards so that we can put it on record in our daily incidence reports and the receipts before releasing the vehicle? Do our security guards have the right to demand those suspicious law-breakers to present their personal data if such persons were found to commit potential crimes on campus?
A: Your question concerns the collection of personal data. As a general matter, such collection is subject to the requirements of data protection principle ("DPP")1 in Schedule 1 to the Ordinance. DPP1, inter alia, permits a data user to collect personal data for a lawful purpose directly related to a function or activity of the data user (DPP1(1)(a) refers). The data collected should be necessary, as well as adequate and not excessive, for that purpose (DPP(1)(b) and (c) refer). The specific issue of the collection of the ID card numbers of such individuals is a matter covered by the Code of Practice on the ID Card Number and other personal identifiers approved and issued on 19 December 1998 ("the Code"). In particular, paragraph 2.3 of the Code provides that an ID card number may not be collected except under the circumstances specified therein.
It appears to us that, generally speaking, your collection of the identifying particulars of individuals who collect impounded vehicles does not contravene the above-mentioned requirements of DPP1. The same applies to individuals suspected of having committed offences on University premises. With respect to your collection of the ID card numbers of individuals who collect impounded vehicles, you indicate that this is necessary to safeguard against damage or loss on the part of the University. So long as that damage or loss is more than trivial in the circumstances, which appears to be so in this case, such collection is permitted pursuant to paragraph 2.3.3.3 of the Code. In addition, where the collection of the ID card numbers is necessary to prevent or detect crime this is permitted under paragraph 2.3.2.2 of the Code. Accordingly, the collection of the ID card numbers of individuals suspected of committing offences on University premises is permitted if these requirements are fulfilled. Furthermore, if there is any statutory provision which empowers you to require the furnishing of the ID card number or obliges you to collect such number in the circumstances mentioned, such collection by you will also be permitted under paragraph 2.3.1 of the Code.
On the other hand, where you encounter an individual who refuses to furnish to you his or her ID card number, you should pay special attention to paragraph 2.1 of the Code. This provides that unless authorized by law, no data user, which in this case is the University, may compulsorily require an individual to furnish his or her ID card number. To ascertain whether you have any such right of compulsion in law in the circumstances referred to in your letter, you may wish to seek advice from your legal advisers. Even if you do not have such right, where a vehicle has been lawfully impounded by you, making the furnishing of ID card number a condition for the release of the vehicle does not in our view amount to compulsory requirement within the meaning of paragraph 2.1. Hence, the imposition of such a condition is not contrary to the said paragraph.
