A data user may collect the ID card number of an individual if it is for correct identification which is necessary for the advancement of the interest of the holder (2.3.3.1 of the Code ) or for the prevention of detriment to any person other than the data user (2.3.3.2 of the Code).
Q: I am an administrator of a hospital.
Sometimes patients refuse to show their ID cards by saying the
Ordinance provides such right. Under the Dangerous Drugs Regulations,
we have to register the patients¡¦ identification when dispensing
dangerous drugs. Also according to the direction given by the
Hospital Authority and the Department of Health, we cannot treat
illegal immigrants unless it is an emergency case. If patients
refuse to show their identification, does the hospital has the
right to ask patients to show their valid identification before
providing treatment. What should we do?
A: Generally speaking, the Ordinance is
concerned with recorded information about identifiable living
information. Accordingly, asking someone to show an identification
document without recording any of the information on that document
relating to the individual is not a matter that is subject to
the requirements of the Ordinance. Hence, the requirements of
the Ordinance cannot form a valid basis for a refusal to comply
with such a request. On the other hand, as a matter of general
law, no individual can be compelled to produce an identification
document unless obliged in law to do so. In the absence such
a lawful obligation, an individual is entitled to refuse to
comply with a request to produce an identification document.
You also refer specifically to the requirement placed on you
by the Department of Health to check the identification documents
of individuals to ascertain whether they are illegal immigrants.
I suggest you ask the Department of Health, or your legal advisers,
whether you have any lawful authority to require individuals
to show their identification documents for this purpose and
what you should do if you do not and they refuse.
Where your intention is to record the number
of the identity document shown you are obliged to comply with
the requirements of the Ordinance and the "Code".
The provisions of the Code of most relevant
to your question are those of paragraph 2.1 in of the Code.
This provides:
"Unless authorized by law, no
data user may compulsorily require an individual to furnish
his ID card number."
This is in fact a mere re-statement of the
general legal position. Hence, a party may compel an individual
to furnish his or her ID card number if and only if such party
is authorized by law to do so. (An example of such authorization
is to be found in Note 1 to paragraph 2.3.1 of the Code in relation
to a statutory power conferred on public officers.) In your
case, it may be that in order to comply with the Dangerous Drugs
Regulations in prescribing or dispensing dangerous drugs, you
must make a record of the ID card number of the patient concerned.
However, it appears to us that there is nothing in the law which
authorizes you to compel the furnishing of ID card numbers by
individuals. Hence, if an individual refuses for whatever reason
to furnish his or her ID card number, all you may consider doing
is to refuse to provide service, e.g. refuse to prescribe or
dispense the dangerous drugs. If you make the furnishing of
identification a pre-requisite for providing service, you are
not compulsorily requiring the furnishing of the ID card number
as the individual has the choice not to provide the number by
not taking the service. Hence, this is not a breach of paragraph
2.1. Whether it is permissible or desirable from a professional
or policy point of view for you to refuse medical treatment
in such circumstances is, however, a matter for you to decide.
Under paragraph 2.3 of the Code, you should
in any event not collect any ID card number unless the collection
falls into one of the situations mentioned therein. You also
have mentioned several reasons why it is considered necessary
for you to collect the ID card numbers of patients. From this,
it appears that such collection by you falls within the prescribed
situation. In particular, paragraph 2.3.1 in relation to your
obligation to collect ID card numbers in prescribing or dispensing
dangerous drugs and paragraph 2.3.3.1 and 2.3.3.1 of the Code
in relation to the treatment of patients in general as explained
in the Notes to those paragraphs. The fact that your practice
of collecting ID card numbers is consistent with the requirements
of the Code may be used by you as an argument to persuade your
patients or their families to furnish the ID card numbers of
the patients should they be reluctant to do so. In any event,
the purpose of your collection of personal data ought to be
notified to the data subjects at the time of collection of personal
data as required by Data Protection Principle 1(3) in Schedule
1 to the Ordinance.
All of our above comments apply equally to
collection of personal identifiers other than the ID card number,
e.g. passport numbers. This is provided for in Part IV of the
Code.
