Privacy Commissioner for Personal Data expresses views on ID Card Scheme

The Privacy Commissioner for Personal Data understands, for the convenience of the public as well as to enhance efficiency of Government services, the Government's proposal to introduce a new Identity Card (ID card) in the form of a smart card with the capacity to support multiple applications.

"I fully appreciate the reasons and rationale for the Government to replace the existing ID card by a smart card. However, I have concerns with regard to the potential dangers of privacy invasion brought by the new technology and applications." The Privacy Commissioner for Personal Data, Mr Stephen Lau said.

Mr Lau expresses his concern of the danger of identity theft, with a card which has the capability to access different kinds of personal data. He is also concerned with the potential and significant amount of individual's sensitive personal data to be stored and concentrated in a single card. Richness in data tends to lead to 'function creep', where the personal data contained in the card may be used for purposes beyond those for which the data were originally collected.

"The card with its capabilities to support the various applications can be regarded as quite a comprehensive personal dossier. While portability of the card can be an advantage to the holder, it also can make the embedded personal data accessible to many, thus diminishing protection of the individuals' data privacy." Mr Lau said.

As privacy is a very personal matter, individuals should be given, where appropriate, the opportunity to a non-discriminatory and informed choice on the applications on offer.

In addition, there should be security and administrative safeguards to ensure that data in the card and the related databases would not be accessed or used for purposes beyond the originally intended purposes.

Mr Lau is pleased that through the on-going dialogue, the Government has responded positively to the issue of data privacy, and has engaged a consulting company to conduct a Privacy Impact Assessment study.

"I am obviously interested in the findings and recommendations of the consultant study and Government's views on such recommendations." said Mr Lau.

Mr Lau also notes the Government's intent to conduct feasibility studies on the planned applications, and that additional Privacy Impact Assessment studies will be conducted at relevant stages of the development of such projects.