COPIES OF ID CARDS BASIC
POSITION:
No right to compel an
individual to provide a copy of an ID card unless authorised by law
Unless authorized by law, no data user may compel an
individual to provide a copy of his or her ID card. A data user may
request an individual to provide a copy of his or her ID card
under the circumstances where the collection of the copy is permitted
by this code. In such a case. the code does not, and in law could not,
prohibit a data user from refusing to deal with an individual who
declines to provide a copy of his or her ID card. However, before doing
so, we advise that the data user should consider whether the purpose of
collecting the copy of the identity card can be achieved through some
other means that may be more acceptable to the individual, e.g. by
collecting a copy of some other identification documents such as the
relevant pages of a passport.
Step
1 : Check whether your collection of copies of ID cards comes under one
or other of the circumstances where this is permitted in the code
A
data user is permitted to collect a copy of an ID card only under one
or other of the following circumstances:
- To carry out any of the purposes mentioned in section 57(1) of
the Ordinance, which are the safeguarding of security, defence or
international relations in respect of Hong Kong.
- To carry out any of the purposes mentioned in section 58(1) of
the Ordinance, which include the prevention or detection of crime, and
the assessment or collection of any tax or duty.
- Where the collection of the ID card number of the individual is
permitted under the code (see Step 2 in the ID card number section
above) and the copy of the ID card is further collected for any of the
following purposes:
| |
i. to provide
proof of compliance with any statutory requirement, e.g. an employer
may collect a copy of an ID card to prove compliance with the
requirement of section 17J of the Immigration Ordinance (Cap.115) to
inspect the ID card of an individual before employing him or her;
ii. to comply with a
requirement to collect the copy which is included in any code, rules,
regulations or guidelines applicable to the data user and which
requirement has been endorsed in writing by the Privacy Commissioner,
e.g. the requirement, which the Privacy Commissioner has endorsed, on
banks to collect copies of the ID cards of their customers in the Money
Laundering Guidelines issued by the Hong Kong Monetary Authority;
iii. to collect or check
the ID card number of the individual, but only if the individual has
been given the choice of presenting his or her ID card in person
instead, e.g. Transport Department is permitted to collect copies of ID
cards for this purpose in relation to applications for driving licences
made by post, as individuals are given the choice of presenting their
ID cards in person;
iv. for the issuing of an officially recognised travel document, e.g.
the BN(O) passport; or
v. to enable the data user to carry out functions related to the
operation of a tribunal or a court.
|
In addition, the Immigration Department is permitted to collect
copies of ID cards in carrying out its functions and activities.
Step
2 : Make sure that your collection of copies of ID cards does NOT come
under one or other of the circumstances where this is specifically NOT
permitted in the code
A
data user is not permitted to collect a copy of an ID card under the
following circumstances
- merely to safeguard against a clerical error in recording the
name or ID card number of the individual, i.e. the copy should not be
collected in order only to enable the person to check the accuracy of
the record that has been made of the individual's name or ID number.
- merely in anticipation of a prospective relationship with the
individual, e.g. it would not be permissible for an employer to collect
a copy of the ID card of an individual only because the employer may
wish to offer him or her employment at some stage
Step
3 : Check whether the way you collect copies of ID cards ensures that
they are truly copies of the ID cards that are held by the individuals
concerned
- When a data user collects a copy of an ID card from the holder in
person, the copy should always be checked against the ID card
concerned, e.g. where an individual opens a bank account in person and
provides a copy of his or her ID card, the bank should check the copy
against the individual's ID card.
- When a data user collects a copy of an ID card from a third
party, the data user should take all reasonably practicable steps to
ensure that the third party has checked the copy against the ID card
concerned, e.g. a car hire-purchase finance company that receives
copies of ID cards of applicants for hire-purchase finance from car
vendors dealing directly with the applicants should require the vendors
to check such copies against the individuals' ID cards.
- A data user who obtains from individuals copies of their ID cards
other than directly from the individual in person e.g. the copies are
sent to the data user by post, should also undertake the following
actions.
|
- The relevant staff should be given training to enable them
to detect irregularities on the face of ID card copies, e.g. the
staff should be instructed on the usual content of ID cards so that any
omission in a copy would be detected.
- A system should be instituted for ensuring that ID card
copies are not accepted unless they have been checked and no
irregularity has been found. Note: The system should be included in
any relevant manual of office procedure and practice.
- A record should be retained in relation to such copies
indicating that they have been collected without being checked against
the ID cards concerned, e.g. a note to this effect could be made on
the copy itself.
|
Step
4 : Check that you use copies of ID cards only for one or other of the
purposes permitted by the code
A
data user should use copies of ID cards only for:
- the purposes for which they were collected,
- a purpose for which the individual concerned has voluntarily
given express consent, or
- a purpose for which there is an applicable exemption under the
Ordinance.
Step
5 : Check that you are implementing adequate security safeguards for
copies of ID cards that you hold or transmit
Specifically,
the code requires the following.
A copy of an ID card in paper
form should be marked "copy" across the image of the ID card. This
requirement does not apply to a copy that is awaiting conversion into
some other form, e.g. microfilm or image form, within a reasonable
time. Mark copies of ID cards with the word "COPY" across the images of
the cards.
- Where a copy of an ID card is subject to the above requirement
and is obtained in the presence of the holder it should be marked
"copy" in his or her presence, e.g. where an individual opens a bank
account in person and either provides a copy of his or her ID card or
the bank makes such a copy, the bank should mark it "copy" in the
presence of the individual.
- A data user that collects copies of ID cards should ensure that
such copies are treated as confidential documents, e.g. as with other
confidenti
al documents they should be
kept in locked cabinets or secure areas when not in use. The copies
should be kept under secure conditions with access restricted to
individuals who need to carry out permitted uses of the copies. Treat
copies of ID cards as confidential documents.
A data user should not transmit a copy or image of an ID card unless it
has taken all reasonably practicable steps to ensure that it is
received only by the intended recipient. Such steps could include
safeguards such as encryption, confidential mail boxes, access
passwords and dedicated fax machines for receiving confidential
material. In case of dispatch by mail, a sealed envelope should be used
and the image of the ID card should not be visible through any
window in the envelope.
Back to top
