COPIES OF ID CARDS
BASIC POSITION:
No right to compel
an individual to provide a copy of an ID card unless authorised
by law
Unless authorized by law, no data user may compel an
individual to provide a copy of his or her ID card. A data
user may request an individual to provide a
copy of his or her ID card under the circumstances where the
collection of the copy is permitted by this code. In such
a case. the code does not, and in law could not, prohibit
a data user from refusing to deal with an individual who declines
to provide a copy of his or her ID card. However, before doing
so, we advise that the data user should consider whether the
purpose of collecting the copy of the identity card can be
achieved through some other means that may be more acceptable
to the individual, e.g. by collecting a copy of some other
identification documents such as the relevant pages of a passport.
Step 1 : Check whether your
collection of copies of ID cards comes under one or other
of the circumstances where this is permitted in the code
A data user is permitted to collect
a copy of an ID card only under one or other of the following
circumstances:
- To carry out any of the purposes mentioned in section
57(1) of the Ordinance, which are the safeguarding of security,
defence or international relations in respect of Hong Kong.
- To carry out any of the purposes mentioned in section
58(1) of the Ordinance, which include the prevention or
detection of crime, and the assessment or collection of
any tax or duty.
- Where the collection of the ID card number of the individual
is permitted under the code (see Step 2 in the ID card number
section above) and the copy of the ID card is further collected
for any of the following purposes:
| |
- to provide proof of compliance with any statutory
requirement, e.g. an employer may collect a copy of
an ID card to prove compliance with the requirement
of section 17J of the Immigration Ordinance (Cap.115)
to inspect the ID card of an individual before employing
him or her;
- to comply with a requirement to collect the copy
which is included in any code, rules, regulations
or guidelines applicable to the data user and which
requirement has been endorsed in writing by the Privacy
Commissioner, e.g. the requirement, which the Privacy
Commissioner has endorsed, on banks to collect copies
of the ID cards of their customers in the Money Laundering
Guidelines issued by the Hong Kong Monetary Authority;
- to collect or check the ID card number of the individual,
but only if the individual has been given the choice
of presenting his or her ID card in person instead,
e.g. Transport Department is permitted to collect
copies of ID cards for this purpose in relation to
applications for driving licences made by post, as
individuals are given the choice of presenting their
ID cards in person;
- for the issuing of an officially recognised travel
document, e.g. the BN(O) passport; or
- to enable the data user to carry out functions related
to the operation of a tribunal or a court.
|
In addition, the Immigration Department is permitted to collect
copies of ID cards in carrying out its functions and activities.
Step 2 : Make sure that your
collection of copies of ID cards does NOT come under one or
other of the circumstances where this is specifically NOT
permitted in the code
A data user is not permitted to
collect a copy of an ID card under the following circumstances
- merely to safeguard against a clerical error in recording
the name or ID card number of the individual, i.e. the copy
should not be collected in order only to enable the person
to check the accuracy of the record that has been made of
the individual's name or ID number.
- merely in anticipation of a prospective relationship with
the individual, e.g. it would not be permissible for an
employer to collect a copy of the ID card of an individual
only because the employer may wish to offer him or her employment
at some stage
Step 3 : Check whether the way
you collect copies of ID cards ensures that they are truly
copies of the ID cards that are held by the individuals concerned
- When a data user collects a copy of an ID card from the
holder in person, the copy should always be checked against
the ID card concerned, e.g. where an individual opens a
bank account in person and provides a copy of his or her
ID card, the bank should check the copy against the individual's
ID card.
- When a data user collects a copy of an ID card from a
third party, the data user should take all reasonably practicable
steps to ensure that the third party has checked the copy
against the ID card concerned, e.g. a car hire-purchase
finance company that receives copies of ID cards of applicants
for hire-purchase finance from car vendors dealing directly
with the applicants should require the vendors to check
such copies against the individuals' ID cards.
- A data user who obtains from individuals copies of their
ID cards other than directly from the individual in person
e.g. the copies are sent to the data user by post, should
also undertake the following actions.
| |
- The relevant staff should be given training to enable
them to detect irregularities on the face of ID card
copies, e.g. the staff should be instructed on
the usual content of ID cards so that any omission
in a copy would be detected.
- A system should be instituted for ensuring that
ID card copies are not accepted unless they have been
checked and no irregularity has been found. Note:
The system should be included in any relevant manual
of office procedure and practice.
- A record should be retained in relation to such
copies indicating that they have been collected without
being checked against the ID cards concerned, e.g.
a note to this effect could be made on the copy itself.
|
Step 4 : Check that you use
copies of ID cards only for one or other of the purposes permitted
by the code
A data user should use copies of
ID cards only for:
- the purposes for which they were collected,
- a purpose for which the individual concerned has voluntarily
given express consent, or
- a purpose for which there is an applicable exemption under
the Ordinance.
Step 5 : Check that you are
implementing adequate security safeguards for copies of ID
cards that you hold or transmit
Specifically, the code requires
the following.
A
copy of an ID card in paper form should be marked "copy" across the image
of the ID card. This requirement does not apply to a copy that is awaiting
conversion into some other form, e.g. microfilm or image form, within a reasonable
time. Mark copies of ID cards with the word "COPY" across the images of the
cards.
- Where a copy of an ID card is subject to the above requirement
and is obtained in the presence of the holder it should
be marked "copy" in his or her presence, e.g. where an individual
opens a bank account in person and either provides a copy
of his or her ID card or the bank makes such a copy, the
bank should mark it "copy" in the presence of the individual.
- A data user that collects copies of ID cards should ensure that such copies
are treated as confidential documents, e.g. as with other confidenti
al
documents they should be kept in locked cabinets or secure areas when not
in use. The copies should be kept under secure conditions with access restricted
to individuals who need to carry out permitted uses of the copies. Treat copies
of ID cards as confidential documents.
A data user should not transmit a copy or image of an ID
card unless it has taken all reasonably practicable steps
to ensure that it is received only by the intended recipient.
Such steps could include safeguards such as encryption,
confidential mail boxes, access passwords and dedicated
fax machines for receiving confidential material. In case
of dispatch by mail, a sealed envelope should be used and
the image of the ID card should not be visible through
any window in the envelope.
Back to top
