Table of Contents Table of Contents
Previous Page  40 / 192 Next Page
Show Menu
Previous Page 40 / 192 Next Page
Page Background

Such collection would avoid damage or loss which was more than trivial in the

circumstances as permitted under clause of the Code of Practice on the Identity

Card Number and other Personal Identifiers. The Commissioner also considered that it

was unnecessary for the company to collect the participants’ dates of birth for the

purpose of contacting them and verifying their identities as argued.



In relation to the collection of a copy of an individual’s HKID, clause 3.2 of the Code of

Practice on the Identity Card Number and other Personal Identifiers has prescribed

circumstances under which such collection is allowed, some of which are similar to those

specified in paragraph 5.10 above. However, clause 3.3.1 of the Code makes it clear

that the collection of a copy of a HKID will not be allowed merely to safeguard against

clerical error in recording the name or HKID number of the individual. There was a

complaint against a government department for taking a photograph of the

complainant’s HKID for the purpose of verifying the complainant’s identity as a witness.

The Commissioner took the view that such an act was contrary to DPP1(1) and clause

3.3.1 of the Code.

The government department eventually agreed that the collection of

the copy of the complainant’s HKID was unnecessary and deleted the image stored in

the digital camera.


In another investigation,


the Commissioner found that the collection by a fitness centre

of copies of HKIDs or Home Visit Permits from applicants/members during the handling

of membership applications/renewals, breached DPP1(1), as such collection was

unnecessary and excessive for the purposes put forward by the fitness centre. The fitness

centre claimed that the collection was necessary in order to verify the identity of each

member for establishing a legal relationship; enabling the fitness centre to take legal

action where necessary; facilitating internal administration and external audits; and

discouraging its staff (who earn extra commission based on the number of memberships

sold) from fraudulently creating membership accounts. The Commissioner found that

such reasons for collection were not justified as there were less privacy intrusive

alternatives available, e.g. the fitness centre could have required members to enter into

the membership agreement under their legal names instead of pseudonyms, and

auditors could verify the fitness centre’s income based on bank statements, etc. In

particular, the Commissioner found that the fitness centre’s collection of copies of HKIDs

or Home Visit Permits for the claimed prevention of fraud by its staff was not justified

under paragraph


of the Code of Practice on the Identity Card Number and

other Personal Identifiers in the absence of any supporting statistics or cogent evidence.

He was of the view that the fitness centre could have considered implementing other


See Investigation Report Number R09-3658, available on the Website: ort_e.pdf


See Investigation Report Number R13-12828, available on the Website:


Under paragraph, a data user may collect the copy of an identity card for any of the purposes mentioned in

section 58(1) of the Ordinance (the prevention or detection of crime, the apprehension, prosecution or detention of

offenders, the assessment or collection of any tax or duty, etc.).