Codes of Practice/ Guidelines

Step 4 : Check that you use ID card numbers only for one or other of the purposes permitted by the code

Where a data user has collected an ID card number for a purpose allowed under the code, the ID card number should generally be used only for that purpose. In addition, the code allows ID card number to be used for the following further purposes.

1. Where a data user has collected an ID card number for a purpose allowed under the code, the ID card number should generally be used only for that purpose. In addition, the code allows ID card number to be used for the following further purposes.
2. To manage records relating to the individual that were collected for the same particular purpose but which are held by more than one data user e.g. the ID card number could be used to manage an individual's records under the proposed mandatory provident fund scheme, which will be held by more than one data user.
3. To carry out a "matching procedure" that is permitted under the Ordinance. Note: For guidance on what constitutes a "matching procedure" under the Ordinance and the circumstances under which such procedures are permitted, see the PCPD's leaflet "Matching Procedure: Some Common Questions".
4. For a purpose that is required or permitted under any other code of practice that has been approved and is in force under the Ordinance.
5. For a purpose to which the individual has voluntarily given his or her express consent.
6. For a purpose permitted by an applicable exemption in the Ordinance.

Step 5 : Check that you are NOT publicly displaying or disclosing ID card numbers with the names of the ID card holders and that you are NOT issuing cards such as staff cards with ID card numbers printed on them

Unless required or permitted by law, a data user should not:

1. 
   Where an Ordinance gives the data user a power to require individuals to provide ID card numbers, e.g. section 5 of the Registration of Persons Ordinance (Cap. 177) gives public officers such a power.
2. Where an Ordinance requires the data user to collect the ID card number, e.g. section 17K of the Immigration Ordinance (Cap. 115) requires employers to keep a record of the number of the document, which is usually an ID card, by virtue of which each employee is lawfully employable.
   
   Furthermore with effect from 19 December 1998, a data user should not issue a card to an individual that has the individual's ID card number printed on it in a legible form, e.g. a staff card with the holder's ID card number printed on it in a form that is capable of being read directly by other individuals.
   
   Note: This prohibition applies whether or not the card is worn as a badge or is only used while the individual is in particular premises, e.g. the offices of the issuing party. The ID card itself and the driving licence are excluded from this prohibition.

Step 6 : Check that you do not keep records of ID card numbers for longer than is necessary to fulfill the purpose for which they were collected

1. Where an ID card number is collected for future identification of an individual who has been permitted to enter premises or use equipment, the record should be erased within a reasonable period after the individual has left the premises or ceased to use the equipment.
2. Where an ID card number is collected as a condition for giving the individual custody or control of property, the record should be erased within a reasonable period after that custody or control has ceased.
   
   Note: A reasonable period in the above contexts would be days rather than weeks

Previous Page | Next Page