Codes of Practice/ Guidelines

Unless authorized by law, no data user may compel an individual to provide a copy of his or her ID card. A data user may request an individual to provide a copy of his or her ID card under the circumstances where the collection of the copy is permitted by this code. In such a case. the code does not, and in law could not, prohibit a data user from refusing to deal with an individual who declines to provide a copy of his or her ID card. However, before doing so, we advise that the data user should consider whether the purpose of collecting the copy of the identity card can be achieved through some other means that may be more acceptable to the individual, e.g. by collecting a copy of some other identification documents such as the relevant pages of a passport.

Step 1 : Check whether your collection of copies of ID cards comes under one or other of the circumstances where this is permitted in the code

A data user is permitted to collect a copy of an ID card only under one or other of the following circumstances:

1. To carry out any of the purposes mentioned in section 57(1) of the Ordinance, which are the safeguarding of security, defence or international relations in respect of Hong Kong.
2. To carry out any of the purposes mentioned in section 58(1) of the Ordinance, which include the prevention or detection of crime, and the assessment or collection of any tax or duty.
3. Where the collection of the ID card number of the individual is permitted under the code (see Step 2 in the ID card number section above) and the copy of the ID card is further collected for any of the following purposes:
   1. to provide proof of compliance with any statutory requirement, e.g. an employer may collect a copy of an ID card to prove compliance with the requirement of section 17J of the Immigration Ordinance (Cap.115) to inspect the ID card of an individual before employing him or her;
   2. to comply with a requirement to collect the copy which is included in any code, rules, regulations or guidelines applicable to the data user and which requirement has been endorsed in writing by the Privacy Commissioner, e.g. the requirement, which the Privacy Commissioner has endorsed, on banks to collect copies of the ID cards of their customers in the Money Laundering Guidelines issued by the Hong Kong Monetary Authority;
   3. to collect or check the ID card number of the individual, but only if the individual has been given the choice of presenting his or her ID card in person instead, e.g. Transport Department is permitted to collect copies of ID cards for this purpose in relation to applications for driving licences made by post, as individuals are given the choice of presenting their ID cards in person;
   4. for the issuing of an officially recognised travel document, e.g. the BN(O) passport; or
   5. to enable the data user to carry out functions related to the operation of a tribunal or a court.

In addition, the Immigration Department is permitted to collect copies of ID cards in carrying out its functions and activities.

Step 2 : Make sure that your collection of copies of ID cards does NOT come under one or other of the circumstances where this is specifically NOT permitted in the code

A data user is not permitted to collect a copy of an ID card under the following circumstances

1. merely to safeguard against a clerical error in recording the name or ID card number of the individual, i.e. the copy should not be collected in order only to enable the person to check the accuracy of the record that has been made of the individual's name or ID number.
2. merely in anticipation of a prospective relationship with the individual, e.g. it would not be permissible for an employer to collect a copy of the ID card of an individual only because the employer may wish to offer him or her employment at some stage

Step 3 : Check whether the way you collect copies of ID cards ensures that they are truly copies of the ID cards that are held by the individuals concerned

1. When a data user collects a copy of an ID card from the holder in person, the copy should always be checked against the ID card concerned, e.g. where an individual opens a bank account in person and provides a copy of his or her ID card, the bank should check the copy against the individual's ID card.
2. When a data user collects a copy of an ID card from a third party, the data user should take all reasonably practicable steps to ensure that the third party has checked the copy against the ID card concerned, e.g. a car hire-purchase finance company that receives copies of ID cards of applicants for hire-purchase finance from car vendors dealing directly with the applicants should require the vendors to check such copies against the individuals' ID cards.
3. A data user who obtains from individuals copies of their ID cards other than directly from the individual in person e.g. the copies are sent to the data user by post, should also undertake the following actions.
   1. The relevant staff should be given training to enable them to detect irregularities on the face of ID card copies, e.g. the staff should be instructed on the usual content of ID cards so that any omission in a copy would be detected.
   2. A system should be instituted for ensuring that ID card copies are not accepted unless they have been checked and no irregularity has been found. Note: The system should be included in any relevant manual of office procedure and practice.
   3. A record should be retained in relation to such copies indicating that they have been collected without being checked against the ID cards concerned, e.g. a note to this effect could be made on the copy itself.

Step 4 : Check that you use copies of ID cards only for one or other of the purposes permitted by the code

A data user should use copies of ID cards only for:

1. the purposes for which they were collected,
2. a purpose for which the individual concerned has voluntarily given express consent, or
3. a purpose for which there is an applicable exemption under the Ordinance.

Step 5 : Check that you are implementing adequate security safeguards for copies of ID cards that you hold or transmit

Specifically, the code requires the following.

1. 
   A copy of an ID card in paper form should be marked "copy" across the image of the ID card. This requirement does not apply to a copy that is awaiting conversion into some other form, e.g. microfilm or image form, within a reasonable time. Mark copies of ID cards with the word "COPY" across the images of the cards.
2. Where a copy of an ID card is subject to the above requirement and is obtained in the presence of the holder it should be marked "copy" in his or her presence, e.g. where an individual opens a bank account in person and either provides a copy of his or her ID card or the bank makes such a copy, the bank should mark it "copy" in the presence of the individual.
3. 
   A data user that collects copies of ID cards should ensure that such copies are treated as confidential documents, e.g. as with other confidential documents they should be kept in locked cabinets or secure areas when not in use. The copies should be kept under secure conditions with access restricted to individuals who need to carry out permitted uses of the copies. Treat copies of ID cards as confidential documents.
   
   A data user should not transmit a copy or image of an ID card unless it has taken all reasonably practicable steps to ensure that it is received only by the intended recipient. Such steps could include safeguards such as encryption, confidential mail boxes, access passwords and dedicated fax machines for receiving confidential material. In case of dispatch by mail, a sealed envelope should be used and the image of the ID card should not be visible through any window in the envelope.

Previous Page | Next Page