The following paragraphs seek to give practical effect to the Personal Data Security Safeguard Principle (Data Protection Principle 4):
| 3.9 | Save where it is required or permitted by law to do the contrary and subject to paragraph 3.10, a data user should not keep a copy of an identity card in paper form unless it is marked clearly and permanently on such copy, across the entire image of the identity card, the word "copy", or " " in Chinese, or other words in English or Chinese to the same effect. Where the copy is collected by the data user in the presence of the holder of identity card, such marking should be made at the time of collection in the presence of the holder. | |
| Note: | A corollary of this is that an individual who in person provides his ID card copy to a data user has the right to (and in fact should) insist on the marking of the copy being done before him. | |
| 3.10 | Paragraph 3.9 does not apply to a copy of an identity card: | |
| 3.10.1 | existing in a form other than paper form or pending conversion into such a form within a reasonable period; | |
| Note: | Common examples of different forms in which copies of identity cards are kept are imaged and microfilmed forms. | |
| 3.10.2 | collected by a data user before the date on which paragraph 3.9 commences operation until such copy is used by the data user after such date. | |
| 3.11 | A data user who collects a copy of an identity card should ensure that such copy is treated by all staff members concerned as a confidential document, and is kept under reasonably secure conditions with access restricted to individuals who need to carry out activities related to permitted uses of the copy. | |