Q: I am a manager of a dental clinic. Is it permissible if we collect the ID Card number of patients so as to identify them for the purpose of payment for their treatment by their employers? Is it possible to apply for an exemption from the operation of the Ordinance?
A: Pursuant to paragraph 2.3.3 of the Code of the Practice on the ID Card Number and other personal identifiers ("the Code") ID card numbers may be collected where this is necessary to safeguard against loss that is more than trivial in the circumstances. In addition, you should consider whether your collection of patients' ID card numbers is necessary to ensure the correct treatment of the correct person. This is because pursuant to 2.3.3.1 and 2.3.3.2 of the Code collection of ID card numbers is permitted where this is done to correctly identify the individuals concerned, or correctly attribute personal data (e.g. medical records) to them, and this is necessary to advance their interests or avoid detriment to other parties. It is a matter for you to consider whether these or any other circumstances specified under paragraph 2.3 of the Code fit your particular situation. If they do, you may continue collecting ID card numbers under the Code.
Furthermore, as the Code has been approved on the basis that it gives practical guidance on the application of the relevant requirements of the Ordinance, compliance with the Code gives high assurance that the Ordinance has been compiled with. Accordingly, if the Code is complied with, there is no need to seek exemption from the Ordinance. In any case, the Privacy Commissioner for Personal Data has no power to give such an exemption.