Collection of identity card numbers of visitors of car park for deterring and detecting crimes - collection is only allowed when there is a real need - retention of collected identity card numbers - clause 2.3 of the Code of Practice on the Identity Card Number and other Personal Identifiers - DPP1(1) and 2(2)
The Complaint
A driver lodged a complaint against the management company ("the company") of a car park in a commercial building for recording his identity card number when he entered and exited the car park.
Findings of the Privacy Commissioner
The company claimed that there had been many theft incidents happened in the car park and the commercial building, so they adopted the policy for the purpose of prevention of crime and for assisting the police in detecting crime. They also alleged that the practice was in compliance with the guidelines issued by the police. Reliance was further made by the company on clause 2.3.2.2 of the Code of Practice on the Identity Card Number and other Personal Identifiers ("the Code") which permits collection of identity card number for the purposes listed under section 58(1) of the Ordinance (i.e. prevention or detection of crime, apprehension, prosecution and detention of offenders, etc.)
The Privacy Commissioner took the view that clause 2.3.2.2 of the Code applied only when there had been a real and practical need for the collection but not for presumption of the possible commission of a crime in the future. In relation to the guidelines issued by the police relied upon by the company, the Commissioner found that it applied only to visitors to a building but not to a car park. In the absence of evidence that manifested the real need for collecting identity card numbers, the company acted contrary to clause 2.3 of the Code, and therefore was in breach of DPP1(1). As the identity card number should not have been collected and retained, the company had breached also DPP2(2) for unnecessarily retaining the number. An enforcement notice was then issued to demand, amongst others, immediate cessation of the collection of identity card numbers and destruction of all collected numbers. Dissatisfied with the Commissioner's decision, the company lodged an appeal to the AAB.
The Appeal
The Board ruled that while there were 5 incidents whereby the police required the company to provide the CCTV recordings of vehicles entering and leaving the car park, there was no evidence to support these recordings related to the alleged theft incidents. In addition, the company had not provided evidence to support the alleged numbers of theft incidents happened in the car park and that the practice of collecting identity card numbers had caused a drop of the number of crimes. Moreover, the company never adopted a less privacy intrusive means suggested by the police to deter crimes, i.e. using the two-card system which required no collection of identity card numbers. As far as the guidelines issued by the police was concerned, they were merely directed to visiting building but not car parks that were open to public. In any event, the guidelines were not legally binding and its compliance did not necessarily satisfy the requirements in the Ordinance.
The company claimed that they retained the collected identity card numbers for one month for the purpose of deterring and detecting crimes. Again, there was no evidence to prove that such retention could assist detecting criminals. In fact, according to the company, the police never required the company to produce the retained identity card numbers.
The AAB's Decision
Appeal dismissed.