Visitor Registration
The Enquiry
An enquirer would like to know whether the security guard of a residential estate could record the full Hong Kong Identity (HKID) Card number and name of a visitor.
Our Response
Upon collection of personal data, data users are obliged to comply with the requirements of Data Protection Principle (DPP) 1 of Schedule 1 to the Ordinance. A data user should only collect personal data for a lawful purpose directly related to its function or activity. The data collected should be necessary and adequate but not excessive for such purpose. The means of collection should be lawful and fair.
Regarding the collection of HKID Card numbers, data users (including property management organisations) should further observe the requirements under the “Code of Practice on the Identity Card Number and Other Personal Identifiers” (the Code) issued by the PCPD. Unless authorised by law, no data user may compulsorily require an individual to furnish his HKID Card number. Paragraph 2.3 of the Code sets out the conditions under which a data user may collect HKID Card number of an individual. For example, a data user may collect HKID Card number of a visitor at the entrance of premises in circumstances where the monitoring of the activities of the visitor is not practicable. However, according to paragraph 2.2 of the Code, before a data user seeks to collect from an individual his HKID Card number, the data user should consider whether there may be any less privacy-intrusive alternatives to the collection of such number.
The Code does not specifically distinguish the requirements in collecting full or partial HKID Card number. As long as the above requirements under the Code are all complied with, data users may collect the full HKID card number of individuals. Otherwise, no part of the HKID card number should be collected at all.
(Uploaded in August 2024)