The staff of a driving school prematurely collected inquirer’s Hong Kong identity card number – Data Protection Principle 1(1)
The Complaint
An individual made enquiries on course details and course fees at a driving school. He was required by the staff to provide his Hong Kong identity (HKID) card number before he could obtain a quotation of a driving course. He did not enroll on any courses with the driving school eventually and considered that the driving school should not retain his HKID card number. He hence made a complaint to the PCPD.
Outcome
Data Protection Principle 1(1) of Schedule 1 to the Ordinance provides that personal data shall be collected for a lawful purpose directly related to a function or activity of the data user, the collection of the data is necessary for or directly related to that purpose and the data is adequate but not excessive in relation to that purpose. Furthermore, HKID card number is a sensitive personal data, a data user may only collect the HKID card number or a copy of the HKID card of an individual under the circumstances allowed in the Code of Practice on the Identity Card Number and Other Personal Identifiers (PI Code) issued by the Privacy Commissioner.
The driving school explained to PCPD that the collection of HKID card number of the complainant was prepared for the driving tests conducted by the Transport Department. However, the driving school should not collect the complainant’s HKID card number prior to his enrolment on its courses. With the intervention of PCPD, the driving school made apology to the complainant and destroyed his HKID card number.
Lesson learnt
Notwithstanding that a data user is allowed to collect the HKID card number of an individual under the PI Code, a data user should duly consider the timing of collection. Premature collection of HKID card numbers may constitute wrongful collection. If a data user has not yet established a definite relationship with the data subject so as to justify collection of the HKID card numbers, the data user must not collect them at that point.
(Uploaded in September 2020)