Q: Is collection and use of ID card numbers of data subjects in connection with the administration of public examinations allowed under the Code of Practice on the ID card number and other personal identifiers ("the Code")?
A: It is necessary for you to consider whether your practices in collecting and using ID card numbers are justified by reference to the general provisions of the Code. As regards collection, the starting point is paragraphs 2.1 to 2.3 of the Code. In particular, pursuant to paragraph 2.3, ID card numbers should not be collected except under the circumstances specified therein.
It appears to us that the circumstances that are most likely to be relevant to this case are those specified in paragraphs 2..3.2.2 and 2.3.3.1. Pursuant to paragraphs 2..3.2.2 such collection is permitted where it is necessary for one or other of the purposes mentioned in section 58(1) of the Personal Data (Privacy) Ordinance. These purposes include the prevention, preclusion or remedying of unlawful or seriously improper conduct, or dishonesty or malpractice. If one purpose of your collecting ID card numbers is to prevent or remedy cheating in public examinations, and such collection is necessary to achieve this purpose, it will be justified on this basis. In addition, paragraph 2.3.3.1 of the Code permits the collection of ID card numbers, to enable the correct identification of individuals, or correct attribution of personal data, e.g. examination marks, to them. Such identification or attribution of personal data must, however, be necessary to advance the interests of the holders of the ID cards, e.g. the examination candidates. If, as appears to be the case, this is so in the case of candidates sitting for public examinations, then your collection is also justified under this heading. You should, however, consider this guidance in the light of the particular circumstances of your case before concluding that your collection of ID card number is consistent with the requirements of the Code.
Where ID card numbers are collected pursuant to the requirements of paragraph 2.3 of the Code, they may be used for the purpose for which they were collected (paragraph 2.6.1 refers). They may also be used for linking, retrieving or otherwise processing records as permitted under paragraphs 2.6.3 and 2.6.4 of the Code.