Q: We are a company which organise international fairs mainly jewellery fairs. We would like to know whether the following practice would be a breach of the Ordinance or the Code of Practice on the ID Card Number and other Personal Identifiers ("the Code")?
(a) Can we collect visitors' identification document number in the visitors' registration form in view of the high level of security required where valuable items are exhibited.
(b) For security reason, we will have bag searching at exit. Anyone going out from the hall with a bag(s) is requested for a search. Also, we are planning to install CCTV at the entrance and inside the hall in order to record down the whole fair period. All these two actions are for the purpose of crime prevention.
(c) On the whole, we also have other forms and procedures that require exhibitors giving us passport/ID cards number together with fax copies so that we can prepare badges for them. In this case, can we do so? And what kind of action we need to take in doing this?
A: According to the Code, identification card number may be collected for the prevention of detriment to any person other than the data user (paragraph 2.3.3.2) or safeguard against damage or loss on the part of the data user which is more than trivial in the circumstance (paragraph 2.3.3.3). Given that valuable jewellery are presumably exhibited at your fairs, it appears that such collection is necessary for preventing detriment to other exhibitors or for safeguarding you against damage or loss which is more than trivial in nature. Whether it is indeed so is for you to decide. In considering collection of identification documents other than the ID card number, similar considerations apply by virtue of paragraph 4.7 of the Code.
Since you have mentioned that you collect personal data by means of registration forms, we would like to remind you of the requirements under data protection ("DPP") 1(3) of Schedule 1 to the Ordinance. In particular, DPP1(3) requires that where personal data are collected from the individual who is the subject of the data, as is the case when an individual provides his or her personal data in a form, all reasonably practicable steps should be taken to inform the individual explicitly of the following:
(a) the purpose for which the data are to be used;
(b) the classes of person (if any) to whom the data may be transferred; and
(c) the individual rights to request access to and correction of personal data of which they are the subject and to whom to make such requests.
We suggest that a convenient way of giving such notification is to include these matters in a Personal Information Collection Statement (PICS) in the registration form.
Your specific questions are addressed below in the order in which they appear in your question.
(a) Pursuant to paragraph 2.4.1 of the Code, you should check the ID card or other identity document provided by visitors at the exhibition entrance as the means of verifying the number of such document entered on the registration form, unless some other means of verification is adopted as mentioned in the answer to question 3.2.
(b) The searching of bags is outside the scope of the Ordinance.
As regards CCTV cameras, if no recordings are made, no issues of relevance to the Ordinance could arise. However, where CCTV cameras are used to make recordings of individuals from which they could be identified directly or indirectly this may amount to the collection of personal data. Such collection is governed by DPP1. This requires, inter alia, that the means used to collect personal data must be fair in the circumstances of the case. The open use of CCTV cameras to record individuals is itself intrusive on the privacy of individuals and requires reasonable justification. In your case, it seems on the facts to be justified in order to prevent and detect crime.
In addition, such collection of personal data is subject to the requirement of DPP1(3) as mentioned above. Generally speaking, this requirement could be met by incorporating an appropriate PICS in the registration form, or by displaying it in a prominent notice at, say, the exhibition entrance.
(c) If you are referring to your pre-registration procedure, whereby copies of ID cards or other identification documents are to be collected together with registration forms sent in before the exhibition, under paragraph 3.2 of the Code, copies of ID cards are not to be collected except in situations where such collection is permitted under that paragraph. Paragraph 3.2.2.3 permits such collection as the means to check the ID card number of the individual, but only if the individual has been given the alternative of producing his or her ID card in person for such checking and has chosen not to do so. Hence in your case, you may collect ID copies for pre-registration if, and only if, applicants are given the option of showing their ID cards to you, say, at your office, in lieu of providing such copies.
Lastly, as you refer to the preparation of badges, please note the general requirement of paragraph 2.8 of the Code that cards should not be issued to individuals bearing their ID card numbers. While this requirement does not take effect until 19 December 1998, it would be preferable if organisations could avoid issuing new cards bearing ID card numbers even before then.