Q: As doctors, can we record the patients' ID card numbers or retain a copy of their ID cards. Can patients' ID card copies or numbers be passed to other practitioner in referral cases?
A: It is permissible under paragraphs 2.3.3.1 and 2.3.3.2 of the Code of Practice on the ID Card Number and other personal identifiers ("the Code") to collect the ID card numbers of a patient to ensure that the correct treatment is given to the correct person.
On the other hand, there does not appear to us to be any provision in the section of the Code on the collection of copies of ID cards (paragraphs 3.1 to 3.4 refer) that permits the collection of copies of the ID cards of patients by medical practitioners. If it is considered such collection should be permitted, one should consider pursuing the avenue provided by paragraph 3.2.2.2 of the Code. Under that paragraph, a data user may collect the copy of an ID card pursuant to a requirement contained in any code, rules, regulations or guidelines applicable to the data user issued by a regulatory or professional body, provided that such requirement has been endorsed in writing by the Privacy Commissioner for Personal Data. In submitting such a requirement, whether current or proposed, one should set out the supporting arguments.
As regard the transfer of records of ID card numbers and copies of ID cards of patients between medical practitioners, it should be noted that such transfers are a form of use of the personal data concerned. Under the Code, as under the general provisions of the Ordinance, personal data may be used (including transferred) for a purpose for which the data were to be used when they were collected. For example, where records of ID card numbers are collected by medical practitioners pursuant to paragraphs 2.3.3.1 and 2.3.3.2 of the Code this is done for the correct identification of their patients and the correct attribution of other personal data, viz. medical records, to them. Accordingly, the records of the ID card numbers may be transferred to other parties, e.g. other medical practitioners and used by them, for the same purpose. Similar reasoning could also be applied to copies of patients' ID cards if the collection of such copies is permitted under the Code. In our view, however, this is not presently the case.