Q: We are an equipment-leasing company. It has been our painful experience that, after delivery of the equipment to a customer, the customer concerned simply vanished. When we reported the case to the police, they required from us a copy of Hong Kong Identity Card of the customer to assist in their investigations. In view of the incident, are we entitled to collect a copy of identity card from the individual guarantors of the corporate customers, such as their directors or shareholders?
A: Under paragraph 3.2 of the Code of Practice on the Hong Kong Identity Card Number and Other Personal Identifiers ("the Code"), no copy of an identity card should be collected except in one of the situations mentioned under that paragraph. Under paragraph 3.2.1.2, a data user may collect a copy of an identity card where the use of the copy by the data user is necessary for any of the purposes mentioned in section 58(1) of the Personal Data (Privacy) Ordinance ("the Ordinance"). Such purposes include, among others, the prevention and detection of crime.
In your letter, you mentioned that it has once been your client's experience that, for purpose of police investigation against a customer who vanished, the copy of the relevant identity card was required by the Police. In our view, unless the percentage of such incidents is particularly high, the happening of one isolated incident does not necessarily entitle your client to collect copies of the identity cards of its customers under paragraph 3.2.1.2.