It was reported by some local newspapers that a bank collected from non-account holders their Hong Kong Identity Card copies, addresses and contact details when the latter purchased gift cheques from this bank. A self-initiated compliance check was carried out by the PCPD after this matter had come to light.
Of direct relevance to this case is Data Protection Principle ("DPP") 1(1) of Schedule 1 to the PD(P)O. DPP1(1) stipulates, among other things, that personal data shall not be collected unless the data are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data. DPP1(1) further provides that the personal data collected shall be adequate but not excessive in relation to that purpose. Paragraphs 3.1-3.4 of the Code of Practice on the Identity Card Number and other Personal Identifiers ("the PI Code") have specifically set out the circumstances under which an individual's identity card copy may be collected.
The clarification and view from Hong Kong Monetary Authority ("HKMA") were sought as to whether such collection was required pursuant to the Guideline on Prevention of Money Laundering ("the Guideline") issued by the HKMA. The HKMA confirmed that though there was no specific guideline provided by them in respect of gift cheque business, a person who purchases a gift cheque from a bank is normally regarded as an applicant for "business". According to paragraph 5.26 of the Guideline with respect to business transactions undertaken for non-account holders, banks are required to seek positive evidence of identity from these applicants and keep copies of their identification documents when the transactions undertaken involve large sums of cash or are considered unusual.
The PCPD took the view that even if the bank relies on paragraph 5.26 of the Guideline, it is doubtful whether purchase of gift cheques would normally involve large sum of cash or could be considered as unusual as covered by the said paragraph.
Eventually, the bank in question agreed to revise their practice and ceased to collect Hong Kong Identity Card copies from the non-account holders buying gift cheques unless the amount of a single purchase exceeds HK$100,000.