The Complaint
1. Summary of Facts
When a family member of the Complainant gave pillowcases and bedspreads to a laundry shop for washing, the staff of the laundry shop recorded the surname and mobile phone number of the family member on the invoice. Later, the Complainant went to the shop to pick up the laundry, but she had not brought along the invoice. The staff told the Complainant that if no invoice was presented, identity card number would have to be recorded. The Complainant suggested giving the surname and mobile phone number of the family member as a substitute, but the suggestion was rejected.
Being dissatisfied, the Complainant reported the case to the police immediately. However, the police did not accept the case. The Complainant could not but present her identity card for registration. The staff then recorded her name and identity card number in a register. The Complainant lodged a complaint with the PCPD complaining the collection of her identity card number by the laundry shop.
During the Privacy Commissioner's investigation, the shop explained that it collected the Complainant's identity card number under section 2.3.3.3 of the Code of Practice on the Identity Card Number and other Personal Identifiers ("the Code") issued by the Privacy Commissioner for Personal Data, i.e. "to safeguard against damage or loss on the part of the data user which is more than trivial in the circumstances". The shop further explained that to protect the interest of customers and the shop, and to avoid fraudulent claims, customers without invoices would be requested to report the case to the police and present the police report to it; or their names and identity card numbers would be recorded with their consent before releasing the laundry. However, the shop admitted that no compensation had been offered for any fraudulent claim since opening in 1990. Moreover, the staff recognized that the Complainant was a frequent customer, who often collected laundry without presenting any invoice.
2. Issue of the case
When a customer cannot present any invoice, in order to ascertain the identity of the customer, and in relation to the purpose, is the collection of identity card numbers necessary and not excessive?
Outcome
1. Reasoning
According to the findings of the Privacy Commissioner, the purpose of collecting the identity card numbers was to provide the same to the Police for detection of crime when there was fraudulent claim. Although the shop said that it collected identity card numbers under section 2.3.3.3 of the Code, i.e. "to safeguard against damage or loss on the part of the data user which is more than trivial in the circumstances", the shop had not provided any information to show how the collection of identity card numbers could prevent them from suffering damage or loss which was more than trivial.
Though section 2.3.2.2 of the Code allows data users to collect identity card numbers for the prevention or detection of crime, the Privacy Commissioner takes the view that section 2.3.2.2 of the Code can only be relied upon when there is actual need to collect identity card numbers in the circumstances. In this case, the shop had never experienced any fraudulent claim. Therefore, the shop had never sought assistance from the police for such case, nor had the police instructed it to provide identity card numbers for investigation. The shop could not collect customers' identity card numbers solely because there might be fraudulent claims or it might be required by the police to provide identity card numbers. To confirm whether the Complainant collected the laundry on behalf of the relevant customer (i.e. her family member), the effective way was to ask the Complainant to give the name and/or mobile phone number provided by the relevant customer before for record, and the date, type, pattern, quantity and colour of the laundry for verification. If the shop still had doubt, it could call the relevant customer for enquiry or request the customer to collect the laundry in person.
Therefore, the Privacy Commissioner was of the view that the collection of identity card numbers by the shop was unnecessary and excessive.
2. Action by the PCPD
An enforcement notice was served on the shop directing it to cease such act and destroy all the identity card numbers collected.
3. Remedial Action by the Party Complained Against
The shop has complied with the requirements of the enforcement notice.
uploaded on web in February 2010