Q: Our company provides godown services. In our daily operation, any corporate customer who wants to set up an account with us is required to produce a photocopy of its business registration certificate whereas individual customer is required to produce a photocopy of his or her ID Card for our records. When these customers or their staff or agent are delivering goods to or from the godown, it is our standard practice that we require the individual concerned to produce the valid Delivery Order, which should have the correct lot number, description and number of packages with company chop and authorized signature(s), and his or her ID Card. We will then write down his or her name and ID card number as reference. Please advise whether these practices will contravene the Ordinance?
A: The parts of the Code of Practice on the Identity Card Number and Other Personal Identifiers ("the Code") that are of direct relevance to your enquiry are paragraphs 2.1 to 2.3, which concern collection of ID card numbers, and paragraphs 3.1 to 3.4, which concern collection of copies of ID cards.
Unless authorized by law, no data user may compulsorily require an individual to furnish a copy of his identity card. A data user shall not collect a copy of the ID card unless the use of the copy is necessary, for example for any of the purposes mentioned in section 58(1) of the Ordinance, which include the prevention and detection of crime (paragraph 3.2.1.2 of the Code). Otherwise, a data user should explore the feasibility of other less privacy intrusive alternatives, such as by other means of identification.
As for the collection of ID numbers of individuals who deliver goods to or from the godown, paragraph 2.3.3 is of particular relevance. A data user may find it necessary to collect ID number of individuals accessing the godown for the advancement of the interest of the holder (for example, to ensure that only authorized customer is making lawful access to the godown), for the prevention of detriment to any person other than the data user (for example, where the person entering the godown may also gain access and temper with the goods and properties belonging to other customers) or to safeguard against damage or loss on the part of the data user which is more than trivial (for example, where valuable properties are stored in the godown and the operator has assumed a duty to ensure their security). However, insofar as it is practicable to do so, you should offer alternatives of identity proof and other means of verifying identity for the individuals to choose from, e.g. the acceptance of staff ID card number, to seek confirmation from the customer on the identity of the individual(s) delivering goods to or from the godown, etc.
uploaded on web in February 2009