Employment agency’s collection of Hong Kong Identity Card copy from job seekers
The enquirer asked whether an employment agency could collect Hong Kong Identity (HKID) Card copy from job applicants registered with the employment agency.
Relevant Provisions under the Ordinance
Collection of Personal Data
Data Protection Principle (DPP) 1(1) provides that personal data shall not be collected unless the data is collected for a lawful purpose directly related to a function or activity of the data user who is to use the data and the collection of the data is necessary for or directly related to that purpose. Furthermore, the data is adequate but not excessive in relation to that purpose. DPP 1(2) requires that personal data shall be collected by means which are lawful and fair in the circumstances of the case.
DPP 1(3) provides that on or before a data user collects personal data directly from a data subject, the data user shall take all practicable steps to inform the data subject whether it is obligatory or voluntary for him to supply the data, and if he is obliged to do so, the consequence for not supplying the data. The data subject should also be informed of the purpose of collection and the classes of transferees of the data.
Code of Practice on the Identity Card Number and other Personal Identifiers (the Code)
Paragraph 2.1 of the Code states that no data user may compulsorily require an individual to furnish his HKID Card number unless authorised by law. Paragraph 2.2 of the Code states that before a data user seeks to collect from an individual his HKID Card number, the data user should consider whether there may be any less privacy-intrusive alternatives to the collection of such number, and should wherever practicable give the individual the option to choose any such alternative in lieu of providing his HKID Card number. Paragraph 2.3 of the Code sets out the conditions under which a data user may collect the HKID Card number of an individual. Amongst which, paragraph 2.3.1 of the Code provides that a data user may collect the HKID Card number of an individual if it is collected pursuant to a statutory provision which confers on the data user the power or imposes on the data user the obligation to require the furnishing of or to collect the HKID Card number.
Concerning the collection of a copy of HKID Card, paragraph 3.1 of the Code states that unless authorised by law, no data user may compulsorily require an individual to furnish a copy of his HKID Card whereas paragraph 3.2 of the Code states that a data user should not collect a copy of a HKID Card except in the circumstances set out therein. Under Paragraph 3.2.2.1 of the Code, a data user could collect copy of the HKID Card in order to provide proof of compliance on the part of the data user with the statutory provision concerned.
Our Comments
Pursuant to section 56 of the Employment Ordinance, a licensee of an employment agency shall maintain a record of all job applicants registered with the employment agency containing the job applicants’ names, addresses, HKID Card numbers (in the case of a non-resident, passport number and citizenship), fees and commissions received, dates of employment and names and addresses of employers. Such record shall be retained for a period of not less than 12 months after the expiration of each accounting year of the employment agency and shall be kept at the place of business of the employment agency (i.e. the licensed address) to be made available for inspection by the Labour Department.
In this regard, an employment agency may collect HKID Card number in accordance with the Employment Ordinance and paragraph 2.3.1 of the Code. If an employment agency collects copy of the HKID Card of a job applicant in order to provide proof of compliance with the statutory provision, such collection appears to be in compliance with DPP1 and paragraph 3.2.2.1 of the Code.
(Uploaded in March 2019)