39 / 192
necessary:
• for the prevention or detection of crime, the apprehension, prosecution or detention
of offenders, or any other purpose outlined in Section 58(1) of the Ordinance (clause
2.3.2.2 of the Code of Practice on the Identity Card Number and other Personal
Identifiers);
• to advance the interests of the HKID holder, e.g. a doctor may require a patient to
provide his HKID number to ensure that the correct previous medical records of the
patient are obtained for use in medical consultation and treatment (clause 2.3.3.1 of
the Code of Practice on the Identity Card Number and other Personal Identifiers);
• to safeguard against any damage or loss of the data user, which is more than trivial in
the circumstances, e.g. a driver in a car accident may collect the HKID number of
the other driver in order to facilitate any future claim (clause 2.3.3.3 of the Code of
Practice on the Identity Card Number and other Personal Identifiers); or
• to be inserted in a document to be executed by the HKID holder which is intended to
establish or evidence a legal or equitable right, interest or liability not of a transient
nature or trivial in the circumstances, e.g. the HKID number of an individual may be
inserted into a contract (involving substantial interests) to which he is a party (clause
2.3.4.1 of the Code of Practice on the Identity Card Number and other Personal
Identifiers).
5.11
In a complaint involving collection by a management company of the HKID numbers of
drivers who visited the car park of a commercial building which was open to the public,
the Commissioner found contravention by the management company of DPP1(1) and
clause 2.3 of the Code of Practice on the Identity Card Number and other Personal
Identifiers. As the management company failed to provide any figures on the number of
crimes committed in the car park, there was insufficient evidence to show that such
collection was necessary for the prevention of crime as alleged. The management
company subsequently appealed against the enforcement notice issued by the
Commissioner. In AAB No. 41/2004, the appeal was dismissed by the AAB and the
decision of the Commissioner was upheld.
5.12
In another complaint lodged with the Commissioner, a food company required
purchasers of its food products who wished to be registered for a lucky draw to provide
their names, contact information, HKID numbers and dates of birth. Prizes of the lucky
draw included free credit card spending and gift vouchers worth tens of thousand
dollars. Upon investigation, the Commissioner found that there were two categories of
lucky draw tickets, namely tickets placed inside the products all bearing the same lucky
draw number, and tickets that were attached to the boxes of other products with
unique lucky draw numbers. The Commissioner decided that for those participants
issued with unique lucky draw numbers, the company would have been able to meet
the purpose of authentication when winners presented their tickets and HKIDs for prize
collection by checking the lucky draw numbers together with their names and contact
information previously registered with the company. In all the circumstances of the case,
the collection of the HKID numbers of these participants was excessive and in
contravention of DPP1(1). As for those participants who held the same lucky draw
numbers, the Commissioner considered that collection of their HKID numbers was
acceptable in view of the high value of the prizes and the risk of misdelivery of prizes.