Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

40 / 192

Such collection would avoid damage or loss which was more than trivial in the
circumstances as permitted under clause 2.3.3.3 of the Code of Practice on the Identity
Card Number and other Personal Identifiers. The Commissioner also considered that it
was unnecessary for the company to collect the participants’ dates of birth for the
purpose of contacting them and verifying their identities as argued.8
5.13 In relation to the collection of a copy of an individual’s HKID, clause 3.2 of the Code of
Practice on the Identity Card Number and other Personal Identifiers has prescribed
circumstances under which such collection is allowed, some of which are similar to those
specified in paragraph 5.10 above. However, clause 3.3.1 of the Code makes it clear
that the collection of a copy of a HKID will not be allowed merely to safeguard against
clerical error in recording the name or HKID number of the individual. There was a
complaint against a government department for taking a photograph of the
complainant’s HKID for the purpose of verifying the complainant’s identity as a witness.
The Commissioner took the view that such an act was contrary to DPP1(1) and clause
3.3.1 of the Code. The government department eventually agreed that the collection of
the copy of the complainant’s HKID was unnecessary and deleted the image stored in
the digital camera.
5.14 In another investigation,9 the Commissioner found that the collection by a fitness centre
of copies of HKIDs or Home Visit Permits from applicants/members during the handling
of membership applications/renewals, breached DPP1(1), as such collection was
unnecessary and excessive for the purposes put forward by the fitness centre. The fitness
centre claimed that the collection was necessary in order to verify the identity of each
member for establishing a legal relationship; enabling the fitness centre to take legal
action where necessary; facilitating internal administration and external audits; and
discouraging its staff (who earn extra commission based on the number of memberships
sold) from fraudulently creating membership accounts. The Commissioner found that
such reasons for collection were not justified as there were less privacy intrusive
alternatives available, e.g. the fitness centre could have required members to enter into
the membership agreement under their legal names instead of pseudonyms, and
auditors could verify the fitness centre’s income based on bank statements, etc. In
particular, the Commissioner found that the fitness centre’s collection of copies of HKIDs
or Home Visit Permits for the claimed prevention of fraud by its staff was not justified
under paragraph 3.2.1.210 of the Code of Practice on the Identity Card Number and
other Personal Identifiers in the absence of any supporting statistics or cogent evidence.
He was of the view that the fitness centre could have considered implementing other
8 See Investigation Report Number R09-3658, available on the Website:
9 See Investigation Report Number R13-12828, available on the Website:
10 Under paragraph 3.2.1.2, a data user may collect the copy of an identity card for any of the purposes mentioned in
section 58(1) of the Ordinance (the prevention or detection of crime, the apprehension, prosecution or detention of
offenders, the assessment or collection of any tax or duty, etc.).