Guideline No. 3.7.3
Code of Practice on the Identity Card Number and other Personal Identifiers
You may be aware that the Privacy Commissioner had issued the Code of Practice on the Identity Card Number and other Personal Identifiers (the "Code") on 19 December 1997. A provision has been incorporated into the Code to permit the collection of copies of ID cards where this is required under any code, rules, regulations or guidelines issued by a regulatory or professional body and such requirement has been endorsed in writing by the Privacy Commissioner as being in accordance with data protection principle 1 of the Personal Data (Privacy) Ordinance (see paragraph 3.2.2.2 of the Code enclosed).
Pursuant to paragraph 3.2.2.2 of the Code, the Privacy Commissioner has now written to the Monetary Authority and given his endorsement in writing of the requirement under paragraph 5.5 of the Prevention of Money Laundering Guideline issued under section 7(3) of the Banking Ordinance (the "Guideline") for authorized institutions to collect copies of identity cards. This means that authorized institutions can continue to collect copies of identity cards for customer identification purpose as required under paragraph 5.5 of the Guideline without being in breach of the Code issued by the Privacy Commissioner.
Extract of Code of Practice on the Identity Card Number and other Personal Identifiers
3.2.2 where the collection of the identity card number of the individual by the data user is permissible under Part II of this Code, and the copy of the identity card is collected furthermore by the data user:
3.2.2.1 in order to provide proof of compliance with any statutory requirement on the part of the data user;
Note: For example, an employer may collect a copy of the identity card of an employee as proof of compliance on the part of the employer of section 17J of the Immigration Ordinance (Cap.115), which requires the employer to inspect the ID card of a prospective employee before employing him.
3.2.2.2 in order to comply with a requirement to collect such copy as contained in any code, rules, regulations or guidelines applicable to the data user issued by a regulatory or professional body, which requirement has been endorsed in writing by the Privacy Commissioner as being in accordance with Data Protection Principle 1 of the Ordinance;
Note: For example, banks are permitted under this paragraph to collect copies of the identity card of their customers in compliance with the relevant requirement contained in the Money Laundering Guidelines issued by the Hong Kong Monetary Authority, which requirement has been endorsed in writing by the Privacy Commissioner.
3.2.2.3 as the means to collect or check the identity card number of the individual, who has been given the alternative of physical production of his identity card in lieu of collection of such copy by the data user but has chosen not to do so;
Note: A common example of such collection would be the Transport Department receiving applications for driving licence, which individuals may choose to make either in person or by post. Even where the predominant way for a data user to collect ID card numbers is through the collection of ID card copies sent to it by mail or by fax, e.g. in the case of a service provider without any retail outlets, an option should still be made available for individuals who prefer to do so to present
