Use of ID card numbers and ID card copies

III. Use of ID card numbers and ID card copies

The Code of Practice on the Identity Card Number and other Personal Identifiers and its compliance guide for data users (issued by the Privacy Commissioner's Office) came into force on 19 December 1997 and were amended in April and July 2016 respectively. Any breach of the Code may be used as evidence in any legal proceedings relating to the Ordinance against the relevant data user.

The Code gives practical guidance to data users on the application of the Ordinance in relation to the collection, accuracy, retention, use and security of: (a) identity card ("ID card") numbers and copies of ID cards; and (b) other personal identifiers that uniquely identify individuals, e.g. passport numbers, employee/staff numbers, examination candidate numbers and patient numbers.

Where a data user has collected an ID card number or copy of an ID card for a purpose allowed under the Code, the data should generally be used ONLY for that purpose. The records of ID card numbers or ID card copies should not be kept for longer than is necessary to fulfill the purpose for which they were collected.

Data users should also implement adequate security safeguards for data that they hold or transmit. Specifically, the Code requires that a copy of an ID card in paper form should be marked "copy" across the image of the ID card. Records of ID card numbers and ID card copies should also be treated as confidential documents which should be kept in locked cabinets or secure areas when they are not in use.

Due to advances in easy-to-use technology and lower costs, biometric data for personal identification has been put to use for purposes other than the investigation of crime. To regulate the use of this sensitive personal data, the PCPD published in July 2015 and revised in August 2020 the note entitled Guidance on Collection of and Use of Biometric Data.

NOTE: 

The below questions and answers only highlight the general points of the Code. For further information, please refer to the whole content of the Code on the PCPD webpage. It is recommended that you contact the PCPD or consult a lawyer if you have any queries about the Code.