Hong Kong: Updates Guidance on Handling Identity Card Numbers

Privacy and Data Protection

Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) released updated versions of its guidance documents regarding the use of Identity Card numbers. These updates include a revised Code of Practice and a new information leaflet aimed at both organizations and the public, which was released on 22 August 2024.

Key Points from the Compliance Guide:

• Collection and Use of ID Numbers: Organizations can’t force people to provide their ID numbers unless it’s legally required. When collection is allowed, organizations must:

  • Explore alternatives to collecting ID numbers.

  • Ensure collection practices align with the Code.

  • Verify the accuracy of the ID numbers provided.

  • Use ID numbers only for approved purposes.

  • Avoid displaying or disclosing ID numbers publicly.

  • Retain ID numbers only as long as necessary.

• Handling Copies of ID Cards: Similarly, organizations can’t require copies of ID cards unless authorized by law. When collection is permitted, they must:

  • Confirm that collecting copies is allowed.

  • Ensure copies are genuine and accurate.

  • Use copies only for authorized purposes.

  • Implement strong security measures for storing or transmitting copies.

• Other Personal Identifiers: These are subject to the same rules as ID numbers, meaning they can only be collected and used in the same way as ID numbers. Exceptions apply if the identifiers are necessary for specific functions.

For more details, you can view the press release - here and Compliance Guide - here