Enforcement Action
- The Commissioner has served an Enforcement Notice on H-Privilege directing it to regularly circulate among the staff its established policy on the handling of residents' personal data and the circular issued in respect of this case. The staff shall not disclose or provide residents' personal data to anyone without authorisation or consent from the residents concerned. H-Privilege is also directed to include the above policy and circular in staff training to enhance their awareness of personal data protection, and also conduct effective and regular monitoring to ensure implementation of and compliance with the above policy and circular, in order to prevent recurrence of similar contravention of the Ordinance.
Investigation Case (4): Wilson Property Management Limited Recorded Visitor's Identity Card Number without Offering Less Privacy-intrusive Alternatives
Case Background
- The complainant was a food delivery worker of a takeaway platform. On 5 December 2021, when the complainant delivered food to a unit at Tung Yuk Court in Shau Kei Wan, which was managed by Wilson Property Management Limited (Wilson), a security guard requested him to present his Hong Kong Identity Card for visitor registration. A notice stating that visitors must present their Identity Cards for registration was also posted at the reception counter. The complainant proposed to provide other identification documents for visitor registration, but the security guard insisted that only Hong Kong Identity Card would be accepted. In the end, the complainant was denied access to the building after refusing to present his Identity Card.
Investigation Findings and Contraventions
- DPP1(1) of Schedule 1 to the Ordinance stipulates that personal data shall be collected for a lawful purpose directly related to a function or activity of the data user who is to use the data; the collection of the data is necessary for or directly related to that purpose; and the data is adequate but not excessive in relation to that purpose.
- Moreover, Identity Card numbers are sensitive personal data. Data users can only collect Identity Card numbers under the conditions stated in the
7
