- Ordinance and the "Code of Practice on the Identity Card Number and other Personal Identifiers" (Code) issued by the Commissioner under the Ordinance.
- According to the Code, property management companies may record visitors' Identity Card numbers at building entrances. However, the Code also points out that property management companies should, wherever practicable, give visitors the option to adopt alternatives which are less privacy-intrusive than providing their Identity Card numbers (e.g. accepting other identification documents for registration, or calling the residents concerned to identify the visitors).
- In the present case, Wilson could in fact have adopted less privacy-intrusive alternatives (e.g. accepting his staff card as proof of identity when the visitor was trying to enter the building to perform his duties, or allowing the security guard to confirm with the resident concerned about the purpose of visit) for visitor identification. However, apart from collection of Identity Card numbers, Wilson failed to offer any less privacy-intrusive alternatives to visitors. The Commissioner found that such an act had contravened the requirements of the Code and the requirements under DPP1(1) as regards the collection of personal data.
Enforcement Action
- The Commissioner has served an Enforcement Notice on Wilson directing it to review the visitor registration procedures and allow visitors (no matter whether they are on an errand) to adopt alternatives which are less privacy-intrusive than providing their Identity Card numbers for registration; formulate written policies and guidelines for staff compliance; regularly circulate the policies and guidelines among its staff; provide staff training to enhance their awareness of personal data protection; and conduct effective and regular monitoring to ensure ongoing implementation of and compliance with the above policies and guidelines.
Recommendations
- The Commissioner encourages property management bodies (including owners' corporations, owners' committees, mutual aid committees and property management companies) to "self-regulate" by adopting good practice in accordance with the law and guidance, to protect and respect
8
