Agency members have reflected to the Council that recently, they have received letters from the Office of Privacy Commissioner for Personal Data (PCPD) enquiring about their personal data collection practices (especially on identity card numbers and date of birth), in order to decide whether a formal investigation on the organization’s compliance with the Personal Data (Privacy) Ordinance (the Ordinance) is needed.

In fact, social service agencies unavoidably handle large volume of personal data in everyday operations and should beware beware of the legal requirement. To facilitate the compliance of the Ordinance, the Council and PwC Hong Kong developed the Personal Data Privacy Toolkit for NGOs in June and uploaded to the Project website. The toolkit highlights the six Data Protection Principles of the Ordinance and provides practical guidance on handling personal data. “Principle 1: Purpose and Manner of Collection” in particular specifies that NGOs as data users, must consider why personal data needs to be collected and processed. Only data necessary for the specific purpose should be collected. Agency members can view and download the toolkit via the link above.

PCPD has also published the “Code of Practice on the Identity Card Number and other Personal Identifiers –– Compliance Guide for Data Users”, which points out that data users have no right to compel an individual to provide a HKID Card number unless authorized by law. The full version of the code can be found in the link above.