C.S. 166
CONFIDENTIAL ##
XCC(77)71
8
機密
34
Copy No ...
Page 3 of 6
of 80
The simplest and most efficient way of achieving unique personal identification in Government records is to make use of a person's identity card number. If the identity card number were used for that purpose, it would be necessary:
9
(a)
(b)
for Government to use the identity card number in all its dealings with the public for personal identification purposes when dealing with the public;
to establish within Government a point of responsibility for co-ordinating and controlling the use to be made throughout Government of the identity card number and the records to which access could be gained through the use of the identity card number.
The use of a unique identifier other than the identity card number is theoretically possible but, for a number of reasons, would be an impractical alternative. Any number other than the identity card number would create considerable administrative problems, incur much greater expenditure and cause confusion to the public. Moreover it would be extremely difficult in Hong Kong to construct an identifier based on a person's name and date of birth, which is the only realistic alternative to the identity card number, because of the problems of romanisation of Chinese names. Accordingly, and as the identity card number is widely used in Government records and is an accepted form of identification by the public, in reality it is the only identifier that could be used.
Setting up of a population data-base
10
The introduction of the use of the identity card number in the Government's record-keeping system would enable:
(a)
(b)
a single central computerised record to be created consisting primarily of basic personal identification data such as name, address, date of birth, sex, marital status and the identity card number. The computerisation of the Registration of Persons record, in which all these data are to be found, is already being planned by the Director of Immigration. This computer record could therefore become the single central record of personal identification data;
all the duplicated and redundant personal identification data held in all other Government records could be abolished;
CONFIDENTIAL **
機密
C.S. 166
XCC(77)71
(c)
CONFIDENTIAL #2 機密
34 Copy No .. of 80 Page 4 of 6
all the remaining, non-duplicated data, would continue to be held in separate Government records but these could be accessed by use of the identity card number and, where necessary, the information those records contain could be linked with the central personal identification data. In addition, information from any record could be extracted from the system so that the details about an individual in many records could be made available to that part of the Government which required it. But it is this facility of the proposed system which would have to be comprehensively con- trolled so that information were only made available on an authorised need to know basis. This is where the question of privacy arises, to which reference is made in paragraphs 12 and 13 below.
Benefits and dangers
11
The actual and potential benefits from such a system would be considerable. Routine clerical work would be curtailed; improve- ments would be achieved in the economy, accuracy and speed with which information could be processed; and some elements of Government's forecasting, planning, and matching supply to demand would be improved. All this would enable departments providing services to the public or engaged in law enforcement to work to higher standards, to improve their performance and to undertake tasks which are not at present possible because of inadequate record systems.
12
It is recognised, however, that the enormous quantity of information that can be stored in computer systems and the speed with which this information can be combined, retrieved and widely distributed does raise problems not normally encountered in traditional record keeping systems. Among these is the need to ensure that information of a personal nature affecting an individual's right of privacy is not disseminated to parties for whom the information is not strictly necessary for the efficient conduct of their official business. To provide this pro- tection to the individual does not give rise to any insuperable problem for a computer system.
13
It can be argued that the Government is a single entity and must retain the right to make available to any department any information lawfully obtained by, or make available to, any part of Government, except where this is expressly prohibited by law. On the other hand, information stored in computer systems must protect the right of the individual by ensuring the necessary degree of protection against unauthorised or unnecessary disclosure within Government. Accordingly, if a system of
CONFIDENTIAL
機密
C.S. 166
XCC(77)71
CONFIDENTIAL #
機密
Copy No.34.. of 80 Page 5 of 6
computerised record-keeping, such as that indicated in paragraphs 6-10 above, is to be considered within Government, very careful consideration will need to be given to the administrative roles and procedures and legislation needed to ensure an individual's rights. Consideration would also need to be given to the requirement to keep the future situation closely under review to ensure that all existing and future computer systems on which personal information is held, in both the private and public sectors, are operated with appropriate safeguards for the privacy of the subject of that information.
Conclusions
14
All the available evidence indicates the need to study the feasibility of developing a population data base in the manner described in this paper. But, as indicated in paragraph 8 above, a necessary pre-requisite is the use of an identity card number. If the identity card number is not to be used, the proposed system would not be feasible and a study would not be undertaken. In that case, the Government would have to try to find some other way of improving existing record-keeping systems, But those improvements would inevitably be less successful in removing the deficiencies of the existing systems.
15
If, however, it is agreed in principle that the identity card number can be used in the manner described it is proposed to carry out a feasibility study with the terms of reference set out in the annex to this memorandum.
Financial implications
16
The financial implications of the feasibility study will be worked out in detail but the major expenditure will relate to staff and consultancy costs. This is provisionally estimated to be between $1.5 million and $2 million,
Public relations
17
There are no public relations implications stemming directly from this paper, proposing as it does an internal Government study. There is always, however, the likelihood that Government might be asked its current attitude to computers and privacy given the fact that it is public knowledge that some sort of centralised Government computer system might be contemplated. In the event of such questions it will be necessary to explain that Government is always examining the need to improve its efficiency and if a centralised computer system can help
CONFIDENTIAL
機密