LC Paper No. CB(2)2836/01-02(02) Information paper on 4 October 2002

Bills Committee of the Legislative Council Registration of Persons (Amendment) Bill 2001

Experience of Using Smart Identity Cards in Other Countries

INTRODUCTION

As requested by Members at the meeting on 10 July 2002, this paper provides information on the smart identity (ID) card schemes operated by other countries and compares their schemes (including their legislation on data privacy issues) with ours.

SMART ID CARD SCHEMES OPERATED BY OTHER COUNTRIES OR REGION

2. As far as we know, Finland, Brunei and Malaysia have been issuing smart ID cards for some time while the Special Administrative Region (SAR) is planning to do so by the end of this year.

Finland

3. Electronic identification cards (EID), with a validity of three years, are issued to Finnish citizens and foreigners residing permanently in Finland. Apart from being a valid ID card, it can be used for electronic identification and digital signature. The card also serves as an official in a total of 15 European countries. Applications for EID are voluntary.

4. The EID features the holder’s photograph and a microchip, with the user’s e-number embedded in it. With the EID, it is possible to exchange information over data networks with public authorities, companies and corporate bodies. Currently the card provides access to on-line banking and insurance services, educational services, and services 2 provided by regional administration and public administration. It is expected that more services will be provided in the future and thus the EID will become a single key for numerous on-line services.

5. Protection of personal data is governed by the Personal Data Act and enforced by the Data Protection Ombudsman, an independent authority operating in connection with the Ministry of Justice.

Brunei

6. The Brunei national multi-application smart ID card (SIC) was officially launched on 29 July 2000. The scheme was initiated by the Department of Immigration and National Registration (INR) of Brunei. All Brunei citizens and permanent residents are required to register with INR for the issue of a SIC at the age of twelve. The SIC will also be issued to foreigners staying in Brunei for a period of more than three months.

7. There are three types of SIC in circulation - the yellow, the purple and the green. The yellow ID card is for Brunei citizens, the purple one for permanent residents and the green one for temporary foreign residents. All SICs take the form of a contact smart card and contain the template of two thumbprints, one digital photograph, general personal data and immigration specific data. Partitions are available for other government agency data.

8. Commencing from 1 August 2000, all holders of Brunei ID card are required to re-register for a new SIC, but the re-registration for green ID card was temporarily frozen until further notice.

9. At the moment, the SIC has the sole function as an ID card. It will be expanded to include driving licence and electronic certificate at a later stage with a view to working towards e-government and e-commerce.

10. Our understanding is that there is no specific legislation for protection of personal data in Brunei.

3

Malaysia

11. The National Registration (Amendment) Regulations 2001, which formally recognizes the Government Multi-Purpose Card (GMPC) as the national ID card of Malaysia, was introduced in June 2001. The GMPC is an electronic card embedded with a microchip capable of storing and processing a person’s personal particulars for the functions and applications prescribed by the Director General of National Registration. No further paper ID cards has been issued since 31 July 2001.

12. The GMPC is a collaboration of five Government Agencies, namely the National Registration Department as the lead agency, Road Transport Department, Immigration Department, Ministry of Health and Royal Malaysian Police. The GMPC is a replacement of the National Identification Card and Driving Licence. It also serves as the access key to facilitate other services and applications. For instance, availability of passport/immigration information in the GMPC facilitates efficient exit and re-entry of cardholders at Malaysian Immigration checkpoints; E-cash and Automated Teller Machine (ATM) facilitate daily transactions; and Transit makes contactless ‘Touch and Go’ for auto toll and parking possible. An additional application, namely, Public Key Infrastructure (PKI) is planned to be implemented by the end of this year or early next year to facilitate e-commerce transactions and ensure integrity, authentication and non-repudiation of data.

13. Our understanding is that there is no specific legislation for protection of personal data in Malaysia.

Macau SAR

14. The Macau SAR Government is planning to issue the new smart Resident Identity Card (RIC) in November/December 2002. The Law of Resident Identity Card Regime (Law No. 8/2002), which defines the principles for the issuance of smart RIC, was enacted by the Legislative Assembly on 30 July 2002.

4

15. The biometric data to be collected by the Identification Department during application of RIC are fingerprints. Right and left index fingerprints of the cardholder will be captured, digitised and encrypted through algorithms before storing in the chip of the card for auto-gate operation at border controls and verification of identity. Although a person can be identified with absolute certainty from this data, reproducing the fingerprint from the digitised information is not possible.

16. The visible data (i.e. data shown on card face) stored in the chip could be read by an ordinary smart card reader. Reading invisible information such as marital status could be effected by the holder through keying in a Personal Identification Number (PIN) or by an officer through using a Security Access Module (SAM). Reading other invisible data, such as fingerprint codes, contact information, driving licence, will only be possible through a SAM, which is to be produced in the Identification Department under the requests of competent departments. It will contain the access right to certain data defined by the relevant department.

17. Government departments and private sector will be allowed to read card face information stored in the chip. Public notaries (possibly also private notaries) will be allowed to read marital status. Only government departments (mainly Police/Immigration Department) will be able to read fingerprint codes.

18. The smart RIC project will be implemented by phases. The replacement of the current Macau Resident ID Card will be compulsory and is expected to last for 4 years. Until late 2003, there will only be data within the competence of the Identification Department, i.e. single ID application. After that, other data will be added, such as student card, driving licence and medical card.

19. The Law of Resident Identity Card Regime has the following measures in addressing the privacy issue:

(a) allowing the cardholder the option to include the non-identification data in his smart RIC; and

(b) enabling the cardholder to read his data in the smart

5

RIC and related database of the Identification Department.

20. A table comparing the smart ID card scheme adopted by the HKSAR and other countries/regions known to have issued or will shortly issue smart ID card is at Annex.

Security Bureau 2 October 2002

Annex

Comparison of Smart ID Card Scheme adopted by the HKSAR and other countries/regions

Finland Brunei Malaysia Macau SAR SAR

Date of December 1999 July 2000 July 2001 November/ May 2003 Implementation December 2002 Function of the Multi-application Multi-application Multi-application Multi-application Multi-application Smart ID Card • National ID card • Only single application • National ID card • ID card • ID card • Access to various (ID card) at the outset. • Driving licence • Digital certificate • Digital certificate services of the state • Driving licence and • Passport information • Auto-gate operation • Library card sector such as electronic certificate will • Immigration information • Capacity reserved for • Driving licence notification of change be introduced at a later • Automatic Teller inclusion of more • Change of address of address, applications stage. Machine (ATM) functionalities, such as • Capacity reserved for for changes to tax • E-cash student card, driving e-purse and other future cards, registration as • Transit (contactless licence, medical card, applications to be job-seeker with the ‘Touch and Go’ for toll etc. identified labour exchange, etc. and parking) • Emergency point of • Other usages include: • Public Key contact • Employer usage: Infrastructure (PKI) for access to company e-commerce, to be premises and implemented by end of company’s own data 2002 or early 2003 network • Municipality usage: application for day-care, library services, public transportation

Page 1 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

• Banking usage: using bank account via the network, raising loans, investment services • Citizen usage: individual solutions, e.g. secured e-mail • As official travel document for travelling in 15 European countries.

Compulsory or Voluntary Compulsory Compulsory Compulsory Compulsory Voluntary for (Paper type ID card has Replacement of ceased to be issued since Smart ID Card 31 July 2001.)

Population • Finnish citizens and • All citizens of Brunei, • All citizens of Malaysia • All residents of Macau • All residents who are Involved foreigners residing permanent residents or permanent residents SAR aged five and required to register for permanently in Finland aged twelve or above aged twelve and above above. an ID card under the whose particulars have and temporary residents (about 18 million). Registration of Persons been entered in the staying in Brunei for • 2.2 million cards have (ROP) Ordinance and Population Information more than three months. been issued since its ROP Regulations (about System with identity rollout. 6.8 million). verified reliably.

Page 2 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR Data Collection The Identity Card Act of The National Registration The National Registration The Macau SAR Law on The ROP Regulations for Registration Finland only specifies the Regulations stipulates that Regulations stipulates that Residents’ ID Card stipulate that the following of Persons content of an ID card but the following particulars the following particulars Regime only specifies the particulars shall be not the particulars to be shall be furnished by the shall be furnished by the content of the ID card but furnished by the collected at the time of applicants: applicants: not the particulars to be applicants: application. However, • Name (including • Name collected at the time of • Name the Act stipulates that ID , if • Previous identity card application. However, • Residential and business cards are issued to Finnish any) number, if any the ID card application address citizens and aliens • Full address of place of • Full address of place of form shows that the • Nationality claimed residing permanently in residence residence following particulars are to • Place of birth Finland whose particulars • Race • Race be collected: • Date of birth have been entered in the • Place of birth • Religion (only for • Name • Sex population information • Date of birth Muslims) • Sex • In the case of new system and whose identity • Sex • Place of birth • Date of birth arrivals, the names of has been verified reliably. • Physical abnormalities, • Date of birth • Nationality countries which they

if any • Sex • Place of birth have resided Under the Population • Citizenship • Photograph continuously for 6 Information Act, the • Physical abnormalities • Marital status months or more prior to following personal data • Blood group • Citizenship • Profession their entering Hong shall be recorded in the • Photograph • Photograph Kong population information • Fingerprint impressions • Thumbs impressions • Residential address • Name and ID card system: • Such other particulars as • Such other particulars as • Contact telephone number number of spouse • As identification the registration officer the registration officer • Names, sex and age of information – personal may consider necessary may consider necessary • Name of spouse children identity code, electronic • Document details of the transaction identifier, spouse • Profession, occupation, trade or employment name, address, • Name of father municipality of • Document details of the • Travel document

Page 3 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

residence, place of father • In case of non- residence, information • Name of mother permanent resident, his on real estate, building • Document details of the condition of stay (COS) and apartment mother and limit of stay (LOS) • Information relating to • Fingerprint impression • Photograph parents, marriage, (right index finger) • Thumbprint impressions spouse and children • Signature of applicant • Such other particulars as • Information on (or parents) the registration officer citizenship, legal • List of documents may consider necessary capacity and date of submitted death • Additional information • Information on native language and communication language, profession, postal address, corresponding address • Voting right information • Membership of religious community • Information on decisions made by the multi-member body handling social welfare issues relating to the taking of children into custody

Page 4 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

Contents of the • ID card number • The National • ID card number • Serial number • ID card number Card • Name Registration Act and • Name • Date of first issue • Name (English and (Data on Card • Sex Regulations do not • Residential address • Date of current issue Chinese) Face) • Personal identity code specify the particulars to • Sex • Date of expiry • Chinese commercial • Date of issue be printed on the card • Citizenship • Name of the card codes (if applicable) • Date of expiry face. • Religion (only for those holder • Date of birth • Nationality (Finnish • In the lack of a Brunei of Muslim faith) • Date of birth • Photograph (for persons citizens only) ID card, no further • Old ID card number • Height of or over the age of 11) • Issuing authority information is available. • Serial number • Place of birth and sex • Place of birth code

• Photograph of the codes • Symbols denoting sex, holder • Portrait place of birth, residential • Signature of the holder • Category of Macau status, change of name, SAR residential status change in date/place of • Signature birth • Optical character • Date of first registration recognition code of an ID card • Date of issue of the (Information obtained smart ID card from the Macau SAR Law on Residents’ ID Card Regime)

Data stored in • Card face information • Under regulation 5(3) of • Card face information • Visible data on card • Card face information the Chip • Certificates may be the National Registration • Thumbprint image face • Templates of the left and stored, upon application, Regulations of Brunei, • Photo image of the card • Names of the card right thumbprints or any to enable electronic the definition of holder holder’s parents two fingerprints (for transaction “fingerprint impression” • Driving licence • Marital status persons of or over the

Page 5 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

within administration, and “photograph” information • Fingerprint code age of 11) social and health include images stored by • Passport number • Alias(es) used by the • Photo image of the card services, on-line means of a computer. • Expiry date of passport card holder holder (for persons of or authentication, • It is understood that • E-cash information • Temporary permission over the age of 11) encryption and digital blood group of the card • PKI to holder • In case of non-permanent signature. holder will also be stored (The above information • Resident Identity Card resident, his COS and • The following in the chip. However, is obtained from the digital certificate LOS. information will be in the absence of website and the relevant • Date of last update • Digital certificate (at stored onto a certificate: response from the authorities. Cannot • Date of integrated cardholders’ choice) • name of the issuer of relevant authorities, no find such information in circuit lockout on the certificate further information is the National expiry of the Resident • name of the certificate available. Registration Act or Identity Card holder Regulations.) • Password • electronic transaction • Encryption key identifier of the • Information of contact certificate holder person(s) or • validity of the organization(s) in case certificate of incapacitation due to • data on the method accident, illness or card for calculating the holder’s minor status public key of the (on application by the certificate holder card holder) • the country code of the issuer of the (Information obtained certificate from the Macau SAR • serial number of the Law on Residents’ ID certificate Card Regime)

Page 6 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

• data on the calculation method used by the certificate authority for signing the certificate • data on the certificate policy used • data on the usage of the certificate • other necessary technical data required for the use of the certificate.

Memory of the 16K 8K 32K 32K 32K Chip (May move to 64K in 2003 (May upgrade the chip to if chips of 64K are 64K when the technology available in the market and is mature) reliable.)

Contact or Contact Contact Hybrid (contact and Contact Contact Contactless contactless) Card

Validity of the • 3 years • 10 years for citizens and • No expiry date specified • Below 18 years of age: • No expiry date specified Smart ID Card permanent residents valid for 5 years aged 17 and above.

Page 7 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

aged 17 and above. • Between 18-59 years of • 5 years for citizens and age: valid for 10 years permanent residents • Over 60 years of age: aged between 12 and 16. with no expiry date. • For temporary residents, according to period stated in the passport.

Privacy The Identity Card Act of • Regulation 11(1) of the • Regulation 12(1) of the • Article 14 of the Macau • Regulation 12 prohibits Safeguards Finland does not contain National Registration National Registration SAR Law on Residents’ any person without (in ID card any particular provision Regulations of Brunei Regulations stipulates ID Card Regime authority to mark any legislation) on privacy matters stipulates that the that the register shall not prohibits the entry upon, erase, register shall not be open be open to inspection by unauthorized use of cancel, alter any mark or to inspection by the the public. PIN, unauthorized entry, deface or destroy public. • Regulation 12(2) access to the ID card an ID card, or in • Regulation 11(2) confines the power of computer system, possession an ID card confines the power of inspection on the interference with the which is defaced or inspection on the registration register to circuits in the chip, unlawfully altered. registration register to public officers duly hacking and • Regulation 24 of the public officers duly authorized by the unauthorized alteration ROP Regulations authorized by the Director General of of and damage to the stipulates that a Commissioner of National Registration, or data. Offenders will be registration officer shall National Registration, or a police officer carrying liable to imprisonment not disclose a police officer carrying out a police terms and a fine. photographs, out a police investigation. • Allowing the card fingerprints and investigation. • Regulation 25(1)(k) holder the option to particulars without the • Regulation 24(1)(k) prohibits any public include the written permission of prohibits any public officer to publish or non-identification data the Chief secretary for

Page 8 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR officer to publish or communicate to any in his/her smart ID card Administration. communicate to any person any information (Article 9(4)). • To further strengthen the person any information contained in the register • Enabling the card holder privacy safeguards, the contained in the register save in the public to read his/her own data ROP (Amendment) Bill except in the public interest and with the in the chip of the smart 2001 has proposed the interest and with the permission of the ID card and the database inclusion of the permission of the Director-General, or for of the Identification following measures: Commissioner. the purpose of criminal Department (Article 12). • To add the “smart Offenders will be liable proceedings. element” of the new to imprisonment terms Offenders will be liable ID card to the ROP and a fine. to imprisonment terms Ordinance so that the and a fine. prohibitions on unauthorized entry, erasure, cancellation or alteration of ID card (Regulation 12) can also apply to the data in the chip

• To repeal Section 7(2)(f) such that Chief Executive in Council will no longer be empowered to make regulations on the disclosure of personal data • To add a new Section

Page 9 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR 9 in order to impose restrictions on the use of particulars • To move Regulation 24 to the ROP Ordinance (as new Section 10) in order to raise its status • To add a new Section 11 to make unauthorized access, storage, use or disclosure of ROP particulars an offence. Offenders will be liable to imprisonment terms and a fine • To specify in the new Regulation 11A that verification of identity by way of thumbprint match can be done only if there are reasons to double the identity of a person

Page 10 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

Privacy • Protection of personal • There is no separate • There is no separate • Macau does not have • Personal Data (Privacy) Safeguards data is accorded by the legislation on protection legislation on protection any authority with Ordinance [PD(P)O] (in other Personal Data Act. of data privacy. of data privacy. specific powers in the and the Code of Practice legislation) • The Personal Data Act fields of privacy or on the ID Card Number is enforced by the Data personal data, but a and other Personal Protection Ombudsman number of provisions Identifier are in force to (DPO) who is an scattered in the protect personal data independent authority legislation shall have a privacy. operating in connection similar effect. • An Office of the Privacy with the Ministry of • Article 30 of the Macau Commissioner for Justice. Basic Law recognizes Personal Data is • The Personal Data Act that Macau residents established to enforce of Finland is similar to have a right to privacy. the PD(P)O. the PD(P)O of Hong • Article 79 of the Civil • Six data protection Kong in the following Code is specifically on principles are stipulated areas: personal data. It sets in the PD(P)O: • The Controller shall out that a data owner • Data shall not be process personal data shall have the right to collected unless the lawfully and know about any data data are collected for carefully, in relating to himself in a lawful purpose compliance with any database and the directly related to a good processing purposes of the function or activity of practice. The collection, as well as the the data user, the personal data right to demand collection of data is processed must be rectification or update of necessary, and the necessary for the such data. data are adequate but declared purpose of not exhaustive in processing. relation to that

Page 11 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR

• The Controller shall purpose. see to that no • All practical steps erroneous, must be taken to incomplete or ensure that personal obsolete data are data are accurate processed having regard to the • Personal data must purpose for which the not be used or personal data are or otherwise processed to be used in a manner • Personal data shall incompatible with the not, without the purpose of consent of the data processing. subject, be used for Personal data shall be any purpose other processed only if the than the purpose for data subject has which the data were unambiguously to be used at the time consented to the of collection or same, or if processing directly related is based on the purpose provisions of an Act • All practical steps or for compliance shall be taken to with a task or ensure that personal obligation to which data held by a data the Controller is user are protected bound by virtue of an against unauthorized Act, or order issued or accidental access, on the basis of an processing, erasure or

Page 12 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR Act, etc. other use • The Controller shall • All practical steps carry out technical shall be taken to and organizational ensure that a person measures necessary can ascertain a data for securing personal user’s policies and data against practices in relation unauthorized access, to personal data, be accidental or informed of the kind unlawful destruction, of personal data held manipulation, by a data user, and be disclosure, transfer or informed of the main unlawful processing purposes for which • When collecting data, personal data are to the Controller shall be used see to it that the data • A data subject shall subject can have be entitled to information on the ascertain whether a Controller, the data user holds purpose of the personal data on him processing of and request access to personal data, regular personal data destinations of • Section 57 & 58 of the disclosed data, as PD(P)O provides for well as how to circumstances under proceed in order to which data protection make use of the rights principle 6 or 3 is of the data subject in exempted, as

Page 13 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR respect of the appropriate, e.g. for processing operation. safeguarding security, • Everyone shall have defence or international the right of access, relations, or for after having supplied prevention or detection sufficient search of crime, etc. criteria, to the data on him in a personal data file, or to a notice that the file contains no such data • There are also provisions under which the Controller can derogate from the duty of providing information to the data subject, e.g. if this is necessary for the protection of national security, defence or public order or security, for the prevention or investigation of crime, etc. • It is interesting to note in the Personal Data

Page 14 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR Act that personal data can be processed for special purposes such as research, statistics, official plans and reports, public register, genealogical research, direct marketing and other personalised mailing

Legislation for • No particular provision • None • The National • The Law of Resident ID • A new provision will be Multi- on the multi-application • The ID card legislation Registration Card Regime provides added to the existing Application in in page 1 of this chart is does not place any (Amendment) for the storage of digital ROP Ordinance to the ID Card mentioned in the restriction on the Regulations 2001 certificate and empower the Chief Legislation Identity Card Act. The incorporation of future provides that “an emergency point Executive in Council to Act only states that by non-immigration identity card” means a contact. specify in a new means of an electronic applications into the Government • Setting up a Committee Schedule 5 the ID card, a person can be card. Neither is it a multi-purpose Card that defines the policy non-immigration authenticated in requirement that all which is construed to of adding applications that require certified electronic non-immigration mean an electronic card non-identification data the storage of additional transaction and where applications must be embedded with an to the chip of the smart data in the chip or necessary, the person voluntary. electronic microchip ID card and proposes to printing of additional can electronically sign capable of storing and the Chief Executive the information on the card and encrypt documents processing a person’s inclusion of particular face to be incorporated and messages he sends. personal particulars for data. into the new smart ID the functions and • The ID card legislation card. • The ID card legislation applications prescribed does not place any (At the initial stage,

Page 15 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR does not place any by the Director General restriction on the only the digital restriction on the from time to time and incorporation of future certificate issued by incorporation of future includes a high security non-immigration the Hong Kong Post non-immigration identity card with chip. applications into the will be embedded in applications into the • No particular provision card. Neither is it a the chip and requires card. Neither is it a on multi-application in requirement that all the storage of requirement that all page 1 of this chart is non-immigration additional data.) non-immigration mentioned in the applications must be • For implementation of applications must be National Registration voluntary. non-immigration voluntary. Act or Regulations, applications, their except that: relevant underlying • “driving licence” was legislation will be added in the National updated wherever Registration appropriate. Regulations as “driving licence shall be construed as provided under the Road Transport Act 1987” • the definition of “registration office” was extended to include: (a) the National Registration Department or any branch of the National

Page 16 Annex

Finland Brunei Malaysia Macau SAR Hong Kong SAR Registration Department; (b) the Road Transport Department or any branch of the Road Transport Department; (c) the Immigration Department or any branch of the Immigration Department; or (d) any premises as may be determined by the Director General of National Registration.

• The ID card legislation does not place any restriction on the incorporation of future non-immigration applications into the card. Neither is it a requirement that all non-immigration applications must be voluntary.

Page 17