On 1 June 2021, the Hong Kong Government announced that it will enact the Telecommunications (Registration of SIM Cards) Regulation (Regulation) to implement the Real-name Registration Programme for subscriber identity module (SIM) Cards (Registration Programme). The Government is introducing the Registration Programme for the purpose of facilitating the prevention and detection of crime, specifically through more effective tracing of SIM card subscribers.
For context, Government figures report that there are approximately twelve million pre-paid SIM (PPS) cards and nine million SIM service plan (SSP) customers in Hong Kong.
Here is a summary of the key features of the Registration Programme:
The Regulation was gazetted on 4 June and will be tabled at Legislative Council on 9 June for commencement on 1 September.
The new measures will apply to all mobile service operators/licensees providing SIM card services, including the larger mobile network operators and mobile virtual network operator and smaller operators under the Class Licence for Offer of Telecommunications Services.
While service operators will need to continue to comply with the requirements of the Personal Data (Privacy) Ordinance (Cap 486) (PDPO), under the Registration Programme, operators will be responsible for the collection and safekeeping of additional personal data of its users. This would possibly involve the setting up of additional infrastructure and back-end systems for registering and storing personal data of users, implementing procedures to address requests for access by LEAs and providing relevant staff with training.
While the PDPO does not expressly include any concept of “sensitive personal data” that is subject to stricter controls, the PDPO’s Data Protection Principle 4 does require data users to consider the kinds of data they process and the harm that could result if there were any unauthorized access to it when they determine appropriate security controls. Copies of identity documents and identity card details are required to be handled in accordance with the Code of Practice on the Identity Card Number and other Personal Identifiers.
During the public consultation on the Registration Programme, the Office of the Privacy Commissioner for Personal Data (PCPD) proposed that SIM card users be given the choice to submit copies of their identity documents to service operators, depending on the mode of registration. For instance, the PCPD proposed that users that are registering online would have to provide a copy of the identity document for verification purposes, whereas users registering in person in physical stores could simply produce the original identity document for verification, without having to deposit a copy of the same.
Having considered the submissions received, the Government retained the requirement to submit a copy of the subscriber’s identity document, regardless of the mode of registration.
The Registration Programme requires users’ personal data to be kept for 12 months after the SIM cards are deregistered. Beyond this period, this general requirement under the PDPO still applies, i.e. personal data shall not be kept for a period longer than is necessary for the fulfilment of the purposes for which the data is to be used. Service operators may need to review and amend their current data privacy practices and policies.
As mentioned, one of the features of the Registration Programme is that LEAs can request service operators to disclose SIM card registration records without a court warrant for dealing with urgent or emergency situations for the purpose of investigation or prevention of crimes. While the PDPO and other legislation already have similar provisions, the introduction of this new measure has led to personal privacy concerns, in particular whether the grounds for warrantless search are sufficiently clear. It remains to be seen whether the Communications Authority would issue further guidelines on this topic or whether one would need to wait for judicial cases to cast light on the scope.
To facilitate the implementation, the Communications Authority is currently working on guidelines to explain and illustrate the requirements of the Registration Programme.
Our team at Hogan Lovells are following the changes closely. Watch this space for further updates.