*******************************************
Following is a question by the Prof Hon Patrick Lau and a reply by the Secretary for Commerce, Industry and Technology, Mr Joseph W P Wong, in the Legislative Council today (March 14):
Question:
The Government has advised that Smart Identity (ID) Card has multi-application capability, which brings convenience to members of the public. In this connection, will the Government inform this Council:
(a) of the types of data that can be stored in Smart ID Card at present;
(b) whether it has considered storing, in the Smart ID Card of construction workers, the records of their attendance at recognised safety training courses, so that they may be allowed to enter construction sites without carrying green cards; and
(c) whether it plans to permit Smart ID Card to store all the professional and academic certifications issued by government departments and recognised academic institutions, thereby reducing the number of certification cards to be issued and facilitating verification by potential employers; if so, of the details of such plans; if not, the reasons for that?
Reply:
Madam President,
The purpose of implementing the Multi-application Smart ID Card is to enhance security and to provide more efficient, better quality and value-added electronic services to the community. Any proposal for change or expansion of the scope of application of the Smart ID Card should be considered on its benefits to the cardholder and the community, taking into account the privacy issues of the cardholder, and will eventually require the approval by the executive body and the Legislative Council before implementation.
Regarding the question asked by Hon Patrick Lau, my reply is as follows:
(1) The data stored in the chip embodied in the Smart ID Card is made up of two main types: (i) immigration data and (ii) non-immigration data.
* The immigration data consists of all the data printed on the card face plus the digital photo image, left and right thumbprint templates and data about the conditions of stay of the cardholder. Besides being used for immigration purpose, part of the data can be used by other applications, including as a substitute for the Library Card.
* The non-immigration data currently consists of a digital certificate of the cardholder issued by the Hongkong Post Certification Authority under the Electronic Transactions Ordinance (Cap. 553) if the cardholder has applied for it to be stored in the chip embodied in the Smart ID Card on a voluntary basis.
There is a limited amount of memory space in the chip of the Smart ID Card available for storing new data, but we need to consider the above factors before adding new data to the chip.
(2) When developing the Multi-application Smart ID Card system, the Government had considered storing data of registered construction workers in the Card. We decided not to add this type of data into the Card, for the following reasons:
* First, the storage capacity in the Smart ID Card is limited. The basic principle for adding new data is that the data should be commonly used, and can benefit the majority of the cardholders.
* Second, reading and storing the contents of the Card require a secure and controlled environment and associated computer systems to preserve the authenticity and integrity of data stored in the Card and prevent the data from being erased or altered. In general, a construction site environment does not meet these requirements. Using an improper system to read or store data in the chip of the Card would not only cause damage to or loss of the data, it is possible that the immigration related data in the Card might be affected.
* Third, if the required data in Smart ID Card is temporarily inaccessible due to loss or damage of the Smart ID Card, it will cause great inconvenience or loss to the cardholders in their work.
(3) The Government does not intend to store data of the cardholder such as professional and academic certifications in the chip embodied in the Smart ID Card. The main reason is that we want to reserve the limited memory space of the Card for new data that can benefit most of the cardholders and the community, taking into account the security and privacy considerations. We believe that the professional and academic certification data does not meet these criteria.
To facilitate checking of this kind of data, we believe that the Smart ID Card can be considered to be used as an authentication token, including the digital certificate stored on the Card as appropriate, to gain access to the databases stored in external computer systems.
Ends/Wednesday, March 14, 2007
Issued at HKT 11:50
NNNN
