*******************************************************
Following is a question by Dr Hon Kenneth Chan and a written reply by the Secretary for Security, Mr Lai Tung-kwok, in the Legislative Council today (April 22):
Question:
The operation support systems of the Hong Kong Police Force (HKPF), comprising the Operational Nominal Index Computer System (Index System) and the Criminal Intelligence Computer System, store the criminal records of individuals, data concerning wanted persons and missing persons, as well as intelligence. Regarding the management and operation of those systems, will the Government inform this Council:
(1) of (i) the respective current numbers of information items on Hong Kong residents and non-Hong Kong residents stored in the aforesaid systems, and (ii) the respective numbers of information items added to and deleted from the aforesaid systems in each of the past three years, with a breakdown by type of information (e.g. fingerprints, palm prints, photographs, DNA samples, criminal records, etc.); the criteria for the collection and deletion of such information;
(2) whether it has formulated guidelines on the collection procedure, collection targets, collection restrictions, time limit for storage and deletion procedure for the information stored in the Index System and reviewed the guidelines regularly; if so, of the details; if it cannot provide the details, the reasons for that; whether it can publicise the guidelines; if it cannot, of the reasons for that;
(3) whether it will consider commissioning the Audit Commission, the Office of the Ombudsman or the Office of the Privacy Commissioner for Personal Data to scrutinise or review the management and operation of the Index System, so as to ensure that the system does not store any excessive and unnecessary information, and that the personnel concerned operate the system in accordance with the established procedures; if so, of the details of the scrutiny and review; if not, the reasons for that, and whether HKPF has any plan to conduct the relevant review; and
(4) given that HKPF will submit a funding application to the Finance Committee of this Council for replacing the infrastructure platform for the aforesaid two systems, whether HKPF will consider reviewing the management and operation of the systems at the same time; if so, of the details of the review; if not, the reasons for that?
Reply:
President,
The infrastructure platform that currently supports the Police Operational Nominal Index Computer System (PONICS) and the Criminal Intelligence Computer System (CICS) is approaching the end of its serviceable lifespan. The Government proposes to replace the outdated infrastructure platform for maintaining effective daily operation of law enforcement agencies. Our consolidated reply to Dr Hon Chan's question is as follows:
The PONICS maintains a central repository of criminal records in Hong Kong and details of all persons who are signified by the Hong Kong Police Force (Police) as "Missing Persons" or "Wanted Persons". The Police and other law enforcement agencies may retrieve data from the PONICS for prevention and detection of crime and for execution of statutory functions. The Police also provide criminal conviction records to assist the Judiciary in performing its judicial functions during court hearings. As at March 2015, there were around 1.1 million criminal records in the PONICS which, however, does not maintain a breakdown by status as Hong Kong resident and non-Hong Kong resident, nor does it have figures of data addition or deletion on a yearly basis. The system does not keep information such as fingerprints and palmprints.
Under section 59 of the Police Force Ordinance (Cap 232), the Police may record and retain particulars of persons arrested and convicted for violating the law of Hong Kong. Criteria for deleting related data are formulated in accordance with section 59 of the Police Force Ordinance and other relevant laws. Circumstances leading to deletion of data include that the defendant is acquitted or his conviction is quashed by the court on appeal, that the subject cautioned under the Police Superintendent's Discretion Scheme attains the age of 18 years or two years have elapsed since the administering of the caution (whichever is the later), that voluntary binding over orders and court orders under section 15 of the Juvenile Offenders Ordinance (Cap 226) have expired, and that the person concerned is certified dead.
The Police adopt a strict mechanism to regulate the management and operation of the PONICS. Limited to "restricted use", the PONICS is operated by trained and authorised officers who are in stringent compliance with internal guidelines and procedures. The PONICS is also subject to a vigorous security checking mechanism, under which monitoring officers carry out sampling check of audit records on a regular basis to identify any unauthorised or improper use of data. Any suspected unauthorised access to the system or use of data, once spotted, will be investigated comprehensively by the Police, which may result in criminal prosecution or disciplinary action. As an internal document of the Police, the PONICS guidelines shall not go public. Formulated with reference to the law of Hong Kong, the guidelines will be timely updated by the Police in the light of relevant legislative amendments.
The Police have in place a set of proven and effective mechanism and procedures to ensure the high level of integrity, reliability and security of the PONICS. In their past internal monitoring, the Police spotted individual officers' violation of the regulations by making improper access to the system or use of data therein and, as a result, they were internally disciplined. Some of them had to face criminal liability by having been charged for the offence of "access to computer with criminal or dishonest intent". Given that the PONICS is an internal operating system, the Police have no plan to invite scrutiny by any outside organisations.
Ends/Wednesday, April 22, 2015
Issued at HKT 12:26
NNNN
