HKIDs and Government secrecy
12th February 2013
Take our HKIDs and Government poll
Poll closed: 18:00:00 27-Feb-2013
There's been a lot of attention recently on the proposed implementation of
changes to the Companies Ordinance to allow the Companies Registry (CR) to withhold
full HKID or passport numbers and "usual residential" addresses from public
inspection at the registry.
Webb-site first wrote about the HKID issue
back in 2010, when the Financial Services and Treasury Bureau had issued conclusions from its consultation
on a draft Bill. The ordinance was amended last summer before the end of the
2007-12 session. The full ordinance can be
found here. Now we have a new LegCo and the Government needs subsidiary
legislation to map out the details, without which, this Division of the
ordinance (Division 7 of Part 2, Sections 47-60) will presumably not be brought
into effect. So on 2-Nov-2012 the Government published a
consultation on the Companies (Residential Addresses and Identification
Numbers) Regulation (CRAINR), amongst other things. The
consultation closed on 14-Dec-2012, and conclusions have not yet been published.
So we still have a chance to stop it. Media articles in the last few months on the
assets of families of state leaders (including
Wen Jiabao and the
8 immortals) were
facilitated by access to the CR, and that has brought this issue to global
attention. Closer to home, sub-divided apartments held by a company owned by a
HK official's wife have also been in the news. But there are much broader issues
at stake, including the entire approach of the HK Government to access to
HKIDs should be seen, not hidden
In our 2010 article, we opposed the proposal to blank out
the last 3 digits of ID numbers, because it makes it impossible to know for sure
who you are dealing with. 1,000 people could have the same partial HKID, and in some cases, they will have the same name. Family names in
HK, like Scottish clans, don't have a lot of variety, particularly when Romanised (there is a
many-to-one relationship between Chinese characters and English words). Take out
the Chans, Cheungs, Leungs and Wongs and you would be missing more than one
third (24/70) of the
Legislative Council. In mainland PRC, the top 3 family names
cover 21% of the population, and many of them have only two characters in
their name, such as "Li Wei", of whom we currently have 16 in
Webb-site Who's Who (WWW),
the leading public database on HK people.
other culture, some given names are also quite popular. For example, we currently have 19 "Chan
Chi Keung"s in WWW, of which 9 have no English given name, so they appear
identical. The only way we can distinguish between them is using an identifier
from another source, such as the SFC, where each licensee has a separate code.
That doesn't help much though, because the same person could have been licensed
with the HKMA, MPFA or insurance self-regulators, but he would have a
different license number at each regulator. He might also have a disciplinary
history as a licensed estate agent, a solicitor, or a certified public
accountant. If all regulators published HKID numbers, then we would know whether
we are looking at the same person. Without HKIDs, we are often unable to connect the dots and know
for sure whether it is the same person or a different person with the same name.
As the Law Society put it in
"Identification numbers should be recorded and disclosed in
full as it is a unique piece of information for identifying a person; the name
of a person is not. Persons with identical names are not uncommon. An identification number is not a reliable tool for
authenticating the identity of a person in electronic or telephone transactions.
Use of identification number for authentication purpose is itself a misuse and
should be discouraged."
The Government, in its
paper, said "the remaining digits (together with
the name) should be sufficient to identify the individual persons". That
directly contradicts the Government's own
of 17-Dec-2009, which said (p54):
"The option of masking 3 or 4 digits of an identification number
would not serve the purpose of identifying a person as there are cases of
persons with the same name having similar identity card numbers".
By treating HKIDs as secrets, the Government is encouraging the misuse of the
HKID as an authenticator (particularly by phone) rather than an
identifier, and thereby incentivising
identity fraud. The Government should be doing the opposite, and requiring the
service providers it regulates, such as telecoms and pay-TV providers, to find
other ways to authenticate their customers.
The HKID index
The easiest way to stop abuse of HKIDs as authenticators would be to give clear notice that
in say, two years' time, the full register of all HKIDs and the corresponding
names will be published, so that nobody will rely on them as
authenticators. Two years ought to be enough time for all commercial
users to modify their systems to use more reliable authentication when dealing
with customers by phone.
The Government should embark on a publicity campaign to remind people that HKIDs are
not secrets and should not be used as authenticators. Through the Communications
Authority, the HKMA and the SFC, Government can also require regulated service
providers not to use ID numbers to authenticate people by phone or online. If
they need to authenticate a customer by phone, they should ask the customer
something that only she and the service provider would know, such as a
pre-arranged password, or the balance on the last bill.
The Government should amend the Privacy Ordinance to make clear (if it isn't
already) that an ID number is not a piece of personal data, it is an identifier.
It does not in itself contain material personal information
about a person, it merely identifies them.
The Government should also publish full HKID numbers alongside the name of
any person it appoints to a statutory or advisory body. These posts are like
directorships of companies, and the public has a right to know exactly who has been
appointed, rather than just a common name (see
this notice, for example - who is Wong Wai Man, or Chan Chi Hung?). The
HKIDs can then be used at the
CR, Land Registry and other public sources to know more about the person and check on any conflicts of
interest. Regulators, likewise, should use HKID numbers in their online
directories of licensees and in disciplinary matters. That includes the HKICPA,
HKMA, SFC, MPFA, Medical Council, Estate Agents Authority and any other licensor
you can think of.
We published our founder's ID number, P135143(9) back in 2010, to prove that
this is not in any way a secret. Today, we are launching an
index of HKIDs
which are (or have been) available on the web, not behind any pay-wall,
and not as a result of any security breach. There are over
1,100 people in that index, mostly still alive, including some well-known
billionaires whose HKID numbers can readily be found online. Interestingly, the
most popular prefix is "D", and the rarest is "Y". Judging from the names, it
seems that persons born outside HK are more likely to have a P or an R
(including some mainland arrivals), and the XA, XD, XE and XG series are almost
exclusively non-Chinese but have been here for decades - possibly all before the
handover, so perhaps those series are no longer issued.
We have compiled this index without (yet) paying to obtain data in the CR -
but we reserve the right to do so. Filings with the CR are public filings, and
the data are provided for the purposes of making them available for public
inspection and identifying who the directors of companies are. You don't have to be a company director if you don't want to, but if
you are, then the public has a right to know exactly who you are. You direct
your company with its privilege of limited liability. The only
reason that the CR data are not used more widely is the pay-wall that stands in the
Tear down that wall
The CR has a monopoly on filings from companies registered in HK. The Land
Registry has a monopoly on the registration of real estate transactions. Each
operates behind a pay wall, a pay-per-view document scheme which harks back to
the days when providing copies of documents from the registries actually cost
money, and involved counter service staff, acetate microfiches and reading rooms
to enlarge, view and print said microfiches. In the 21st century though, the
registries receive a lot of documents electronically, and those which are on
paper are promptly scanned and digitised for internal records. The incremental
cost of making all those files available for public search is nearly zero - just
a matter of local bandwidth and software maintenance.
So there is no "user pays" excuse here. The greater public interest would be
served by demolishing the pay-wall and opening the registries, and all their
documents, to public access. In the words of Ronald Reagan in Berlin, "tear
down this wall". A good example of this open access is the
Companies Registry, where all documents are online. They do have the
complication that NZ has no national ID number scheme, so instead they
distinguish between "John Smith"s by using their residential addresses. Another
option would be to use dates of birth, to almost eliminate duplicates.
The CR makes a monopolistic profit.
for the year to 31-Mar-2012 show that the CR had turnover of HK$483.2m and
pre-tax profit of $257.6m, or 53% of turnover. Only $61.1m of turnover came from
search and copying fees, so it would still have made a huge profit even if it
charged nothing for searches. Incorporation fees, annual filing fees, and
registration of charges (mortgages) amounted to $384.0m of turnover. So in fact
the CR should cut those fees as well.
Meanwhile at the Land Registry,
for the year to 31-Mar-2012 show turnover of $426.8m, sharply reduced because of
Special Stamp Duty which reduced transactions and filings, but still making a
profit before tax of $116.5m, which was more than the search fees of $82.2m. In
the previous year, turnover was $573.4m, with profit before tax of $242.2m and
search fees of $100.9m. So in both years, the Land Registry would have made a
profit without charging search fees.
Both registries are essential Government services and are natural monopolies.
They should not be run for-profit but to cover their costs, including
amortisation of infrastructure. The Basic Law calls for the Government to
balance its budget, not rack up surpluses by abusing natural monopolies.
Regardless of that, the public interest calls for opening the registries and
all their documents to free online search. For example, the controversy over the
defaulted sales of luxury flats at 39
Conduit Road would have been avoided if it had been obvious, from looking at
the online sale and purchase agreements, that each sale was to a shell company
with only a 5% deposit. In effect, those shells were call options - if the value
of the flats went down more than 5%, then the owner of the shell would walk away
from the deal, and if not, then they would complete the purchase. The buyers and
the developer knew that, but the public did not. Journalists had to pay to see
each and every transaction agreement before they could build the picture.
Similarly, researching the assets and potential conflicts of interest by
government officials, both from the mainland and HK, involves paying to see
records of each company and property they are involved with - if you can
identify them in the first place. In a first-hand example of why the use of
HKIDs would improve transparency and reduce mistaken identity, we can tell you
that on 18-Apr-2007, Ming Pao
reported that Webb-site founder David Webb had sold a house in Mount Kellett
Road for HK$75m, upon which he had made a profit of $12m. Nice story - but it
wasn't us. The newspaper didn't bother to call us - they assumed that the
property agents feeding them the story had got the correct David Webb. To our
knowledge, there are at least three "David Webb"s in Hong Kong. Incidentally,
the same house was
resold in 2012 for HK$155m. If only we had held on to the house we didn't
own to start with!
Now, if this story had been about the secret assets of a Chinese
politburo member or a HK Chief Executive, he would probably have sued the
newspaper for defamation. The risk of such mistaken identity is enough to
intimidate the media into not reporting - there is a rule of thumb: "if in doubt,
leave it out".
A media exemption would mean media controls
On 29-Jan-2013, after a meeting with Government, the
HK News Executives Association said
that the Government had
suggested an exemption in the law for journalists. The fact that the Government even
suggested such an exemption shows how little they have thought about the Basic
Law issues at stake here. Yet they have clearly been planning it in some detail
- each "media organisation" would be given its own password to access the HKIDs
and residential addresses, but only if it was used for the purpose of news
reporting. It is a blatant attempt to "buy off" opposition from the media, and
we are glad that the Hong Kong Journalists Association has rejected this move
A media exemption is completely unacceptable. Unlike in mainland China, where
the Government controls all the media and censors free speech, Hong Kong has
"freedom of speech, of the press and of publication" guaranteed by
Article 28 of the Basic Law. There is no licensing scheme which says who is
a journalist and who is not, and what is a media organisation and what is not,
nor should there be (although there is still the antiquated
of Local Newspapers Ordinance).
The grant of any privileged access would imply a licensing
or recognition scheme which could become a tool to suppress the media. The
ability to withdraw privileged access to the registries by revoking recognition
of a journalist or organisation would mean that the Government had the ability
to impede freedom of the media. Bloggers, freelance investigative journalists,
and operators of independent sites like Webb-site, would have a particularly
tough time. The Government could simply refuse to recognise someone as a
"journalist" or "media". Members of the public who wanted to conduct their own
research would be locked out.
The situation is bad enough already, in that the Government already releases
some information via a
Government News &
Media Information System (GNMIS) that is not open to the
general public, only to organisations lucky enough to receive a password. You
will notice a complete absence of any "register here" button on the site that
would allow you to sign up. GNMIS is a little known fact - you don't see regular
media ever mentioning it, perhaps because they fear losing access. We believe
the system is used, amongst other things, to give notice of media conferences at
which new policies will be announced.
People working in private banks or IPO sponsors, seeking to do due diligence
on their potential clients, would also have difficulty, as would businesses
seeking to know more about their customers or suppliers. The result would be
more money-laundering, fraud, corruption and conflicts of interest than is
presently the case. So what next - will the Government propose exemption for all
these categories? Who does that leave?
We have sympathy with the proposal to allow display of a correspondence
address rather than a "usual residential address". As long as a person has a
designated correspondence address at which they can be sued (whether or not they
are physically at that address) then we see no reason why that address should
also be his home. It could even be a P.O. Box, because that is little different
from the "virtual office" addresses that thousands of private companies use. The
law can be clarified that the designated address is valid for any legal
proceedings, and if the person then does not check his mail and has a judgment
awarded against him in his absence, that is his choice.
Although there is very little, if any, evidence that the disclosure of
residential addresses has been abused, it can be a personal security issue.
People conducting investigative journalism might not like the idea that the
people they criticise can find out where they and their children sleep at
night. If you are a director of a news organisation or association, or a
freelancer who directs your own company, then your residential address should be
in the CR. That risk in turn might work against the public interest in a free
and incisive media. If you are a director of a private bank who has just
declined to open an account for a suspected triad, then your address is in the
However, we note that residential addresses are also available in other
public documents. For example, the (mostly residential) addresses of candidates
for election to the Election Committee, District Councils and the Legislative
Council are published in the Gazette. There you will find the addresses of the
CPPCC nominees to the Election Committee in 2011, including Leung Chun Ying,
and here are the addresses of
property tycoons. The full list of nominations is
What the Government should do
- Abandon the proposal to restrict access to IDs in the CR.
- Amend the draft subsidiary legislation to focus only on correspondence
addresses, and simultaneously table amendments to repeal the provisions of
the new Companies Ordinance relating to IDs.
- Adopt a Government-wide policy of promoting the use of HKIDs to uniquely
identify a person, including in appointments to Government boards and
- Require the HKMA, SFC, Estate Agents Authority, Medical Council, Dental
Council and other regulators to include HKID numbers in public
registers of licensees, and require that regulated service providers cannot use
HKIDs to authenticate individuals by telephone.
- Amend the privacy ordinance to clarify that identifiers, including HKIDs
and passport numbers, are not personal data.
- Tear down the pay-walls and open the Companies Registry and Land
Registry to free online access for all data and documents.
If the Government does all of the above, then it will promote HK as a fairer,
more transparent and open economy, and at the same time reduce fraud, corruption
© Webb-site.com, 2013