HKIDs and Government secrecy
12th February 2013

There's been a lot of attention recently on the proposed implementation of changes to the Companies Ordinance to allow the Companies Registry (CR) to withhold full HKID or passport numbers and "usual residential" addresses from public inspection at the registry.

Webb-site first wrote about the HKID issue back in 2010, when the Financial Services and Treasury Bureau had issued conclusions from its consultation on a draft Bill. The ordinance was amended last summer before the end of the 2007-12 session. The full ordinance can be found here. Now we have a new LegCo and the Government needs subsidiary legislation to map out the details, without which, this Division of the ordinance (Division 7 of Part 2, Sections 47-60) will presumably not be brought into effect. So on 2-Nov-2012 the Government published a consultation on the Companies (Residential Addresses and Identification Numbers) Regulation (CRAINR), amongst other things. The consultation closed on 14-Dec-2012, and conclusions have not yet been published.

So we still have a chance to stop it. Media articles in the last few months on the assets of families of state leaders (including Xi Jinping, Wen Jiabao and the 8 immortals) were facilitated by access to the CR, and that has brought this issue to global attention. Closer to home, sub-divided apartments held by a company owned by a HK official's wife have also been in the news. But there are much broader issues at stake, including the entire approach of the HK Government to access to information.

HKIDs should be seen, not hidden

In our 2010 article, we opposed the proposal to blank out the last 3 digits of ID numbers, because it makes it impossible to know for sure who you are dealing with. 1,000 people could have the same partial HKID, and in some cases, they will have the same name. Family names in HK, like Scottish clans, don't have a lot of variety, particularly when Romanised (there is a many-to-one relationship between Chinese characters and English words). Take out the Chans, Cheungs, Leungs and Wongs and you would be missing more than one third (24/70) of the Legislative Council. In mainland PRC, the top 3 family names cover 21% of the population, and many of them have only two characters in their name, such as "Li Wei", of whom we currently have 16 in Webb-site Who's Who (WWW), the leading public database on HK people.

Like any other culture, some given names are also quite popular. For example, we currently have 19 "Chan Chi Keung"s in WWW, of which 9 have no English given name, so they appear identical. The only way we can distinguish between them is using an identifier from another source, such as the SFC, where each licensee has a separate code. That doesn't help much though, because the same person could have been licensed with the HKMA, MPFA or insurance self-regulators, but he would have a different license number at each regulator. He might also have a disciplinary history as a licensed estate agent, a solicitor, or a certified public accountant. If all regulators published HKID numbers, then we would know whether we are looking at the same person. Without HKIDs, we are often unable to connect the dots and know for sure whether it is the same person or a different person with the same name.

As the Law Society put it in their submission in 2010 (page 4):

"Identification numbers should be recorded and disclosed in full as it is a unique piece of information for identifying a person; the name of a person is not. Persons with identical names are not uncommon. An identification number is not a reliable tool for authenticating the identity of a person in electronic or telephone transactions. Use of identification number for authentication purpose is itself a misuse and should be discouraged."

The Government, in its conclusions paper, said "the remaining digits (together with the name) should be sufficient to identify the individual persons". That directly contradicts the Government's own consultation paper of 17-Dec-2009, which said (p54):

"The option of masking 3 or 4 digits of an identification number would not serve the purpose of identifying a person as there are cases of persons with the same name having similar identity card numbers".

By treating HKIDs as secrets, the Government is encouraging the misuse of the HKID as an authenticator (particularly by phone) rather than an identifier, and thereby incentivising identity fraud. The Government should be doing the opposite, and requiring the service providers it regulates, such as telecoms and pay-TV providers, to find other ways to authenticate their customers.

The HKID index

The easiest way to stop abuse of HKIDs as authenticators would be to give clear notice that in say, two years' time, the full register of all HKIDs and the corresponding names will be published, so that nobody will rely on them as authenticators. Two years ought to be enough time for all commercial users to modify their systems to use more reliable authentication when dealing with customers by phone.

The Government should embark on a publicity campaign to remind people that HKIDs are not secrets and should not be used as authenticators. Through the Communications Authority, the HKMA and the SFC, Government can also require regulated service providers not to use ID numbers to authenticate people by phone or online. If they need to authenticate a customer by phone, they should ask the customer something that only she and the service provider would know, such as a pre-arranged password, or the balance on the last bill.

The Government should amend the Privacy Ordinance to make clear (if it isn't already) that an ID number is not a piece of personal data, it is an identifier. It does not in itself contain material personal information about a person, it merely identifies them.

The Government should also publish full HKID numbers alongside the name of any person it appoints to a statutory or advisory body. These posts are like directorships of companies, and the public has a right to know exactly who has been appointed, rather than just a common name (see this notice, for example - who is Wong Wai Man, or Chan Chi Hung?). The HKIDs can then be used at the CR, Land Registry and other public sources to know more about the person and check on any conflicts of interest. Regulators, likewise, should use HKID numbers in their online directories of licensees and in disciplinary matters. That includes the HKICPA, HKMA, SFC, MPFA, Medical Council, Estate Agents Authority and any other licensor you can think of.

We published our founder's ID number, P135143(9) back in 2010, to prove that this is not in any way a secret. Today, we are launching an index of HKIDs which are (or have been) available on the web, not behind any pay-wall, and not as a result of any security breach. There are over 1,100 people in that index, mostly still alive, including some well-known billionaires whose HKID numbers can readily be found online. Interestingly, the most popular prefix is "D", and the rarest is "Y". Judging from the names, it seems that persons born outside HK are more likely to have a P or an R (including some mainland arrivals), and the XA, XD, XE and XG series are almost exclusively non-Chinese but have been here for decades - possibly all before the handover, so perhaps those series are no longer issued.

We have compiled this index without (yet) paying to obtain data in the CR - but we reserve the right to do so. Filings with the CR are public filings, and the data are provided for the purposes of making them available for public inspection and identifying who the directors of companies are. You don't have to be a company director if you don't want to, but if you are, then the public has a right to know exactly who you are. You direct your company with its privilege of limited liability. The only reason that the CR data are not used more widely is the pay-wall that stands in the way.

Tear down that wall

The CR has a monopoly on filings from companies registered in HK. The Land Registry has a monopoly on the registration of real estate transactions. Each operates behind a pay wall, a pay-per-view document scheme which harks back to the days when providing copies of documents from the registries actually cost money, and involved counter service staff, acetate microfiches and reading rooms to enlarge, view and print said microfiches. In the 21st century though, the registries receive a lot of documents electronically, and those which are on paper are promptly scanned and digitised for internal records. The incremental cost of making all those files available for public search is nearly zero - just a matter of local bandwidth and software maintenance.

So there is no "user pays" excuse here. The greater public interest would be served by demolishing the pay-wall and opening the registries, and all their documents, to public access. In the words of Ronald Reagan in Berlin, "tear down this wall". A good example of this open access is the New Zealand Companies Registry, where all documents are online. They do have the complication that NZ has no national ID number scheme, so instead they distinguish between "John Smith"s by using their residential addresses. Another option would be to use dates of birth, to almost eliminate duplicates.

The CR makes a monopolistic profit. Accounts for the year to 31-Mar-2012 show that the CR had turnover of HK$483.2m and pre-tax profit of $257.6m, or 53% of turnover. Only $61.1m of turnover came from search and copying fees, so it would still have made a huge profit even if it charged nothing for searches. Incorporation fees, annual filing fees, and registration of charges (mortgages) amounted to $384.0m of turnover. So in fact the CR should cut those fees as well.

Meanwhile at the Land Registry, accounts for the year to 31-Mar-2012 show turnover of $426.8m, sharply reduced because of Special Stamp Duty which reduced transactions and filings, but still making a profit before tax of $116.5m, which was more than the search fees of $82.2m. In the previous year, turnover was $573.4m, with profit before tax of $242.2m and search fees of $100.9m. So in both years, the Land Registry would have made a profit without charging search fees.

Both registries are essential Government services and are natural monopolies. They should not be run for-profit but to cover their costs, including amortisation of infrastructure. The Basic Law calls for the Government to balance its budget, not rack up surpluses by abusing natural monopolies.

Regardless of that, the public interest calls for opening the registries and all their documents to free online search. For example, the controversy over the defaulted sales of luxury flats at 39 Conduit Road would have been avoided if it had been obvious, from looking at the online sale and purchase agreements, that each sale was to a shell company with only a 5% deposit. In effect, those shells were call options - if the value of the flats went down more than 5%, then the owner of the shell would walk away from the deal, and if not, then they would complete the purchase. The buyers and the developer knew that, but the public did not. Journalists had to pay to see each and every transaction agreement before they could build the picture.

Mistaken identity

Similarly, researching the assets and potential conflicts of interest by government officials, both from the mainland and HK, involves paying to see records of each company and property they are involved with - if you can identify them in the first place. In a first-hand example of why the use of HKIDs would improve transparency and reduce mistaken identity, we can tell you that on 18-Apr-2007, Ming Pao reported that Webb-site founder David Webb had sold a house in Mount Kellett Road for HK$75m, upon which he had made a profit of $12m. Nice story - but it wasn't us. The newspaper didn't bother to call us - they assumed that the property agents feeding them the story had got the correct David Webb. To our knowledge, there are at least three "David Webb"s in Hong Kong. Incidentally, the same house was resold in 2012 for HK$155m. If only we had held on to the house we didn't own to start with!

Now, if this story had been about the secret assets of a Chinese politburo member or a HK Chief Executive, he would probably have sued the newspaper for defamation. The risk of such mistaken identity is enough to intimidate the media into not reporting - there is a rule of thumb: "if in doubt, leave it out".

A media exemption would mean media controls

On 29-Jan-2013, after a meeting with Government, the HK News Executives Association said that the Government had suggested an exemption in the law for journalists. The fact that the Government even suggested such an exemption shows how little they have thought about the Basic Law issues at stake here. Yet they have clearly been planning it in some detail - each "media organisation" would be given its own password to access the HKIDs and residential addresses, but only if it was used for the purpose of news reporting. It is a blatant attempt to "buy off" opposition from the media, and we are glad that the Hong Kong Journalists Association has rejected this move outright.

A media exemption is completely unacceptable. Unlike in mainland China, where the Government controls all the media and censors free speech, Hong Kong has "freedom of speech, of the press and of publication" guaranteed by Article 28 of the Basic Law. There is no licensing scheme which says who is a journalist and who is not, and what is a media organisation and what is not, nor should there be (although there is still the antiquated Registration of Local Newspapers Ordinance). The grant of any privileged access would imply a licensing or recognition scheme which could become a tool to suppress the media. The ability to withdraw privileged access to the registries by revoking recognition of a journalist or organisation would mean that the Government had the ability to impede freedom of the media. Bloggers, freelance investigative journalists, and operators of independent sites like Webb-site, would have a particularly tough time. The Government could simply refuse to recognise someone as a "journalist" or "media". Members of the public who wanted to conduct their own research would be locked out.

The situation is bad enough already, in that the Government already releases some information via a Government News & Media Information System (GNMIS) that is not open to the general public, only to organisations lucky enough to receive a password. You will notice a complete absence of any "register here" button on the site that would allow you to sign up. GNMIS is a little known fact - you don't see regular media ever mentioning it, perhaps because they fear losing access. We believe the system is used, amongst other things, to give notice of media conferences at which new policies will be announced.

People working in private banks or IPO sponsors, seeking to do due diligence on their potential clients, would also have difficulty, as would businesses seeking to know more about their customers or suppliers. The result would be more money-laundering, fraud, corruption and conflicts of interest than is presently the case. So what next - will the Government propose exemption for all these categories? Who does that leave?

Addresses

We have sympathy with the proposal to allow display of a correspondence address rather than a "usual residential address". As long as a person has a designated correspondence address at which they can be sued (whether or not they are physically at that address) then we see no reason why that address should also be his home. It could even be a P.O. Box, because that is little different from the "virtual office" addresses that thousands of private companies use. The law can be clarified that the designated address is valid for any legal proceedings, and if the person then does not check his mail and has a judgment awarded against him in his absence, that is his choice.

Although there is very little, if any, evidence that the disclosure of residential addresses has been abused, it can be a personal security issue. People conducting investigative journalism might not like the idea that the people they criticise can find out where they and their children sleep at night. If you are a director of a news organisation or association, or a freelancer who directs your own company, then your residential address should be in the CR. That risk in turn might work against the public interest in a free and incisive media. If you are a director of a private bank who has just declined to open an account for a suspected triad, then your address is in the CR too.

However, we note that residential addresses are also available in other public documents. For example, the (mostly residential) addresses of candidates for election to the Election Committee, District Councils and the Legislative Council are published in the Gazette. There you will find the addresses of the CPPCC nominees to the Election Committee in 2011, including Leung Chun Ying, and here are the addresses of property tycoons. The full list of nominations is here.

What the Government should do

1. Abandon the proposal to restrict access to IDs in the CR.
2. Amend the draft subsidiary legislation to focus only on correspondence addresses, and simultaneously table amendments to repeal the provisions of the new Companies Ordinance relating to IDs.
3. Adopt a Government-wide policy of promoting the use of HKIDs to uniquely identify a person, including in appointments to Government boards and committees.
4. Require the HKMA, SFC, Estate Agents Authority, Medical Council, Dental Council and other regulators to include HKID numbers in public registers of licensees, and require that regulated service providers cannot use HKIDs to authenticate individuals by telephone.
5. Amend the privacy ordinance to clarify that identifiers, including HKIDs and passport numbers, are not personal data.
6. Tear down the pay-walls and open the Companies Registry and Land Registry to free online access for all data and documents.

If the Government does all of the above, then it will promote HK as a fairer, more transparent and open economy, and at the same time reduce fraud, corruption and money-laundering.

© Webb-site.com, 2013