Current laws have no stipulations as to the collecting and handling of ID copies. This Bureau recommends that, unless necessary, institutions should keep this practice of collecting staff's or customers' ID copies to the minimum, and take care when handling such data. If the data leakage arises in the handling, the institution will have to bear the consequences. The collecting institutions should prepare a set of rules, stipulating the circumstances under which copies of IDs may be collected, how to handle them, steps of handling and by whom, etc. When preparing any cards for staff or customers (including staff card, membership card or VIP card), avoid indicating the bearer's name and ID number on the same card. Where necessary, use the staff or customer number instead. For collecting certain personal data, this Bureau has prepared seven authorizations that exempt institutions from the obligation of notifying this Bureau. Institutions can refer to them as reference for making their own personal data processing policy, including processing of ID copies.