SINGAPORE, Aug 31 — From Sept 1 next year, cinema-goers buying tickets or shoppers participating in lucky draws can opt to not disclose their National Registration Identity Card (NRIC) numbers, as part of updated guidelines to improve consumer protection.
For cases where alternative identifiers may not be available, such as entering the premises of a private condominium, they may have to provide their partial NRIC number — up to the last three numerical digits and checksum.
Under new guidelines issued by the Personal Data Protection Commission (PDPC) on Friday (Aug 31), organisations will not be allowed to collect, use and disclose NRIC numbers. They are also not allowed to make copies of or retain the physical cards.
They can only do so when it is required by law, or when the inability to accurately identify an individual could cause significant harm to themselves or other individuals.
Advertisement
These new guidelines, however, do not apply to the public sector or critical infrastructure buildings.
To help companies through this one-year transition period, the PDPC has issued a technical guide as well as a list of pre-approved solutions that organisations can consider adopting.
Organisations that fail to abide by the new guidelines by Sept 1, 2019 will be considered to have breached the Personal Data Protection Act and may be subjected to penalties as laid out in the Act. The fine could be up to S$1 million.
Situations where consumers can opt not to disclose NRIC nos:
When redeeming free parking, buying movie tickets online, signing up for a retail membership or when entering some secured building, among others
In place of NRIC numbers, consumers can provide mobile phone numbers, email addresses or other forms of identification depending on the situation
For cases where alternative identifiers may not be available, such as participating in a lucky draw or entering the premises of a private condominium, they may have to provide their partial NRIC number — up to the last three numerical digits and checksum
Situations where NRIC NOS are still needed:
In situations where failure to properly identify an individual could pose a risk of significant harm, such as entering preschool premises or critical infrastructure buildings, as well as buying a property
By law, members of the public also have to provide NRIC numbers when visiting a doctor, checking into a hotel, subscribing to a telephone line, as well as getting hired at a new organisation
Why this matters:
NRIC numbers are permanent and irreplaceable identifiers. Indiscriminate collection or negligent handling of the information can increase the risk of unintended disclosure and may result in illegal activities such as identity theft or fraud. In addition, the move to digitise records has increased these risks.
Other identifiers such as Birth Certificate numbers, Foreign Identification Numbers and Work Permit numbers are subjected to the same guidelines as NRIC numbers. While passport numbers are periodically replaced, the PDPC urged organisations to accord it similar treatment as NRICs.
What organisations have to do:
Assess other suitable identifiers that could be used in place of NRIC numbers based on their own business needs
Avoid collecting excessive personal data as an alternative to the NRIC numbers
Replace existing NRIC numbers in their data systems with other identifiers
Purchase technology solutions such as a visitor management or customer relationship system to help update and automate their operations in line with the new guidelines
Protect partial NRIC numbers from unauthorised disclosure through reasonable security arrangements
Implement the required changes before the new rules kick in on Sept 1, 2019
A Productivity Solutions Grant will be provided to offset up to 70 per cent of the cost of implementing new solutions. More details will be announced in due course. — TODAY
