Businesses, companies, or any other organizations gather all sorts of information for business and commercial purposes. As a matter of fact, most companies in Singapore have the practice of collecting a customer’s NRIC number to verify their identities. In this article, we will focus on the personal data protection policy, specifically about the PDPA on NRIC numbers.
Organizations are generally not allowed to gather, use, or disclose National Registration Identity Card (NRIC) numbers (or any NRIC copies of some sort). In cases where they are permitted to do so, they will have to abide by the data protection provisions stipulated in The Personal Data Protection Act or PDPA on NRIC.
The same provisions apply to other national identification numbers such as the following:
Organizations must not collect the full passport numbers of individuals (even though passport numbers are periodically updated) unless the reason for doing so can be justified by the law.
According to the latest Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers, which took effect from 1 September 2019, businesses or private organizations are only permitted to collect, use, or disclose NRIC numbers or copies of the NRIC if:
Collection of NRIC numbers are strongly prohibited in situations such as:
Are there Alternatives to using NRIC Numbers?
There are some alternatives that businesses and organizations can use in lieu of collecting NRIC numbers. It has been highly encouraged that they start using or adopting the following as identifiers:
To help companies comply with the PDPA guidelines, the Personal Data Protection Commission or PDPC offers a technical guide for organizations on how they can start replacing NRIC numbers on IT systems.
Penalties in Place for Breach of PDPA on NRIC
After the PDPA for NRIC data collection kicked in on September 2019, stricter rules are now in place.
In cases of breach, the Personal Data Protection Commission, or the deciding body for PDPA, may issue a directive to immediately stop the collection, use, or disclosure of NRIC. Organizations that obstruct in any way can be made liable to a fine of $10,000 to $100,000 or imprisonment (in some cases).