Personal Data Protection Policy for NRIC

March 27, 2020
0 comments
Craig Fischer
Posted in Business
0

Businesses, companies, or any other organizations gather all sorts of information for business and commercial purposes. As a matter of fact, most companies in Singapore have the practice of collecting a customer’s NRIC number to verify their identities. In this article, we will focus on the personal data protection policy, specifically about the PDPA on NRIC numbers.

Organizations are generally not allowed to gather, use, or disclose National Registration Identity Card (NRIC) numbers (or any NRIC copies of some sort). In cases where they are permitted to do so, they will have to abide by the data protection provisions stipulated in The Personal Data Protection Act or PDPA on NRIC.

The same provisions apply to other national identification numbers such as the following:

Birth Certification numbers
Foreign Identification numbers
Work Permit numbers
Passport numbers

Organizations must not collect the full passport numbers of individuals (even though passport numbers are periodically updated) unless the reason for doing so can be justified by the law.

Key Exemptions

According to the latest Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers, which took effect from 1 September 2019, businesses or private organizations are only permitted to collect, use, or disclose NRIC numbers or copies of the NRIC if:

The collection, use or disclosure is allowed by the law (provided that organizations should still notify the person of the purpose for doing so). Circumstances that fall under this category would be:

Checking in to hotel establishments- as mandated by the Hotels Licensing Regulations

New employment- as required by Section 95 of the Employment Act

Enrolling into a private education institution- as stated under regulation 21 of the Private Education Regulations

Seeking medical treatment at a medical clinic- supported by regulations 12(1) and (1A)(a) of the Private Hospitals and Medical Clinics Regulations.

Subscribing to a mobile phone line or telecommunication line- as required under Section 5 of the Telecommunications Act

It is absolutely essential to establish or verify an individual’s identity to a high degree of accuracy and fidelity—where a failure to do such a case may create a safety risk, security issues, or may cause harm to an individual or an organization. More specifically, NRIC numbers collection is permissible in cases such as:

- Visitor Entry to preschools

Transactions involving financial matters such as insurance claims or financial aids- for verification purposes and to avoid fraudulent claims

Property or real estate transactions

Collection of NRIC numbers are strongly prohibited in situations such as:

Redemption of freebies
Signing up for retail membership
Online purchases such as movie tickets
Participating in a raffle draw
Visitor entry to condominiums or commercial establishments
Submitting feedback on surveys
Registering interest in a product or service

Are there Alternatives to using NRIC Numbers?

There are some alternatives that businesses and organizations can use in lieu of collecting NRIC numbers. It has been highly encouraged that they start using or adopting the following as identifiers:

User- or organization-selected unique IDs
Email Addresses
Mobile Numbers
Partial NRIC Number
Transaction numbers

To help companies comply with the PDPA guidelines, the Personal Data Protection Commission or PDPC offers a technical guide for organizations on how they can start replacing NRIC numbers on IT systems.

Penalties in Place for Breach of PDPA on NRIC

After the PDPA for NRIC data collection kicked in on September 2019, stricter rules are now in place.

In cases of breach, the Personal Data Protection Commission, or the deciding body for PDPA, may issue a directive to immediately stop the collection, use, or disclosure of NRIC. Organizations that obstruct in any way can be made liable to a fine of $10,000 to $100,000 or imprisonment (in some cases).