Stricter NRIC data collection rules kick in from Sept 1; non-compliance could result in hefty penalties

SINGAPORE - Companies have less than a week to comply with stricter rules by Singapore's privacy watchdog governing the use, collection and disclosure of the NRIC and other national identification numbers.

In a release on Monday (Aug 26), the Personal Data Protection Commission (PDPC) reminded organisations that unless required by the law, from Sept 1, it will be illegal for organisations to physically hold on to an individual's NRIC and collect its full number.

This applies to birth certificate numbers, foreign identification numbers and work permit numbers as well. The commission had announced changes to the NRIC advisory guidelines last year as a result of established practices that involved the rampant use of the NRIC.

Details from the permanent and irreplaceable identifier were being used in a range of situations - from filling out lucky draw coupons and membership applications, to retailers registering customers for parking redemptions.

With the updated guidelines, companies can no longer collect national identification numbers from Sept 1.

"NRIC numbers are a permanent and irreplaceable identifier issued by the Singapore Government primarily for public administration purposes and to facilitate transactions with the Government.

"As NRIC numbers can be used to retrieve data relating to individuals, there is a need to reduce indiscriminate or unjustified collection and negligent handling of NRIC numbers," the PDPC said in its statement.

Organisations that have collected the NRIC numbers have been encouraged to assess if they need to retain these numbers and, if not, the commission suggests they dispose of them responsibly and in compliance with the Personal Data Protection Act (PDPA) disposal methods.

[[nid:426301]]

The law already prohibits the indiscriminate collection of consumers' personal data and requires organisations to account for its use.

But privacy advocates have argued that NRIC details were still being collected, sometimes for frivolous reasons - from booking a movie ticket to renting a bicycle.

From Sunday, NRIC numbers or copies of the NRIC can be obtained or shared only if they are required by law, such as when subscribing to a new phone line, making a doctor's appointment or checking into a hotel.

NRIC details may also be collected when it is necessary to precisely verify an individual's identity "to a high degree of fidelity".

This would include visiting pre-schools or transactions involving healthcare, financial or real estate matters, and when not getting it could risk security or could cause significant harm.

Organisations that continue to indiscriminately collect, use or disclose the NRIC would be flouting the PDPA, and could incur a financial penalty of up to $1 million.

One company that has made changes to the way it uses the NRIC is security services company Prosegur Security, which employs about 1,400 security officers in Singapore.

In the past, some of its clients had asked the company to collect the NRIC - either the full number or the card itself - before allowing visitors to enter their premises.

The company now tells its clients that such requests cannot be made, and amendments have been made to its standard operating procedures (SOPs), including the way clients verify the identity of visitors.

For instance, some clients now use part of their national identification numbers for verification.

"Clients generally are also earnest about doing the right thing and are participative in implementing, amending or enforcing SOPs in line with the requirements," said Mr Vincent Wong, HR manager for Prosegur Security.

Its staff have all been briefed about the dos and don'ts of data collection as well, including the use of the NRIC and management of footage captured by closed-circuit TV cameras and body cameras.

About three months ago, the company disseminated the PDPC's advisory guidelines to all of the sites where its staff work, to allow them to refer to it as and when they need to.

Recruitment portal Jobstreet has also taken steps to get itself ready before the Sept 1 deadline.

A spokesman told ST that since June, it no longer collects the NRIC numbers of job candidates as an optional identifier on its online registration form.

Those who had previously provided the number were informed that the company would remove their NRIC numbers from its databases from June.

"This data removal execution exercise has since been completed in July 2019," said the spokesman.

This article was first published in The Straits Times. Permission required for reproduction.