NRIC Data to Get More Protection with Stricter Rules
Singapore’s National Registration Identity Card (NRIC) is about to get a boost in protection from 1 September 2019. New laws in rules in place are set to make it harder to make copies of the NRIC, collect, use or disclose it. These rules are set to be enforced under the Personal Data Protection Commission (PDPC).
Companies should be aware that unless it is required by the law, even physically holding someone else’s NRIC is going to be made illegal. The move is set to protect the public from unintentionally disclosing their NRIC numbers which may put them at risk of illegal activity and fraud. This is to help minimize the risk of security and potential significant harm which the bearer of the NRIC could experience if their cards were misused.
The guidelines were be proposed by the PDPC and submitted for public consultation at the end of last year. Under the stricter rules which will be enforced, NRIC numbers, copies of these cards and numbers will no longer be permitted to be shared or obtained in instances which include getting a new mobile line, checking into a hotel or even making an appointment unless legally required by law. If a company or organization needs to obtain the NRIC details, they must first ensure that the protection measures they have in place for data are adequate and compliant with the Personal Data Protection Act (PDPA). If found guilty, organizations could put themselves at risk of being fined up to $1million.
Who Can Exempted From This Rule?
Exempted from these new guidelines will be any Government, public agency or organization which is acting on the Government’s behalf. The Government is also set to review its processes to ensure that the use of NRIC by public agencies is limited, and that any retention of the physical NRIC is only done if required by law or is necessary to confirm the identity of the individuals in question.
These updated guidelines will not just be applicable to NRIC numbers, but also other national identification cards, including driving licenses and passport numbers unless there is a justifiable reason to do so. Even partial NRIC numbers will not be permitted because they still considered part of the individual’s personal data, according to the Act. Any organization who intends to collect even partial NRIC numbers must first be compliant with the Act’s Data Protection Provisions and take the necessary precautions to ensure that the data will not be disclosed.
PDPC is set to work together with the Infocomm Media Development Authority (IMDA) to help organizations transition to these new guidelines and work to replace the need for NRIC number identifies with alternatives, which include tracking numbers or QR codes issued by the organization itself. IMDA is set to identify pre-approved technology solutions which companies will be able to consider, and develop template notices so businesses will be able to manage the expectations of the customer during this transitional period.
