Public not required to disclose NRIC numbers from Sept 1, 2019 when buying tickets, entering condos [TODAY Online]

These new guidelines do not apply to the public sector or critical infrastructure buildings.


NRIC

From Sept 1 next year, cinema-goers buying tickets or shoppers participating in lucky draws can opt to not disclose their National Registration Identity Card (NRIC) numbers, as part of updated guidelines to improve consumer protection.

For cases where alternative identifiers may not be available, such as entering the premises of a private condominium, they may have to provide their partial NRIC number — up to the last three numerical digits and checksum.

Under new guidelines issued by the Personal Data Protection Commission (PDPC) on Friday (Aug 31), organisations will not be allowed to collect, use and disclose NRIC numbers. They are also not allowed to make copies of or retain the physical cards.

They can only do so when it is required by law, or when the inability to accurately identify an individual could cause significant harm to themselves or other individuals.  

These new guidelines, however, do not apply to the public sector or critical infrastructure buildings.

To help companies through this one-year transition period, the PDPC has issued a technical guide as well as a list of pre-approved solutions that organisations can consider adopting.

Organisations that fail to abide by the new guidelines by Sept 1, 2019 will be considered to have breached the Personal Data Protection Act and may be subjected to penalties as laid out in the Act. The fine could be up to S$1 million.

Situations where consumers can opt not to disclose NRIC numbers

When redeeming free parking, buying movie tickets online, signing up for a retail membership or when entering some secured building, among others

In place of NRIC numbers, consumers can provide mobile phone numbers, email addresses or other forms of identification depending on the situation

For cases where alternative identifiers may not be available, such as participating in a lucky draw or entering the premises of a private condominium, they may have to provide their partial NRIC number — up to the last three numerical digits and checksum

Situations where NRIC numbers are still needed:

In situations where failure to properly identify an individual could pose a risk of significant harm, such as entering preschool premises or critical infrastructure buildings, as well as buying a property

By law, members of the public also have to provide NRIC numbers when visiting a doctor, checking into a hotel, subscribing to a telephone line, as well as getting hired at a new organisation

Why this matters

NRIC numbers are permanent and irreplaceable identifiers. Indiscriminate collection or negligent handling of the information can increase the risk of unintended disclosure and may result in illegal activities such as identity theft or fraud. In addition, the move to digitise records has increased these risks.

Other identifiers such as Birth Certificate numbers, Foreign Identification Numbers and Work Permit numbers are subjected to the same guidelines as NRIC numbers. While passport numbers are periodically replaced, the PDPC urged organisations to accord it similar treatment as NRICs.

What organisations have to do

  • Assess other suitable identifiers that could be used in place of NRIC numbers based on their own business needs
  • Avoid collecting excessive personal data as an alternative to the NRIC numbers
  • Replace existing NRIC numbers in their data systems with other identifiers
  • Purchase technology solutions such as a visitor management or customer relationship system to help update and automate their operations in line with the new guidelines
  • Protect partial NRIC numbers from unauthorised disclosure through reasonable security arrangements
  • Implement the required changes before the new rules kick in on Sept 1, 2019

A Productivity Solutions Grant will be provided to offset 70 per cent of the cost of implementing new solutions. More details will be announced in due course.

Source: TODAY Online

 


Relevant News