Illegal For Companies To Photocopy NRICs & Collect IDs From 1 Sep 2019

NRIC Information May Only Be Collected For These Reasons

If you’ve registered for a supermarket lucky draw with your NRIC number, you won’t have to do so any longer, come 1 Sep 2019.

Source

That is, once a recommendation by the Personal Data Protection Commission (PDPC) comes to pass.

Private organisations will no longer be able to attain, utilise or share NRIC details. Making copies of your NRIC, or holding on to the actual card will also not be allowed.

What about NRIC info I’ve already given out?

For those who’ve already given out their NRIC info or submitted photocopies of your cards, fret not.

The government has decreed that organisations with your information will have to assess if they are still using it — and dispose of them responsibly by 2019.

Furthermore, disposal methods must be compliant with Personal Data Protection Act (PDPA) requirements.

Proper security in place

Companies with access to NRIC information must ensure that proper security measures are in place to protect the data.

Source

Neglecting to secure sensitive info like your NRIC numbers may result in hackers gaining access to them — or using them for identity theft or fraudulent activities.

With only one NRIC issued per citizen throughout their lives, damages are costly and possibly permanent.

New phone line still need NRIC

Unless required by law enforcers, companies may not physically hold onto your NRIC, or photocopies of them.

Here are instances where it’s still legal to share your NRIC details:

• New phone line subscriptions
• Making a doctor’s appointment
• Checking into a hotel
• Healthcare transactions
• Financial, real estate transactions

When an individual has to be identified to a “high degree of fidelity”, NRIC details may still be collected to mitigate security risks.

However, the updated 1 Sep 2019 guidelines do not apply to government or public agencies.

Up to $1 million fine if not followed

Companies that do not adhere to the new guidelines could face fines of up to $1 million.

Source

Besides NRIC numbers, birth certificates, ICs for foreigners and work permits are included under the new rules.

As for passport numbers, similar to NRIC examples, PDPC has advised that organisations shouldn’t collect them in full, but opt for partial collection instead:

• SXXXX203 F (Last 3 digits + letter)

Even so, they’ll be responsible for securing this information.

Alternatives to identify citizens

The government will be working with relevant agencies and stakeholders to create a guide on alternative ways to identify citizens.

Some ways include a QR code system, unique IDs assigned to new users, or tracking numbers.

This is probably a good move to protect citizens’ data. But due to the many exceptions, we’re afraid it may be hard to implement in real life.

Sound out in the comments if you believe the new penalties for NRIC info collection are too harsh, or a step in the right direction.

Featured image from Channel NewsAsia and Gov.sg.