The personal data protection commission or PDPC is the deciding organization that introduces updates to the personal data protection act or PDPA NRIC, which stands for National Registration Identity Card.
The NRIC includes numbers that are required by transactions related to the government. Many companies in Singapore also routinely ask for NRIC numbers when transacting with individuals, whether asking for physical NRICs, soft copies of NRICs or NRIC numbers.
The PDPA NRIC guidelines were updated in the last 2 years and in this article, we summarized the updates that organizations handling individuals’ NRIC numbers should definitely need to know about.
Businesses and companies are no longer allowed to gather, use and disclose NRIC numbers
Not being able to do so only applies to certain circumstances. Such situations include when gathering, using and disclosing of NRIC numbers are:
- Required under the law; or
- Necessary to accurately establish or verify identities to a high degree of fidelity.
To explain the two circumstances further, here are the specific requirements:
When gathering, using and disclosing NRIC numbers are required under the law
There are laws and regulations that can allow certain organizations and businesses to be able to collect numbers of NRIC to even ask copies of NRIC numbers. The numbers may be necessary for the services that these businesses provide. Here are some examples of these instances:
- Employers may collect employees’ NRIC numbers for record-keeping purposes.
- Telecommunications companies providing mobile phone services may collect customers’ NRIC numbers and keep a copy of the NRIC as evidence of identity.
- Hotels must collect NRIC numbers upon check-in as a record of identity.
- Healthcare institutions may collect NRICs and may ask to review the NRICs for verification purposes.
When gathering, using and disclosing NRIC numbers are used to verify identities and of certain persons
The guideline for the usage of the NRIC numbers states that the organization can ask for the number if it is needed to verify an identity of a person. But, there must be enough notification and consent. These businesses must immediately stop asking for NRIC numbers when it no longer serves the aforementioned purpose.
Here are examples of these instances:
- Visitors attempting to enter preschools, where ensuring the safety and security of the students is an overriding concern.
- Situations where there is a risk of fraudulent claims leading to financial loss, such as property transactions, insurance applications and claims, applications and disbursements of financial aid, and background credit checks with credit bureaux.
- The selling of tobacco.
Businesses and organizations must stop collecting NRIC numbers where they can
For example, when people are asked to show a copy of their NRIC numbers when entering and/or leaving a building. Even though in highly-secured places, exchanging an NRIC copy for a visitor badge is required, it is not legally stated under the law. What they can do is that they can choose an alternative to have one point of entry and exit so they can return their visitor badge without having to present the NRIC copy.
There are alternatives to NRIC as a representation of identity
Last but definitely not least, there are alternatives to the NRIC as a point of identification. This includes user-generated IDs, tracking numbers, organization-issued QR codes, monetary deposits or partial NRIC numbers.
Thus, organizations and businesses are encouraged to assess using these alternatives to reduce the risk of collecting and using NRIC numbers.
Here are examples where these alternatives can be used:
- Checking vehicle or mobile phone numbers.
- Booking references, tracking numbers or SMS confirmations.
- Adopting visitor management systems instead of open physical visitor logbooks.
