Have you ever thought of why you have to submit your NRIC number whenever you redeem free parking or participate in a lucky draw?
The Personal Data Protection Commission (PDPC) announced that starting from 1 September next year, it will be illegal for organisations to collect NRIC details. Which means that they cannot anyhow collect, use or reveal your NRIC numbers, or even make copies of your IC – it will be against the law.
Swee la! Even though this should have been implemented way earlier, but its better late than never right?
Under the updated guidelines by PDPC, there will be stricter rules where companies can only collect and use NRIC numbers only under specific circumstances required by the LAW. This would apply when the activity needs to accurately identify the person, especially when it involved financial transactions relating to healthcare, finances and real estate matters, or risk in security or cause significant harm. Basically, anything involving money and security la.
In fact, companies are also NOT allowed to hold onto your NRIC, unless the law says so. They can be fined up to $1 million for breaching the Personal Data Protection Act (PDPA).
So when do you still need to give your IC number? For example:
- Getting treated at a clinic
- Joining a company as a new employee
- Subscribing to a mobile plan
- Enrolling in a private educational institution
- Visit a massage parlour
But why suddenly the hard stance? Because it’s easy for the baddies to use NRIC numbers for illegal activities, involving identity theft or fraud, if the NRIC numbers are not handled properly; especially in today’s digital economy. This is even more dangerous because the NRIC number is a permanent and irreplaceable identifier – machiam like your DNA.
So for those companies who already have NRIC details in their database, they gotta make sure that those data are well protected. And don’t say never give chance hor, companies have one year from now to find other ways of identifying their customers, if they don’t have legit reasons to take your NRIC number.
But this updated guidelines do not apply to the Government, or any public agencies acting on their behalf. Double standards ah?
So a clarification from the Smart Nation and Digital Government Office (SNDGO) said that because the Government is the issuing authority for the NRIC, and that it rightfully uses it to “discharge its functions and services with citizens in a secure manner”.
Fair enough la, where got ownself issue ownself, then restrict ownself right? In the first place, NRIC numbers are issued to every new Singaporean citizen in order to facilitate gahmen procedures and transactions.
But that doesn’t mean gahmen agencies can suka-suka collect NRIC numbers just because they are not affected by PDPC’s guidelines. SNDGO also said that the Government will also review its processes to ensure that public agencies limit the use of NRIC numbers, and the retention of physical NRICs. They will use NRIC numbers for transactions where such use is required by law or is necessary to accurately establish people’s identities.
Then what about policing those who heck this? How will PDPC ensure that companies comply with the new guidelines? And if these are just “guidelines” and not legislation, does it mean that companies that repeatedly breached the Act only pay the fine, but there are no levers to stop them from flouting the guidelines?
And how will the public be properly informed about their rights to not provide their NRIC numbers beyond the common scenarios? What about the lesser educated aunties and uncles, or elderly folks who are used to giving their IC numbers with little understanding of the risks?
So the next time someone asked for your NRIC for lame activities, like free parking redemption, shopping membership, submit feedback or participate in lucky draw, you can ask them to F*** off. But if you wanna buy cigarette, still must show IC hor.