SINGAPORE - It will soon be unlawful for mall operators to collect and use shoppers' NRIC numbers to track parking redemptions, manage their membership accounts and conduct lucky draws under proposed new rules.
The revised privacy rules will also prohibit cinema operators from collecting NRIC numbers from customers who buy movie tickets online. Rental firms also cannot keep customers' physical NRIC as collateral for rented equipment such as a bicycle.
The Personal Data Protection Commission bars these acts in a revised advisory that aims to interpret Singapore's Personal Data Protection Act.
The Act, which came fully into force in July 2014, prevents the indiscriminate collection of consumers' personal data and requires organisations to be accountable for the data.
In a public consultation paper issued on Tuesday (Nov 7), the privacy watchdog said: "The indiscriminate collection and use of individuals' NRIC numbers is of special concern as it increases the risk that the NRIC numbers may be obtained and used for illegal activities such as identity theft and fraud."
Such risks arise as the NRIC number is a permanent and irreplaceable identifier, which can be used to unlock large amounts of personal information, including income, residential address and medical health.
The commission decided to tighten the rules that govern NRIC use following feedback from the public, and is now asking the public to comment on its revisions.
The privacy watchdog also aims to address concerns surrounding service providers' requests to obtain a copy of people's NRIC as it contains other sensitive data such as name, photograph, thumbprint and residential address.
The consultation will end on Dec 18. Organisations will have up to 12 months from the release of the new advisory, expected to be in mid-2018, to change their business practice.
Some mall operators scan the NRIC barcode for lucky draws and membership account management. Instead of doing this, mall operators are advised to collect shoppers' name, e-mail address or mobile phone number. Similarly, there are other identifiers such as shoppers' vehicle numbers for tracking parking redemption.
The commission also advised cinema operators to issue a unique booking reference number or an SMS confirmation to online movie ticket buyers, instead of recording their NRIC number.
Bicycle rental firms, on the other hand, can collect a monetary deposit as collateral instead of holding people's NRIC card.
The NRIC can be collected without consumers' consent only when it is required under the law. These instances include people seeking medical treatment in hospitals and clinics, enrolling children in a childcare centre, checking into a hotel and subscribing to a mobile phone line.
Consumers' consent is also not required in an emergency situation, such as hospital admission, and for entry into secured buildings.
