If new rules proposed yesterday kick in, it will become unlawful for mall operators and retailers to collect and use shoppers' NRIC numbers to track parking redemptions, manage their membership accounts or conduct lucky draws.
Consumers may win the right to refuse to hand over their NRIC details or card, and the onus will be on service providers to use alternative methods such as mobile phone numbers, vehicle numbers or e-mail addresses to identify them.
Similarly, building owners will also be barred from retaining people's NRICs in exchange for visitor badges.
The Personal Data Protection Commission outlined these new proposed rules in a public consultation released yesterday.
"The indiscriminate collection and use of individuals' NRIC numbers is of special concern as it increases the risk that the NRIC numbers may be obtained and used for illegal activities such as identity theft and fraud," the privacy watchdog said in the consultation document.
Such risks arise as the NRIC number is a permanent and irreplaceable identifier, which can be used to unlock vast amounts of personal information, including income details, residential address and medical status.
Singapore's Personal Data Protection Act, which went fully into force in July 2014, prohibits the indiscriminate collection of consumers' personal data, and requires organisations to account for the use of the data.
-
Keeping NRIC data private
-
The Personal Data Protection Commission said that NRIC details should be collected only where the law requires it, or when it is necessary to verify someone's identity "to a high degree of fidelity", under the proposed rules.
It currently allows and continues to allow NRIC use without consumers' consent for:
• Seeking medical treatment in hospitals and clinics.
• Enrolling children in childcare centres.
• Checking into a hotel.
• Subscribing to a mobile phone line.
• Emergencies where medical workers need to ascertain the blood type or allergies of a patient.
• Entry into secured buildings such as medical facilities.
But it wants consumers to have the right to refuse to hand over their NRIC details or card when:
• Redeeming free parking from mall operators.
• Entering lucky draws.
• Registering for mall or shop membership.
• Buying online movie tickets.
• Renting bicycles.
Irene Tham
But the current rules governing NRIC use do not mandate that service providers provide alternative methods to identify consumers. The rules are now being tightened following initial public feedback.
Some consumers have wondered if service providers are over-collecting their data by scanning their NRIC barcode for all sorts of things, from lucky draws to membership account management.
The commission said that NRIC details should be collected only where the law requires it, such as when one subscribes to a mobile phone line. There are also occasions when it is necessary to verify someone's identity "to a high degree of fidelity" - such as during emergencies, when medical workers need to ascertain blood types or allergies, or for entry into secured medical facilities.
The public consultation will also address scenarios that would require a copy of an NRIC - which contains sensitive data such as name, photograph, thumbprint and home address.
The consultation will end on Dec 18.
Organisations will have up to 12 months from the release of the new advisory on NRIC use, expected to be in mid-2018, to change their business practice.
Consumers appeared to favour a change of rules. Manager C.J. Oh, 44, said supermarket FairPrice scanned his NRIC barcode when he used the NS50 vouchers to pay for goods. "Can't FairPrice check my NRIC name against the name on the voucher?" he asked.
A FairPrice spokesman said its practices comply with current rules, but the supermarket "will continue to work with the relevant authorities to ensure that all the new regulations are adhered to".
Lawyer Gilbert Leong, senior partner at Dentons Rodyk & Davidson, said care must also be taken to protect the use of one's cellphone number. "The mobile number is increasingly becoming a part of one's digital identity; one-time passwords are sent and payments can be made to one's mobile phone," he said.
