Does your Company collect or use NRIC numbers?


If your Company collect, use or disclose personal identification numbers such as NRIC numbers, passport numbers, birth certificate numbers, work permit numbers or foreign identification numbers (collectively referred to as “National IDs“) in the course of your business, your Company is likely required to cease this practice with effect from 1 September 2019.

WHAT IS THE IMPACT ON YOUR COMPANY?

Under the advisory guidelines issued by Personal Data Protection Commission, even if your Company has obtained expressed consent from relevant individuals, it is generally not allowed to collect, use or disclose National IDs.

You should also note that your Company should also generally avoid retaining an individual’s physical National ID unless the retention of the physical National ID is required under the law. For purpose of verification, your Company may merely have sight of an individual’s physical National ID and its information in certain situations.

WHAT IF YOU DO NOT COMPLY?

Your Company may be directed by Personal Data Protection Commission (“PDPC“) to do all or any of the following: –

  • – stop collecting, using or disclosing personal data which contravenes the Personal Data Protection Act (“PDPA“);
  • – destroy personal data collected which contravenes the PDPA;
  • – comply with any direction of the PDPC;
  • – pay a financial penalty of such amount not exceeding $1 million as the PDPC thinks fit.

ARE THERE EXCEPTIONS?

Your Company may only ask for National ID numbers under the following specified situations:

It is required under the law to collect, use and/or disclose National ID.

If your Company is required under the law to collect, use and/or disclose National IDs despite without the individual’s consent, your Company should still notify individuals on the purpose for collection, use or disclosure, as the case may be for good practice.

It is necessary to accurately establish or verify the identity of the individual to a high degree of fidelity.

This refers to situations where failure to accurately establish or verify the identity of the individual will result in: (i) significant safety or security risk; or (ii) significant impact or harm (e.g. reputational, financial, personal or proprietary damage) to an individual and/or organisation.

It is noted that your Company should obtain consent of the individual to collect, use or disclose his/her National ID for the stated purpose.

ACTIONS REQUIRED

You will need to review your Company’s current procedures and processes which involve the collection, use and/or disclosure of National IDs and assess if such collection, use and/or disclosure may continue in view of the aforesaid exceptions.

Remember, facilitating convenience or record keeping do not necessarily fall within the aforesaid exceptions. Hence, your Company might need to consider alternative identifiers in place of National IDs e.g. mobile number, user-generated ID, tracking number, QR code or monetary deposit.


Leave a comment


Please note, comments must be approved before they are published


Related Posts

Closure of Bank Account - Three Key Points
Closure of Bank Account - Three Key Points
There are many reasons why a Company wants to close its corporate bank account(s). Some of the reasons are set out be...
Read More
Change of Name of Companies Act
Change of Name of Companies Act
With effect from 31 December 2021, Singapore legislation has new names. The main objective is to modernise and simpli...
Read More
Typical Share Structures used in Singapore
Typical Share Structures used in Singapore
Most Singapore companies are incorporated with just one class of ordinary shares, with equal rights to voting, divide...
Read More