From Sept. 1, 2019, Singaporeans can refuse to disclose their National Registration Identity Card (NRIC) numbers.

This is part of updated guidelines to improve consumer protection.

And it stems from a greater awareness of privacy issues that has led to the tightening of rules since 2017.

NRIC usage come Sept. 1, 2019

Under new guidelines issued by the Personal Data Protection Commission (PDPC), organisations will not be allowed to collect, use and disclose NRIC numbers.

They are also not allowed to make copies of or retain the physical cards.

They can only do so when it is required by law, or when the inability to accurately identify an individual could cause significant harm to themselves or other individuals.

These new guidelines, however, do not apply to the public sector or critical infrastructure buildings.

Transitioning phase

This period before Sept. 1, 2019 is the transitioning phase.

The PDPC has issued a technical guide as well as a list of pre-approved solutions that organisations can consider adopting.

Some ways include a QR code system, unique IDs assigned to new users, or tracking numbers.

Organisations that fail to abide by the new guidelines by Sept. 1, 2019 will be considered to have breached the Personal Data Protection Act and may be subjected to penalties as laid out in the Act.

The fine could be up to S$1 million.

Situations where consumers can opt not to disclose NRIC numbers

• Redeeming free parking from mall operators.

• Entering lucky draws.

• Registering for mall or shop membership.

• Buying online movie tickets.

• Renting bicycles.

Situations where NRIC can be used without consumers’ consent for

• Seeking medical treatment in hospitals and clinics.

• Enrolling children in childcare centres.

• Checking into a hotel.

• Subscribing to a mobile phone line.

• Emergencies where medical workers need to ascertain the blood type or allergies of a patient.

• Entry into secured buildings such as medical facilities.

Why this matters

NRIC numbers are permanent and irreplaceable identifiers.

Indiscriminate collection or negligent handling of the information can increase the risk of unintended disclosure and may result in illegal activities such as identity theft or fraud.

In addition, the move to digitise records has increased these risks.

Other identifiers such as Birth Certificate numbers, Foreign Identification Numbers and Work Permit numbers are subjected to the same guidelines as NRIC numbers.

The PDPC urged organisations to accord passports with similar treatment as NRICs even as passport numbers are periodically replaced.

For cases where alternative identifiers may not be available, such as participating in a lucky draw or entering the premises of a private condominium, they may have to provide their partial NRIC number -- up to the last three numerical digits and checksum.

Disposal of NRIC details

For organisations that have already collected NRIC numbers, they are encouraged to assess if they need to retain these numbers.

If not, they should dispose of them responsibly and in compliance with Personal Data Protection Act (PDPA) disposal methods.