1.0 Background
Singapore’s National Registration Identification Card (NRIC) number is a piece of personal data that can identify citizens and permanent residents of Singapore. It is often used for transactions with the Singapore government and some commercial organizations.
As the NRIC number is a permanent and irreplaceable identifier of an individual which can potentially be used to unlock large amounts of information relating to an individual, the collection, use and disclosure of an individual’s NRIC number is of special concern.
On 31 August 2018, Singapore’s Personal Data Protection Commission (‘PDPC’) issued Advisory Guidelines on the Personal Data Protection Act for NRIC and other National Identification Numbers (‘Guidelines’).
The PDPC will apply the interpretation of the Personal Data Protection Act (‘PDPA’) to these Guidelines from 1 September 2019.
2.0 New Requirements
2.1 Application of Guidelines
The Guidelines apply to the collection, use and disclosure of the following pieces of identification:
- NRIC numbers
- Copies of the actual NRIC
- Birth Certificate numbers
- Foreign Identification Numbers (‘FIN’)
- Work Permit numbers.
2.2 Application of Data Protection Provisions
Under the Guidelines, organisations are generally not allowed to collect, use or disclose NRIC numbers (or copies of NRIC) except in the following circumstances:
- It is required under a law or an exception under Personal Data Protection Act (‘PDPA’) applies; or
- It is necessary to accurately establish or verify the identities of individuals to a high degree of fidelity.
Under Singapore law, collection, use and disclosure of NRIC is required by law in the following circumstances:
- Seeking medical treatment at a general practitioner
- Checking into a hotel
- Subscribing to mobile telephone line
- Enrolling into a private education establishment
- New employee joining an organization
In the new employee example above, the Guidelines state that the application form for employment should not require the candidate to provide his NRIC number as there is no requirement under law to ask for NRIC numbers for the purpose of job applications. The NRIC number is required when the new employee actually commences employment with the organization.
Where the organization finds it necessary to establish or verify the identity of an individual to a high degree of fidelity, it may collect, use or disclose a person’s NRIC number with notification and consent.
In collecting the NRIC number (or copy of NRIC) organizations should be able to provide justification on request of the individual or the PDPC as to why the collection, use or disclosure of the NRIC number (or copy of the NRIC) is necessary to accurately establish or verify the identity of the individual to a high degree of fidelity.
Section 13 of the PDPA prohibits organisations from collecting, using or disclosing an individual’s personal data unless the individual gives, or is deemed to have given, his consent for the collection, use or disclosure of his personal data.
Section 14(1) of the PDPA indicates an individual has not given consent unless the individual has been notified of the purposes for which his personal data will be collected, used or disclosed and the individual has provided his consent for those purposes.
3.0 Implications for First Advantage clients
First Advantage has commenced reviewing our processes as these changes are likely to have an impact on how First Advantage completes background checks on Singapore residents.
We will keep our clients informed as we develop a response to this change of Guidelines.
4.0 Supporting documents
The following documents have been issued by PDPC:
- Advisory Guidelines on the Personal Data Protection Act for NRIC and other National Identification Numbers
- Technical Guide to Advisory Guidelines on the Personal Data Protection Act for NRIC and other National Identification Numbers
- Fact sheet for individuals
Other related guidelines include:
- Advisory Guidelines On The Personal Data Protection Act For Selected Topics – Employment (Chapter 5)
Information Content Notice:
The foregoing information is not offered as legal advice but is instead offered for informational purposes. First Advantage is not a law firm and does not offer legal advice. The foregoing information is therefore not intended as a substitute for the legal advice of an attorney knowledgeable of the user’s individual circumstances. First Advantage makes no assurances regarding the accuracy, completeness, currency or utility of the foregoing information. Legislative, regulatory and case law developments regularly impact on general research.
Current as at September 2018.
