Stricter data privacy rules set for handling of ID numbers

IMPACT – MEDIUM

What is the change? Singapore will introduce enhanced privacy regulations aimed at prohibiting businesses from collecting, copying or disclosing personal ID numbers—including National Registration Identity Cards (NRIC) numbers, Foreign Identification Numbers (FIN) and work permit numbers—unless required by law.

What does the change mean? Businesses face fines of up to 1 million Singapore dollars (about US$732,000) for violating the laws on personal data protection.

• Implementation time frame: The new rules take effect starting Sept. 1, 2019.
• Visas/permits affected: National ID numbers, such as NRIC numbers, FINs, work permit numbers, passport numbers and birth certificate numbers.
• Business impact: Businesses should prepare for new compliance rules governing their use, collection and copying of personal ID numbers. Authorities are encouraging employers and other organizations to explore the use of other identifiers, such as user-generated IDs, tracking numbers or QR codes issued by the organization.
• Next steps: The Personal Data Protection Commission will work with the Infocomm Media Development Authority to publish a technical guide on how organizations may replace NRIC/FIN numbers with alternative identifiers. Employers and other organizations should anticipate that they may need to amend their policies and practices regarding using, collecting, copying or disclosing ID numbers, as well as the disposal of numbers they have collected. Collecting and retaining an individual’s physical NRIC card will also be prohibited.

Background: The NRIC contains a permanent ID number issued to Singapore citizens and permanent residents, and FIN are issued to foreign workers. These numbers can be used to track personal information including home address, salary, medical details and property ownership. NRIC numbers are commonly requested for routine activities such as signing up for memberships, purchasing and renting items, and entering buildings.

Analysis & Comments: The new rules are intended to protect individuals against identity theft and fraud. Businesses that routinely collect personal ID numbers for purposes other than those required by law should develop policies for requesting and collecting alternative personal identifiers by the compliance deadline of Sept. 1, 2019.

Source: Deloitte LLP. Deloitte LLP is a limited liability partnership registered in England and Wales with registered number OC303675 and its registered office at 1 New Street Square, London EC4A 3HQ, United Kingdom.