Consumers not required to disclose NRIC numbers for purchases by September

It is to protect consumers from identity theft or fraud.

The Personal Data Protection Commission (PDPC) moves to enhance consumer protection by removing the requirement for consumers to disclose their National Registration Identity Card (NRIC) numbers as well as the retention of physical NRICs, an announcement revealed.

“The NRIC number is a permanent and irreplaceable identifier which can be used to unlock large amounts of information relating to an individual,” the commission noted.

The commission acknowledged that the digital economy increased the risks for illegal activities like identity theft or fraud when consumers disclose their NRIC numbers.

With this, they unveiled an updated advisory guidelines that do not allow organisations to collect, use, or disclose NRIC numbers or copies of the NRIC except under isolated circumstances. These include disclosures required by law or those that are necessary to accurately establish or verify an individual’s identity to a high degree of fidelity.

When the NRIC numbers or the NRIC cards are needed for permitted use or disclosure, the committee said that organisations must secure adequate protection measures to safeguard the personal data in their possession or under their control, in compliance with their obligations under the Personal Data Protection Act (PDPA).

They added that the same treatment goes for birth certificate numbers, foreign identification numbers and work permit numbers.

“Whilst passport numbers are periodically replaced, organisations should avoid collecting the full passport numbers of individuals unless justified,” the commission explained.