When is it OK to Share Your NRIC Details?

As of 1 September, organisations cannot collect, use or disclose your NRIC number. But there are, of course, exceptions and exemptions…
By Fawwaz Baktee 02 Sep 2019
iStock-1016968886_900.jpg

If you have tried logging in to your U Portal account, you would have realised that you can’t use your NRIC number to do it anymore.

In case you’re wondering why, here’s something you should know.

With effect from 1 September 2019, organisations cannot collect, disclose or use our NRIC number. They are also not allowed to make copies of our NRIC or retain our physical NRIC and national IDs such as passports, birth certificates, foreign ID, work pass and driver’s license. 

This is all done in the name of data protection.

All organisations must make changes to comply with this new guideline before the start date or face a hefty fine of $1 million for non-compliance.

Where Collection of Personal Data is Unacceptable

When you’re redeeming free parking, purchasing movie tickets online, signing up for loyalty membership, entering a lucky draw, submitting feedback, renting bicycles, or entering buildings, you do not have to produce your NRIC.

If these organisations tell you that they have always collected NRIC and their entire systems have been built on using NRIC as identifiers, remind them of this new rule. And remind them of the fine for non-compliance.

Of course, there are exceptions and exemptions under the law.

What Are the Exceptions?

There are two exceptions to this new rule.

Firstly, you still need to produce your NRIC or a form of ID when it is required by law. Some examples when you need to identify yourself under the law is when you’re seeking medical treatment, checking into a hotel, subscribing to a telephone line, having a massage in a massage establishment, enrolling yourself into a private education institution, or when you’re getting employed

Secondly, the new rule doesn’t apply if an organisation needs to accurately establish or verify your identity to a high degree of accuracy. And if this is not done, it might pose a risk or harm such as fraudulent financial transactions.

Using Personal Data

Based on specific requirements, an organisation can collect, use or disclose your personal data without getting your permission.

Such instances would include in an emergency such as paramedics collecting your NRIC number if you’re unconscious and can’t give permission; if the situation is of national interest such as contact tracing during pandemics, epidemics, and outbreaks; if it is to recover debt; and business asset transactions.

Guideline for Unions

Something to keep in mind – NTUC and unions can collect an individual’s NRIC when he or she joins as a member. This is for the purpose of insurance and subsidies.

If you remember, one of the exceptions is if it’s necessary to accurately establish or verify the identity of the individual to a high degree of fidelity. Insurance coverage falls under this as well.

For existing members, your union will not need to re-obtain consent from you.

However, if NTUC and the unions collect, use or disclose your information, they must reasonably inform you and provide justification.

You also don’t need you to change your existing membership card. But new cards issued after 1 September will be printed without the NRIC.