Malls will not be allowed to collect NRIC numbers to issue free parking vouchers or register customers for lucky draws and memberships, among other things, under stricter rules proposed to address the risk of misuse that could lead to identity theft and fraud.
The Personal Data Protection Commission wants to bar these common practices, saying NRIC details should only be collected where it is necessary to accurately establish and verify the identity of the individual. Examples of such scenarios include the signing of high value contracts like property transactions, or applications for healthcare or travel insurance to prevent fraudulent claims.
The PDPC’s move to tweak guidelines on the use of NRIC numbers arose from feedback from the public, and it targets to implement the changes in the middle of next year, although it intends to give a one-year grace period to make the necessary tweaks to their processes. The public is invited to weigh in on the proposed changes from Tuesday (Nov 7) until Dec 18.
As part of the revisions it wants to make to the guidelines under the Personal Data Protection Act, the PDPC suggested alternative ways commercial entities could verify identities.
For instance, instead of asking for NRIC numbers when customers book movie tickets online, cinemas can send an SMS or issue a booking reference number. A store signing up shoppers for memberships or lucky draws can use other identifiers such as email addresses.
The proposed revisions also addressed the collection of individuals’ physical identity cards as a form of collateral in exchange for rented items. For instance, when an individual wants to rent a bicycle, he should not have to hand over his NRIC as collateral. Instead, some other collateral like a monetary deposit should be used.