Collecting IC numbers may be outlawed
Privacy watchdog raises awareness about risk of identity theft and fraud
If the new rules proposed yesterday kick in, it will become unlawful for mall operators and retailers to collect and use shoppers' identity card (IC) numbers to track parking redemptions, manage their membership accounts and conduct lucky draws.
Consumers may win the right to refuse handing over their IC, and the onus will be on service providers to use alternative data such as mobile numbers, vehicle numbers or e-mail addresses to identify them.
Similarly, building owners will also be barred from retaining people's IC in exchange for visitor badges.
The Personal Data Protection Commission outlined these new proposed rules in a public consultation released yesterday.
"The indiscriminate collection and use of individuals' IC numbers is of special concern, as it increases the risk that the IC numbers may be obtained and used for illegal activities such as identity theft and fraud," the privacy watchdog said.
Such risks arise as the IC number is a permanent and irreplaceable identifier, which can be used to unlock vast amounts of personal information.
Singapore's Personal Data Protection Act, which came fully into force in July 2014, prohibits the indiscriminate collection of consumers' personal data and requires organisations to account for the use of the data.
But the current rules governing IC use do not mandate that service providers provide alternative methods to identify consumers.
The rules are now being tightened following initial public feedback. Some consumers have wondered if service providers are over-collecting their data by scanning their IC barcode for all sorts of things from lucky draw to membership account management.
The Commission said IC details should be collected only where the law requires it, such as when one subscribes to a mobile line.
There are also occasions when it is necessary to verify someone's identity "to a high degree of fidelity" - such as emergencies when medical workers need to ascertain blood types or allergies.
The public consultation will also address scenarios that would require a copy of an IC. It will end on Dec 18.
Organisations will have up to 12 months from the release of the new advisory on IC use, expected to be in the middle of next year, to change their business practice.
Consumers appeared to favour a change of rules.
Manager C.J. Oh, 44, said supermarket FairPrice scanned his IC barcode when he used the NS50 vouchers.
He asked: "Can't FairPrice check my IC name against the name on the voucher?"
A FairPrice spokesman said its practices comply with current rules, but the supermarket "will continue to work with the relevant authorities to ensure that all the new regulations are adhered to".
Lawyer Gilbert Leong, senior partner at Dentons Rodyk & Davidson, said care must also be taken to protect the use of one's mobile number.
"The mobile number is increasingly becoming a part of one's digital identity; one-time passwords are sent and payments can be made to one's mobile phone," he said.
FOR MORE, READ THE STRAITS TIMES TODAY
Get The New Paper on your phone with the free TNP app. Download from the Apple App Store or Google Play Store now