Use of NRICs in Applications for Phone and Telecommunication Services and Measures to Safeguard Consumers' Personal Data

Debated in Parliament on 5 Oct 2021.

Summary written by AI (learn more)

Mr Gan Thiam Poh raised concerns about the use of NRICs in telecommunication services, asking about measures to protect user data, the possibility of using alternative IDs like driver’s licenses, and imposing penalties for data breaches.
Mrs Josephine Teo explained that telcos are required to collect NRIC or other IDs for identity verification to combat fraud, and that organizations must implement safeguards like encryption and access controls under PDPA guidelines.
She noted that PDPA has been strengthened with enforcement powers, breach notification requirements, and rights for civil action, and that Myinfo is being promoted to reduce reliance on physical documents.

Questions identified by AI (learn more)

Full Transcript

Gan Thiam Poh

Mr Gan Thiam Poh asked the Minister for Communications and Information regarding the use of NRICs in applications for telecommunication access (a) what measures are in place to increase protection of users' information obtained by telecommunication providers; (b) whether the Ministry will consider allowing other forms of identification, such as driver licences, which have less personal information; and (c) whether the Ministry will consider imposing penalties and compensation to users based on the severity of breaches.

Mrs Josephine Teo

The Info-communications Media Development Authority (IMDA) requires telecommunication licensees (telcos) to maintain accurate records of the identity of their subscribers, including a copy of their NRIC, passport or employment pass. This requirement is not unique to Singapore, nor to the telcos. As is the case for telcos in other countries, or sectors like banking and healthcare, it is necessary to have accurate information on customer identity to help combat fraud and crimes.

Organisations that maintain personal records, including NRIC information, are expected to implement the necessary safeguards for their IT systems and put in place processes for internal monitoring. Where personal data, such as NRIC numbers, is stored alongside sensitive data, more stringent security measures should be put in place. Some examples of such measures include encryption, access-logging and multi-factor authentication for systems. The Personal Data Protection Commission (PDPC) has issued guidance on the stringent security measures required in its Guide to Data Protection Practices for ICT Systems. The PDPC has meted out higher financial penalties to organisations found with inadequate safeguards to protect sensitive personal data.

The Personal Data Protection Act (PDPA) was amended last year to strengthen enforcement powers and introduce additional safeguards which organisations must comply with. This includes informing affected individuals of a data breach so they can take timely steps to protect themselves. As organisations have a responsibility to their customers to ensure proper service recovery, the PDPC has recommended that organisations put in place breach management plans. Affected individuals also have the right of private action for relief in civil proceedings under the PDPA.

In instances where the collection of residents’ personal particulars is required, one option the Government has implemented is Myinfo. This allows residents to consent to sharing Government-verified information securely and seamlessly, removing the need for physical documents. We are working with telcos to facilitate the use of Myinfo.

Summary written by AI (learn more)

Mr Gan Thiam Poh raised concerns about the use of NRICs in telecommunication services, asking about measures to protect user data, the possibility of using alternative IDs like driver’s licenses, and imposing penalties for data breaches.
Mrs Josephine Teo explained that telcos are required to collect NRIC or other IDs for identity verification to combat fraud, and that organizations must implement safeguards like encryption and access controls under PDPA guidelines.
She noted that PDPA has been strengthened with enforcement powers, breach notification requirements, and rights for civil action, and that Myinfo is being promoted to reduce reliance on physical documents.

Questions identified by AI (learn more)

Use of NRICs in Applications for Phone and Telecommunication Services and Measures to Safeguard Consumers' Personal Data | PAPERCUTS

Use of NRICs in Applications for Phone and Telecommunication Services and Measures to Safeguard Consumers' Personal Data

Debated in Parliament on 5 Oct 2021.

Summary written by AI (learn more)

Mr Gan Thiam Poh raised concerns about the use of NRICs in telecommunication services, asking about measures to protect user data, the possibility of using alternative IDs like driver’s licenses, and imposing penalties for data breaches.
Mrs Josephine Teo explained that telcos are required to collect NRIC or other IDs for identity verification to combat fraud, and that organizations must implement safeguards like encryption and access controls under PDPA guidelines.
She noted that PDPA has been strengthened with enforcement powers, breach notification requirements, and rights for civil action, and that Myinfo is being promoted to reduce reliance on physical documents.

Questions identified by AI (learn more)

Full Transcript

Gan Thiam Poh

Mrs Josephine Teo

Summary written by AI (learn more)

Mr Gan Thiam Poh raised concerns about the use of NRICs in telecommunication services, asking about measures to protect user data, the possibility of using alternative IDs like driver’s licenses, and imposing penalties for data breaches.
Mrs Josephine Teo explained that telcos are required to collect NRIC or other IDs for identity verification to combat fraud, and that organizations must implement safeguards like encryption and access controls under PDPA guidelines.
She noted that PDPA has been strengthened with enforcement powers, breach notification requirements, and rights for civil action, and that Myinfo is being promoted to reduce reliance on physical documents.

Questions identified by AI (learn more)

Use of NRICs in Applications for Phone and Telecommunication Services and Measures to Safeguard Consumers' Personal Data

Summary

Questions Identified

Full Transcript

Gan Thiam Poh

Mrs Josephine Teo

Summary

Questions Identified

Use of NRICs in Applications for Phone and Telecommunication Services and Measures to Safeguard Consumers' Personal Data

Summary

Questions Identified

Full Transcript

Gan Thiam Poh

Mrs Josephine Teo

Summary

Questions Identified