NRIC numbers should not be used as passwords or for authentication: PDPC

NRIC numbers should not be used as passwords, Singapore's data privacy watchdog has reiterated.

- Shabana Begum

Organisations should also not use NRIC numbers to authenticate users' identities and must obey laws governing the use of NRIC data, said the Personal Data Protection Commission (PDPC).

"Like any personal identifier, the NRIC number is still subject to the data protection obligations in the Personal Data Protection Act," the commission added.

"Therefore, organisations collecting NRIC data must still obtain valid consent, and comply with reasonable use and ensure protection."

PDPC's remarks on Dec 14 came in response to the authorities' statement earlier in the day that the Government intends to move away from the practice of masking NRIC numbers.

The commission said it sought to emphasise its recommendations on how NRIC numbers should be treated, given the public attention drawn to the matter.

For one thing, NRIC numbers should not be used as passwords, "just as our names are not used as passwords", it said.

People who have done so should immediately change their passwords, PDPC added.

"If the change function cannot be found on the service portal, it is best to contact the service provider immediately for advice to change the password," it said.