Authorities say this will better protects citizens from impersonation and having their personal data accessed by others
[SINGAPORE] The Personal Data Protection Commission (PDPC) and Cyber Security Agency (CSA) on Thursday (Jun 26) advised private organisations to stop using full or partial national registration identity card (NRIC) numbers for authentication.
Authentication is the process of proving that a person is who he claims to be before granting him access to services or information intended solely for him, the PDPC and CSA said in a joint advisory posted on their websites.
“NRIC numbers should not be used to prove that a person is who he claims to be for the purposes of trying to gain access to services or information meant only for that person,” the Ministry of Digital Development and Information (MDDI) said in a statement on the same day.
Companies that do use NRIC numbers for such purposes should “transition away from (the) practice as soon as possible”, the ministry said.
This includes not setting NRIC numbers as default passwords and not using full or partial NRIC numbers with other easily obtainable personal data – such as by using passwords that combine parts of a person’s NRIC number with his date of birth.
The ministry noted that some private sector organisations currently require individuals to use their NRICs as passwords to access information intended solely for them, such as insurance documents.
This practice is unsafe as a person’s NRIC number may be known to others such that using it for authentication would permit anyone who knows the person’s NRIC number to impersonate him and easily access his personal data or records, the MDDI said.
“If it is necessary to authenticate a person, organisations should consider alternative methods, for example requiring the person to use strong passwords, a security token or fingerprint identification,” the MDDI statement said.
This comes on the back of government efforts, since January, to ensure the proper use of NRIC numbers in the private sector to better protect citizens, MDDI said.
Copyright SPH Media. All rights reserved.
