Singapore – Ban on Using Identity Numbers as a Proof of Identity or Password

In Singapore, all citizens and permanent residents are issued with a National Identity Registration Card (NRIC) – this is in addition to the Singapore passport held by citizens and the foreign passport held by permanent residents.

The Personal Data Protection Commission of Singapore (PDPC) and the Cyber Security Agency (CSA) recently issued a joint advisory against using NRIC numbers for authentication purposes.  (An advisory is not legally enforceable, but is likely to be used as evidence of expected best practice in a regulatory dispute and/or in formal legal action.)

In particular, the PDPC said that NRIC numbers are issued to uniquely identify a person, which can be useful when organisations need to be sure they have the right customer, such as at banks, telcos, and clinics. However, this means that NRIC numbers may have been disclosed to others in the process. This is why organisations should not use NRIC numbers as default passwords or allow their customers to cite NRIC numbers to prove that they are who they claim to be (i.e. to perform authentication).  Instead, organisations must be aware that a person may not be who they claim to be just because they are able to state their NRIC number. Further security measures should be taken to authenticate the person before allowing access to information or services intended for them alone.

Options to authenticate a person include:

Something only the person knows (e.g. strong passwords)
Something only the person owns (e.g. security token, smart card)
Something only the person has (e.g. fingerprint, face, iris, palm vein)