To Collect ID or Not to Collect, That is the Question….
This post provides an update on the Advisory Guidelines on Singapore's PDPA, which were enacted on September 1, 2019, regarding the collection, use, and disclosure of Singapore National Registration Identity Cards (NRICs).
From 1 September 2019, organisations will be required to adhere to the Advisory Guidelines (“Guidelines”) on the Personal Data Protection Act of Singapore (“PDPA”), which includes provisions on the collection, use and disclosure of the Singapore National Registration Identity Card (“NRIC”). The question is, will this impact the collection and processing of the NRIC when you conduct an ID check as part of your pre-employment screening programme?
What type of documentation do the Guidelines cover?
The Guidelines set out that the following types of identification documentation/numbers are caught by the Guidelines:
Work permit numbers
Foreign ID numbers
Birth certificate numbers (not relevant to screening)
All the above types of identification/documentation are unique to an individual and as such any misuse of those numbers could have a significant impact on an individual. The Guidelines set out to make it clear when such identification/documentation can be collected and processed.
What do the Guidelines say?
The Guidelines state that organisations are not generally allowed to collect, use, or disclose NRIC numbers (or copies of NRIC numbers) unless certain circumstances apply:
The collection of NRIC numbers is required by law (“Exception 1”)
The collection of NRIC numbers is necessary to accurately establish or verify the identities of individuals with a high degree of certainty (“Exception 2”)
An exception to consent under the PDPA applies (“Exception 3”)
The NRIC numbers should also be deleted once there is no further need to process.
What does this mean in reality?
When conducting pre-employment screening checks any of the above exceptions could apply:
Certain checks within a screening programme can require an NRIC number to be disclosed prior to those checks being undertaken. By way of example, if you had a UK expat candidate, and as part of your programme you conducted criminal record checks, it would be mandatory to disclose the National ID number of that candidate to the Disclosure & Baring Service.
If you screen later in the recruitment cycle i.e. once the candidate is employed, then section 95 of the Employment Act (“EA”) requires you as an employer to maintain certain employee records, which includes an NRIC number.
NRIC numbers can be collected and processed where doing so would ensure that the individual would not be caused harm i.e. a lack of accuracy leading to false positives in background checking. Therefore, where a screening programme includes more sensitive information, such as credit and criminal checks, the collection and processing of NRIC numbers is used to ensure greater accuracy.
An employer whose candidates are in positions of control and responsibility OR who conduct roles in a regulated industry OR work with children or vulnerable adults are required to ensure that they have accurately established the identity of that individual as to fail to do so could pose significant impact or harm.
Under the PDPA employers are permitted to collect and process personal data for “evaluative purposes” (as defined under section 2(1) of the PDPA), i.e. for the purpose of determining the suitability, eligibility or qualifications of the individual to whom the data relates:
for employment or for appointment to office; or
for promotion in employment or office or for continuance in employment or office
when collecting personal data for an “evaluative purpose” consent of that individual is not required.
Therefore, when collecting NRIC numbers as part of the pre-employment screening program to determine the suitability and/or eligibility of a candidate for employment that collection will fall under Exception 3.
What do I need to do – is there any impact on my screening programme?
With any new legislation it is recommended that programmes be reviewed. The key items to consider are:
The drafting of any authorisation and disclosure forms: it may be worth reviewing and revising authorisation and disclosure forms to note that pre-employment screening is undertaken for “evaluative” purposes so that Exception 3 applies.
The type of employee you are screening: Exception 1.
The nature of the type of checks that are being undertaken: Exception 1 and/or 2.
The timing of your screening programme: once an employee: if screening takes place once an individual is employed then Exception 1 will apply.
The retention period on your Singapore screening accounts: once a reasonable period has elapsed (for example to allow for reworks) then it may be advisable to set a purge date.
Keeping a record of the steps and considerations above, including any rationale behind the inclusion of conducting an ID check or using NRIC numbers in the screening programme.
By utilising any one or more of the above steps, an employer can demonstrate compliance with the Guidelines.
Whilst on the face of it the Guidelines would appear to prohibit the use of NRIC numbers in pre-employment screening, the reality is different. For all programmes Exception 3 will apply and NRIC numbers may be collected and processed. It appears therefore that the impact of the Guideline is minimal in respect to pre-employment screening programmes.
Release Date: October 28, 2019
Caroline is a UK qualified lawyer with over 18 years’ experience and currently serves as HireRight’s Deputy General Counsel for the EMEA and APAC regions. When not “lawyering” or writing blogs, Caroline can be found striking yoga poses in remote locations such as Mongolia and Bhutan.