“Can I collect NRIC numbers of my volunteers?”
With the updated Personal Data Protection Act (PDPA) guidelines on NRIC collection, we’re here to answer some FAQs you may have.
Over the past few weeks, there has been a couple of major updates regarding the collection of NRICs by organisations. To help non-profits understand these changes, we have put together a couple of common questions that have been buzzing around the social sector!
1. Am I allowed to collect a volunteer’s NRIC number?
This will depend on the activity that your volunteer is engaged in. In general, you will have cause to collect NRIC under the following scenarios:
- When a volunteer will be interacting directly with high-risk beneficiaries, such as children and seniors.
- When your activity is conducted in a facility that requires volunteers to produce NRIC for prior clearance (eg Changi Prison).
- When the collection of NRIC is required by law for the activity you are running.
You should not be collecting NRIC of a volunteer if he/she is only engaged in the following capacity:
- Conducting talks, roadshows, or any other forms of volunteering that do not involve beneficiaries directly.
By and large, you must have a clear reason as to why you need to identify your volunteers to a high level of fidelity for the activity that they will be engaged in, and this reason should be stated clearly to the volunteers.
2. Can I get volunteers to produce their NRICs for identification purposes when they report for volunteering?
Suppose you have the name of a volunteer, but not their NRIC. That volunteer shows up for the first time, and you wish to ascertain that he/she is indeed the same person as indicated in your name list. You can definitely request the volunteer to produce a photo ID to verify his/her identity. Just make sure you do not keep a copy of any information on the ID that you do not have the right to collect, such as NRIC, driver license number etc.
TL;DR: you can get volunteers to cite their NRIC, but you cannot record it (unless you have permission to do so).
3. If I am allowed to collect NRIC for a project, can I do so through applications such as Giving.sg, the SG Cares portal, or bantu’s volunteering portal?
Yes you can. Sites such as www.bantu.life and www.giving.sg are known as data intermediaries. They allow you to collect information of volunteers when they sign up, and such information is also encrypted when hosted on the server.
It is the data intermediary’s responsibility to ensure that any data collected through the platform is sufficiently secured from malicious attacks, as well as accessible only by specified accounts within each non-profit.
This is why sharing administrator accounts is strongly discouraged, since two persons sharing the same account may have different rights to view the same piece of information.
It is your responsibility as a non-profit to:
- (1) ensure that you have the right to record volunteers’ NRIC for a project,
- (2) inform volunteers of the reason(s) why you are doing so, and
- (3) control and track which of your staff is given access to the volunteer’s information.
If there are some projects in your non-profit that requires NRIC while others do not, you should revise your project sign-up process.
4. Where can I go to find out more about how PDPA applies to non-profits?
You’re in luck! The Personal Data Protection Commission is offer non-profits (like yourselves) DP Advisory session for FREE. Find out more at the link here!
Besides that, there are plenty of resources on the PDPC website which you can access. Here are some useful links below:
Specific guidelines for the Social Sector
Infographics on the updated guidelines
Template notice on the collection of NRIC numbers and phase-out period
Full updated guidelines regarding NRIC collection (31 Aug 2018)
News report on updated guidelines regarding NRICs
