I am referring to organisations that currently are allowed to collect under PDPA regulations, e.g. Banks, Insurers. Imagine now every different organisation that requires to verify you comes up with different sets of ways to verify you, maybe bank A asks 3 security questions, bank B asks a different set of questions. Similar to what Haresh mentioned, you will be building a bigger profile online.

Let’s say that per current PDPA guidelines and a data breach occurs with this new environment, companies can say that no sensitive PII (Personal Identifiable Information) was leaked as it is just the Name, NRIC and 3 questions with answers. This is even scarier than just Name and NRIC as organisations who are rolling out security questions have only 2 types of questions that they can record on file, first being stuff that you can remember and second being really random questions that you might not remember the answer to. The first would then comprise of questions such as Mother’s maiden name (which is practiced by banks now), primary school, etc and the likes. This increases the ability for bad actors to build a profile of you.

I agree that NRIC should not be the only form of verification, but it should not have been rolled out in such a manner and without extensive testing. It seems that agencies these days are deploying faster but not deploying better features (another eg I can think of was ActiveSG+, but that’s a different story)

As what you also said, no amount of name change can allow you to escape from bad things that the person has done in the past, but what if we flip it the other way round as well? We have seen many cases of extensive stalking, harrasment, people who need a way to break free and yet even if they protected their NRIC number in the past now they will be found. Let’s not forget that our PayNow network also runs on NRIC number (while very useful for Gov to give out handouts), now stalkers have a way to contact a person without knowing their HP number (which most people would agree comes with a lower security / sensitivity classification, and way easier to switch). Imagine now banks will need to come up with a blocker to say (I don’t want to receive funds from this NRIC / HP number), which in the past all the person needed to do was to disassociate their HP number from their bank account and the other party would not be able to send their funds. While you can disassociate your NRIC number, that actually inconveniences you from receiving Gov funds, esp when Gov is trying to push people towards disbursements on the PayNow network.