National Registration (Amendment) Bill – Wrap Up Speech by Mr Desmond Lee, Senior Minister of State for Home Affairs

Mdm Speaker, members have asked questions broadly on the four areas that I have covered earlier:

• collection of iris images;

• how data that ICA collects will be safeguarded;

• appointment of non-ICA employees as registration officers; and

• the powers to refuse the registration of certain types of names.

Collection of iris images

2.    Let me start first with the collection of iris images.

3.    Mr Melvin Yong asked how and when iris scan technology will be implemented at the checkpoints, and how this will affect the efficiency of the checkpoint clearance process. He also asked if iris scans will eventually replace current fingerprint verification.

4.    Madam, ICA plans to introduce iris scan technology progressively at our land, air and sea checkpoints within the next two years.

• This will complement the current fingerprint matching process at immigration clearance, and give ICA another way to verify a traveller's identity. This will enhance border security.

• Travellers using the automatic clearance lanes who find that their fingerprints cannot be matched, can also use iris scans, instead of being re-directed to manned counters.

• So more Singapore Citizens (SCs) and Permanent Residents (PRs) will therefore enjoy automated clearance at our checkpoints, with the reduced need to be diverted to manned counters.

• This will improve the overall efficiency and effectiveness of the immigration clearance process.

5.    Mr Louis Ng asked about whether iris scanners can detect stress through the movement of the eyeballs, to bolster border security.

6.    While potentially useful, our sense is that this technology does not appear mature at present. But we will continue to look at all these methodologies and make decisions as they mature over time.

7.    The collection and verification of iris images is very safe and will not harm our eyes.  The process is similar to taking a photograph - convenient, contactless, non-intrusive, and it can be done in a matter of seconds.

8.    Mr Alex Yam asked whether existing NRIC holders will be required to enrol their iris images, and when ICA intends to begin doing so. Mr Yong wanted to know if this process can be made convenient for the public and Mr Leon Perera asked whether iris enrolment can be done outside of the three phases of NRIC registration, re-registration and passport application and renewal.

9.    Madam, ICA intends to start collecting iris images from Singapore Citizens and Permanent Residents from next year.

• To make it convenient for people, ICA will do this as part of ICA's existing interactions with the public.

• And these include compulsory NRIC registration and re-registration – there are currently two phases, one at age 15 and one at age 30 – as well as during passport application and renewal.

• ICA will enrol an individual's iris images when he collects his new NRIC or passport.

• There is therefore no need to make a separate trip to ICA Building just to have your iris images collected. So we build it into an existing process, and we collect it as and when people make use of ICA's existing services.

10. Mr Melvin Yong asked about how we will help people with disability or serious illness. The ICA Home Visit Team will enrol their biometric identifiers like iris images at their homes, when they register or re-register for their NRICs. This is an existing service and all applicants need to do is to provide documentary proof of their condition, or their caregiver can do so on their behalf.

11. Mr Melvin Yong, Mr Louis Ng and Mr Patrick Tay asked how personal data will be protected; and whether the information will be shared with third parties.

12. ICA has security measures in place.

13. First, ICA has strict user access controls. Only authorised ICA officers can access the database as part of their work. Regular audits are conducted. Those caught misusing the data will be punished.

14. Second, sensitive data like fingerprint and iris images are encrypted before storage in a secure database.

15. Third, ICA's servers are protected by physical and software measures, in line with international security standards.

16. Fourth, the National Registration Regulations tightly regulate and restrict the instances under which personal identifiers such as fingerprints and iris images may be shared.  Unauthorised access or disclosure is an offence.

17. Ms Joan Pereira said that iris patterns may be affected by cataract surgery, and that these patterns may also change over time as a person ages. Mr Melvin Yong also asked a similar question.

18. Madam Speaker, almost all personal identifiers will have their inherent vulnerabilities or limitations.

• This is already the case for fingerprints, photographs and facial features.

• For instance, fingerprints can fade with time, or if the person does a lot of manual work.

• A person will also look different with age. So if you registered at 15, and when you are 30, the photograph will look different over time.

• A person can also alter his physical appearance, or assume a fake identity by replicating another person's fingerprints.

19. Based on reports by the National Institutes of Standards and Technology of the US Department of Commerce, iris patterns are relatively stable over time and have lower mismatch rates as compared to other biometric identifiers.

20. For those whose iris images cannot be effectively scanned or enrolled due to medical reasons such as cataracts, ICA will continue to rely on other identifiers such as fingerprints or facial recognition to identify such individuals.

21. Mr Melvin Yong also asked about people who wear very thick glasses. When we enrol or scan iris images, we will request that they remove their glasses in order for the iris to be more accurately scanned or enrolled.

22. Ms Joan Pereira asked if identity theft can be committed by replicating a person's iris patterns.

23. Like other biometric identifiers, this is certainly possible. But studies have shown that this requires very sophisticated equipment, and is harder to do so accurately. Biometrics systems also have built-in mechanisms to ensure that the presented biometrics are authentic.

24. Carrying out identification using iris images alongside other existing identifiers will make the overall system more secure and robust, and make identity theft harder to commit.

25. Having said that, we cannot be overly reliant on technology and the human dimension is still very important.  We will continue to deploy our officers to look out for tell-tale signs or suspicious behavior among travellers that may indicate possible identity theft.

26. Mr Leon Perera asked about whether there would be processes beyond what I just identified for the enrolment of irises. At this point in time, in order to minimize inconvenience to members of the public, we are limiting enrolment to those interfaces that ICA already has with members of the public – registration at age 15 and re-registration in subsequent years.  And of course, when a person applies for a passport, there will also be another opportunity and touchpoint to enrol his iris images. This will necessarily mean that iris enrolment for the entire population will take quite some time. But let us start with these initial touchpoints first. That will already allow large numbers of Singaporeans and Permanent Residents to have their iris images enrolled.

Appointment of non-ICA employees as registration officers

27. I will move on to the appointment of non-ICA employees as registration officers.

28. Many members spoke about this. Mr Alex Yam and Mr Melvin Yong asked why non-ICA employees should be appointed as registration officers. Mr Leon Perera asked whether these non-ICA employees would be subject to the Official Secrets Act or other forms of security measures and undertakings. Mr Yam asked if this was a productivity measure.

29. Madam Speaker, ICA's objective is to partner other agencies and the private sector, to deliver certain registration services more conveniently to the public, specifically to provide services at more locations.

30. ICA will be highly selective about what we appoint non-ICA employees to do.  These may include functions such as the issuance of NRICs and the enrolling of iris images. They will not be appointed to perform sensitive functions that will require them to access, retrieve or alter individuals' personal information in ICA's records.

• ICA has put in safeguards.  This includes strict user-access controls to prohibit non-ICA employees from accessing, retrieving or altering any information, such as an individual's personal records from ICA's systems.

• Personal information collected by these employees will also be transmitted directly to ICA.

• Non-ICA employees will not be allowed to edit the information. Their role is to guide the public through the enrolment process and not to manage the information collected.

• For greater accountability, ICA will only appoint full-time staff of these entities as registration officers.

• Private entities will be required to submit to ICA, the particulars of each employee whom they intend to appoint with these registration duties.

• Each of them will have to be individually appointed as a registration officer by the Commissioner of ICA.

• This will be done only after ICA has assessed the entity and each individual for their suitability, and conducted the necessary screening measures. So, apart from the suitability of the institution, the individuals will also be assessed.  Mr Leon Perera asked whether there will be a privacy impact assessment or security impact assessment conducted. The entire framework will be put under scrutiny in order to ensure that privacy is secured.

• In addition, under the new Section 3A, these officers and individuals appointed by Commissioner will be deemed to be public servants for the purposes of the Penal Code.

31. Every registration officer is required to produce an identification card or document as evidence of the officer's authority. This will clearly state whether he is from the public sector or if he is from one of these external entitles that we have appointed to carry out some of these functions. If he does not do so, members of the public are well advised not to comply with any order or demand by these individuals.

Powers to refuse the registration of certain types of names

32. Madam, I will now move on to the power to refuse the registration of certain types of names.

33. Mr Alex Yam said that parents should think of the consequences of giving undesirable names to their children, and asked if ICA could come up with a set of guidelines on allowable names.

34. Mr Leon Perera wanted to know if time would be given to parents who choose names that may not be registered under these new rules, instead of being compelled to make a decision there and then, on the spot. I will deal with that first. Certainly this is a very important decision for parents and will affect the children all through their lives. The kinds of names to give is not an issue that we expect parents to take lightly. Neither do we want to put them in a position to be rushed. So certainly, in the rare instance where the name suggested may not comply with the rules, the officers would give the parents ample time to reconsider. Even with the registration of a child's birth, there is a period of time given for parents to make the registration.

35. Madam, we fully agree that names should be given responsibly and that has indeed been ICA's experience so far. So in response to Mr Leon Perera's question about how often we see such inappropriate names, or names exceeding 66 characters, the answer is that they are few and far between. This is a power that is embedded in the registration legislation of many other developed countries. The legislative language referencing public interest also exists in these other countries.

36. ICA does not intend to prescribe a set of guidelines on allowable names, since the vast majority of names are registered without issue. It is not our intention to regulate the kinds of names parents choose for their children.

37. Instead, ICA will assess each name at the point of registration, to ensure that they do not flout the conditions stipulated in the new section 6A.

• Names that do not meet the mark will be refused registration.

• The Commissioner may also refuse to register names that are obscene or offensive.

• The Commissioner will have to carefully consider each case on its own merits, before he exercises his discretionary powers to refuse registration, a power which ought to be exercised sparingly.

38. Mr Leon Perera asked for examples of names that could possibly flout public interest. I have given a few earlier – those that use titles like 'Sir', 'Professor', 'President'; names that are offensive or that use expletives.  One other example could be names that could possibly be deemed derogatory or highly offensive to any particular race or religion. Again, bearing in mind that this is the parents' right to express the kinds of name they would like for the children to carry through their lives, we will exercise these powers very sparingly and carefully.

Replacement of NRIC with more recent photographs

39. Madam, Mr Patrick Tay asked if ICA can provide NRIC replacements at selected intervals of a person's lifetime due to fair wear and tear and outdated photographs. While Mr Leon Perera asked whether ICA can give more assurance to people who have lost their NRICs, especially if they are impecunious or unable to afford the fee for the replacements – either the first or subsequent replacements.

40. Let me deal with the second query first. ICA considers each application for waiver holistically, taking into account a range of factors. ICA will consider waiving the replacement fees fully or partially, for cases where the loss of IC was not through negligence, but due to circumstances beyond the cardholder's control. For example, if the wallet was stolen or if they face financial difficulties.

41. Madam, we certainly understand that NRICs are critical for many functions – whether interfacing with the Government, or in daily life in Singapore.  The loss of an NRIC poses not just inconvenience to the individual, but also tremendous risk to him or her in terms of identity theft.  People could use their ICs to borrow from loansharks.  Identity theft could also pose national security risks. Syndicates, criminals or even terrorist organisations could use Singapore identity documents or NRICs maliciously. Therefore it is important to reflect proper safekeeping of the NRIC in the law.

42. We balance the need to emphasise that responsibility, with the ability of people to afford the replacement fees. In relation to affordability, I've given the member the answer that ICA will assess each case based on the person's circumstances, and also the circumstances under which the identity card was lost.

43. Now in relation to Mr Patrick Tay's earlier question, currently a person registers and receives his first NRIC at the age of 15 and he then has to re-register to receive a second NRIC at 30 with an updated photograph. ICA is looking at introducing at another NRIC re-registration at a later phase of a cardholder's life so that the information captured such as photograph would be more up-to-date. ICA will release more details in due course.

44. Finally, Madam, Mr Leon Perera also asked about the explanatory statement of the Bill which refers to the Bill not resulting in any increase in public expenditure. This is indeed the case. The enactment of the Bill and its execution will not cause an increase in public expenditure itself. Because when ICA puts the systems in place, MHA will include this amount as part of the Supply Bill and we will reflect the expenditure under that Bill.