MCI - Ministry of Communication and Information of the Republic of Singapore

10/05/2021 | News release | Distributed by Public on 10/05/2021 04:08

MCI’s response to PQ on Prohibiting Organisations from Storing Scans of Identification Documents beyond Period Required for Identity Verification in Light of MyRepublic Data Breach

1. The Personal Data Protection Act ("PDPA") already sets baseline requirements for organisations to cease retaining documents containing personal data when it is no longer needed for legal or business purposes. These include scans of identification documents.

2. Specifically, for telecommunication licensees, it is a licensing requirement to retain the identification record of a subscriber for at least 12 months following the termination of services by the subscriber. This is to ensure that agencies investigating fraudulent and/or criminal acts can review such identification records if telecommunication services were used for such purposes.