National Registration (Amendment) Bill

Order for Second Reading read.

1.36 pm

The Senior Minister of State for Home Affairs (Mr Desmond Lee): Mdm Speaker, I beg to move, "That the Bill be now read a Second time."

This Bill seeks to strengthen the operational effectiveness and efficiency of the Immigration & Checkpoints Authority (ICA). It will also allow ICA to provide more convenient registration services to the public and to enhance security in Singapore.

Madam, the key amendments are mainly in four areas, namely: (a) collection of personal identifiers; (b) registration of names; (c) appointment of registration officers; and (d) powers of enforcement and investigation.

First, the Bill amends the Act to allow ICA to collect more forms of personal identifiers.

Currently, ICA collects photographs and fingerprints from Singapore Citizens (SCs) and Permanent Residents (PRs) as personal identifiers. These are collected during the National Registration Identity Card (NRIC) registration and re-registration process.

As technology improves, other forms of personal identifiers may be used to complement existing identifiers.

Clause 2 of the Bill allows the Minister to set out in the Schedule the types of personal identifiers that may be collected under the Act. These new personal identifiers are restricted to images, measurements or recordings of an external part of a person's body; or measurements or recordings of a person's voice. These personal identifiers will not involve the taking of body samples obtained through invasive means, such as blood samples.

A new personal identifier we intend to collect are iris images. This has been included in the Schedule, along with photographs and fingerprints currently collected by ICA. ICA plans to start collecting iris images from SCs and PRs from next year. To ensure that the collection of iris images will be easy and convenient, it will be collected as part of the NRIC registration and re-registration process. Iris images will also be collected as part of the passport application or renewal process.

Iris scan is a proven technology. It has been in use in countries, such as Germany and the Netherlands, since the early 2000s. Passport holders from European Union countries can voluntarily enrol their iris images with German and Dutch immigration authorities as well. Once this is done, immigration clearance to enter these countries through some major airports can be done using iris images. Authorities can verify the identities of these travellers by comparing their iris images against what had been previously enrolled.

Some other countries, like the United Arab Emirates (UAE), have also mandated the collection of iris images from their citizens to facilitate immigration clearance. UAE mandated collection of iris images from all citizens since 2013. The enrolled iris images are used to verify the identity of citizens when they travel in and out of the country.

The collection and verification of iris images are similar to taking a photograph. It is convenient, contactless and non-intrusive and can be completed in seconds.

The use of iris scan technology will augment current identity verification methods using photographs and fingerprints. A person's appearance can change over time. A person's fingerprints may also wear out over time as he gets older, or if he does a lot of manual work. ICA has received feedback from some travellers who found it difficult to use the automated clearance gates at the checkpoints. Poor fingerprint quality could also be a reason. These travellers had to be directed to the manned counters instead. This has been a source of intrigue and, sometimes, even frustration to these travellers and also to fellow travellers queuing up behind them to use the automated lanes.

The use of iris scan technology can help reduce such problems by providing an additional avenue for persons to verify their identity. Once implemented, persons can continue to use ICA's automated facilities at the checkpoints, even if their fingerprints may have faded over time. This will smoothen the immigration clearance process for individuals and also benefit other travellers, by reducing overall queue times. The end result is more efficient and effective immigration clearance at our checkpoints.

Madam, the second area of amendments gives ICA the powers to refuse the registration of certain types of names. Clause 5 sets down the mandatory and discretionary rules concerning the name of a person to be entered into the national register. Clause 16 makes a related amendment to the Registration of Births and Deaths Act (RBDA) concerning the registration of a child's name at birth.

Most individuals and parents try their best to come up with good and meaningful names for themselves or their children. The vast majority of names are thus registered with no issue. However, ICA has, from time to time, received requests to register names that are inappropriate. These situations are not common, but they happen. Inappropriate names include names that may be impractical, names that may be offensive, or names that may be confusing or misleading.

Clause 5 makes it mandatory for a name to be expressed using the modern English alphabet, though it may include one or more permitted characters gazetted under the new section 9A(2) of the RBDA. Without this, individuals could attempt to register names which are composed of non-English characters or even numerals or punctuation marks. Many people will find it very difficult to pronounce or read these names. They can cause difficulties in identifying the individual which may result in practical inconveniences or even security risks.

The length of a name must also not exceed the character limit of ICA's systems. The current character limit is already long, at 66 characters. We have to be practical and impose a limit on the length of names. Otherwise, names that are too long would be truncated in official documents and could lead to potential misidentification, posing security risks.

In addition to the mandatory rules, the Commissioner is given the discretion to refuse the registration of a name that: (a) contains anything that represents or resembles a title, a rank or an award, such as "Sir" or "Professor"; or (b) uses any expression or abbreviation to signify lineage, such as "bin" or "son of" or "daughter of", which does not correspond to the person's gender in the national register. Such names are misleading and could potentially cause confusion.

The Commissioner is also given the discretion to refuse the registration of names which are obscene, offensive or contrary to public interest. The Commissioner will carefully consider the circumstances of each case, before he exercises his discretionary powers of refusal to register the names.

The third area of amendments makes clear ICA's powers to appoint non-ICA employees as registration officers.

Clause 3 of the Bill sets out the classes of persons that the Commissioner can appoint as registration officers for the purposes of the Act, or any particular provision of the Act. These include public officers, employees of public authorities and employees of prescribed institutions. Prescribed institutions have to be specified by the Minister in the subsidiary legislation and can include private entities. Only public officers can be appointed as registration officers for the purposes of certain enforcement and investigation related powers under sections 15B, 16, 16B or 16C.

The amendments will allow the Commissioner to appoint non-ICA employees as registration officers for any particular provision of the Act. This will allow ICA to partner other Government agencies or private entities to deliver certain registration services more conveniently to the public and at more locations.

ICA will only allow non-ICA employees to perform very specific functions, which will be carefully selected and tightly scoped. One such registration function is to enrol iris images during the NRIC re-registration process. Once collected, these images will be directly transmitted and stored in ICA's database. Non-ICA employees will not have access to individual personal records in ICA's database.

ICA has considerable experience partnering external agencies in this manner, with the necessary safeguards on security and privacy. Currently, ICA already partners SingPost to deliver some services to Singaporeans. These include alternate site collection of identity cards and passports.

Madam, the fourth area of amendments empowers ICA officers with powers of investigation and enforcement under the Act. For instance, ICA officers will be empowered to seize suspicious identity cards and to perform related investigations.

Clauses 8, 9 and 10 of the Bill provide registration officers with additional enforcement powers, as well as new powers to investigate offences under the Act. Currently, Police officers enforce NRA offences. Providing ICA officers with these powers will serve to improve ICA's effectiveness in the administration of the entire spectrum of NRA-related issues, from the issuance of NRIC to the enforcement and investigation of offences under the NRA.

Clause 8 introduces new sections 15A and 15B. The new section 15A gives registration officers the powers to take possession of any document suspected to be false or invalid, when such a document is produced during registration or alteration of a person's particulars in the national register.

The new section 15B gives registration officers and Police officers the powers to demand the surrender of a suspicious identity card. This includes cards that are suspected to have been obtained under false or misleading information; or been used in the commission of offences under the NRA; or been issued or altered by any unauthorised party.

Clause 9 amends section 16 to give registration officers the powers to conduct searches under this Act.

Clause 10 introduces new sections 16A, 16B and 16C. Section 16A, in particular, requires registration officers to comply with the Criminal Procedure Code when making arrests. Section 16B gives registration officers powers to investigate offences under the Act, whereas section 16C allows for registration officers to initiate criminal proceedings by issuing a notice to the suspected offender to attend Court.

Mdm Speaker, we have put in place safeguards to prevent misuse of these enforcement and investigation powers. For example, the Commissioner cannot appoint registration officers with powers under sections 15B, 16, 16B and 16C, concerning the surrender of identity cards, arrest, search and investigation, unless they are public officers. In addition, we intend to grant such powers only to ICA officers and not to any public officer.

The above amendments will serve to improve ICA's effectiveness in the administration of the entire spectrum of NRA-related issues.

Madam, in conclusion, this Bill will enhance ICA's operational effectiveness and efficiency, and allow ICA to deliver better and more convenient registration services. The collection of additional personal identifiers, such as iris images, will also enhance Singapore's security through strengthening the identification of individuals. Mdm Speaker, I beg to move.

Question proposed.

1.48 pm

Mr Melvin Yong Yik Chye (Tanjong Pagar): Mdm Speaker, I rise in support of the Bill. However, I have some questions regarding some of the changes.

As a former Police officer, I am deeply aware of the various threats that Singapore may face, especially from those abroad who seek to infiltrate our country to cause harm and destruction. Therefore, I am supportive of the amendments proposed for the Act, which aim to strengthen the effectiveness and efficiency of our border security operations.

One of the proposed amendments is the collection of iris images from Singapore citizens and permanent residents as an additional identifier, to enhance the accuracy of identity verification. Developed countries, such as the US and the United Arab Emirates, have already adopted iris-scanning technology and it is timely that we do so, too.

However, I would like to ask the Minister for Home Affairs to elaborate on how ICA would be collecting iris scans of our residents, particularly from those with mobility issues and are constrained to their homes due to ill health. How will ICA make the collection of iris scans more convenient for those who may not see the need to register, such as those who do not travel out of Singapore often or at all, or those who are not able to visit the collection centres during normal working hours due to their work arrangements?

While the collection and identification of the iris images are contactless and non-intrusive physically, the idea that the Government is collecting iris scans is new to many Singaporeans. Residents have asked me how personal data, such as fingerprints and iris images, can be protected from being lost or misused. Can the Minister, therefore, elaborate on measures to safeguard these personal data? Also, how will ICA educate the public on the purpose and need to gather iris scans and assure them of the protection of data?

Another key proposed amendment is the appointment of non-ICA employees as registration officers. Due to the scale of this exercise, it may not be practical for ICA to depend solely on its officers to register thousands of residents on a daily basis. A more effective way is to tap on personnel from the public and private sectors by appointing them as registration officers, so that more locations can be made available for the collection of iris scans.

Can the Minister, therefore, clarify on the roles and powers of registration officers from the private sector? Firstly, if a private company is tasked with collecting the personal identifiers, does it have to submit names of employees who will take on the role of registration officers? Secondly, do these registration officers have to be permanent staff of the company? Thirdly, what measures would there be to ensure the registration officers protect the data collected and encrypt them in an appropriate manner? Lastly, how can the public differentiate between registration officers from the private and public sectors?

All registration officers must understand the importance of protecting these sensitive data and practise due diligence accordingly. Clarifications to these questions would help us better understand the administrative and enforcement duties of these non-ICA registration officers.

Mdm Speaker, the use of iris scans signifies the next age of our border security operations and I would like to understand how such technology will be implemented at our checkpoints. Is there a specific timeframe for iris scans to be implemented at all our checkpoints? Would iris scans eventually replace fingerprint technology or would that serve as an add-on? If so, would iris scans slow down the immigration clearance process, taking into consideration the varying volumes of travellers at our different checkpoints? Finally, I would like to also understand if iris scans would be effective for people with existing eye conditions, such as cataracts, or those who wear very thick prescription lenses.

I look forward to the clarifications from the Minister. With that, Mdm Speaker, I support the Bill.

1.52 pm

Mr Leon Perera (Non-Constituency Member): Mdm Speaker, the National Registration (Amendment) Bill seeks to make changes to the law governing the national register and NRIC in light of current realities and technology developments. I do not oppose the thrust of the Bill but I have a number of queries about the context for the amendments and a few requests for clarification and assurance on how these provisions will be implemented.

Firstly, under the amendments to section 19, under clause 13, punishment for destruction of an identity card is $3,000, although the imprisonment term can be up to two years and can be implemented together with a $3,000 fine. Furthermore, the existing rules – and this is independent of the current Bill – are that replacing a lost NRIC costs $100 for the first loss and $300 for the second loss. These penalties are relevant to low-income, multi-problem households.

Madam, I am sure many of us in this House have encountered low-income residents who sought to appeal for a deduction or waiver of those NRIC replacement costs on compassionate grounds. As an FSC volunteer in the past, I have met a number of low-income Singaporeans who have long lost their NRICs and who were deterred from seeking help from social work agencies and Government agencies by the prospect of having to pay for replacing their NRICs or, worse yet, charged with an offence they and their families will suffer as a result.

An NRIC is crucial to interact with Government agencies to exercise the rights and responsibilities of a citizen. Rather than risk deterring at-risk persons from coming forward to ask for help, would ICA consider adopting a similar approach to that taken by our public healthcare institutions? And that approach is that no one will be denied medical help because they cannot pay. Similarly, can ICA publicly say or message that while certain penalties may apply on a case-by-case basis, no one will be denied an NRIC replacement because he cannot pay?

Next, Madam, I would like to speak about clause 5 which places some limitations on what names can be registered. One of these rules is that the name cannot exceed the number of characters permitted by the electronic form of the national register, which the Senior Minister of State confirmed is 66 characters.

As a matter of practical reality, of course, very few people would want to register a name longer than 66 characters. I fully recognise that, but there would be some individuals and families who want to. If a family wants to give their child a name that is too long or someone wants to do a deed poll to the same effect, will they be given sufficient time to consider how to abbreviate their officially registered name to 66 characters?

Madam, I think back to the British colonial period, when registration officers in Singapore would often misrecord people's names because they did not understand the language of the person whose name they were recording, resulting in names that were worded in strange ways that were at odds with the intentions of the parents or the person.

In those days, people had to live with the results of that. I hope that parents and individuals doing deed polls who find themselves on the wrong side of these new rules would have enough time and space to discuss alternatives with the registration officer, rather than being pressured to agree to an officially approved abbreviated version of their name, on the spot, as it were.

Madam, also on clause 5, I would like to ask for some contextual information. Since every act of legislation should be a response to a real-world problem or a problem that is likely to happen, my question is: have there been a significant or an increasing number of persons wanting to register their names that might be deemed to contain an impermissible reference to a rank or an award or deemed to be offensive or contrary to the national interest?

I would also like to question the terms "offensive" and "contrary to the public interest". These are broad-sweeping terms that will give ICA very broad latitude in denying the registration of a name, setting up a tension with the right of individuals to choose their names and their children's names. Could the Senior Minister of State cite some examples of names that will be contrary to the national interest that it has encountered or, at least, indicate broadly what types of names will these be? Will these be, for example, names that contain expletives?

Clause 14 allows the Minister to collect new personal identifiers, such as an iris scan which reflects developments in personal identification technology. I would just like to confirm − I believe I heard this earlier − with the Senior Minister of State that the intention is for the Government to eventually migrate everyone, all Singaporeans and Permanent Residents, to this new iris scan identification and collection.

If that is the case, if my understanding is correct, then, no doubt, this is possible when people replace their NRICs and passports. But for those who are not replacing their NRICs and passports anytime soon, what would be the logistics or undertaking in such a massive exercise of collecting iris scans from every Singaporean and PR? What would be the schedule associated with that?

Next, Madam, section 3(4)(c) allows the employee of a prescribed institution to act as a registration officer. This opens the way for private corporations to perform national registration tasks on contract. Would national registration officers working with private contractors, as with their public sector counterparts, be asked to sign the usual undertakings under the Official Secrets Act regarding the safeguarding of official information?

Also – and here I return to an issue I have raised in the House in another context – would the Ministry conduct a privacy impact assessment, or PIA, before outsourcing national registration functions to companies, given the highly sensitive nature of personal identifier information, including possibly iris scan information? And how highly sought after such data would be by criminal syndicates?

Also, the Bill does not expressly deal with contracts with the outsourcing contractors themselves. Unlike private organisations, the Government is not bound by the Personal Data Protection Act (PDPA). In previous parliamentary debates over the PDPA, the Government has said that it is bound by its own internal rules. The PDPA requires private organisations to ensure that organisations which process data on their behalf, or data intermediaries, comply with the PDPA protection and retention obligations.

To ensure a minimum standard of protection and reduce the compliance complexity for its outsourcers, I would like to suggest that MHA should, at the minimum, treat all organisations it is contracting with for the purpose of national registration, like data intermediaries, under the PDPA. Terms and conditions in its tenders should also take into account the PDPC's guidelines on this issue for private organisations.

Next, the amendment to section 16(2A) allows a national registration officer to break open property, forcefully remove obstruction and take possession of documents found during a search. This gives search, seizure and use of force powers to national registration officers, which the Senior Minister of State would confirm would be ICA officers only and not private sector persons, but, nevertheless, therefore, extending Police powers to another group of personnel outside of the Police. I would like to record my concern on this point. Is this extension of Police powers really necessary or desirable? Can Police officers simply perform these tasks on behalf of national registration agencies?

Lastly, and in conclusion, I have a technical question. The explanatory note to this Bill states that "no extra financial expenditure would be entailed by this Bill". If iris scanning technology is to be purchased and deployed on a considerable scale, would this not result in a considerable increase in financial expenditure? Thank you, Madam.

2.00 pm

Mr Alex Yam (Marsiling-Yew Tee): Mdm Speaker, I rise in support of the National Registration Amendment Bill. There is a global movement in several countries to tighten registration and security. Brazil has recently announced plans to share biometric data from their electoral registry with the federal government for a unified Brazilian identity card project. This is unprecedented in South America. Japanese tech firm NEC has also developed new technology biometric scanners to identify even new-borns and infants to monitor vaccination rates in developing countries. A prototype has run in India and it was used to capture biometric information from 300 children. In the Straits Times on 5 November, it was also pointed out by a senior cybersecurity official of the US Office of the Director of National Intelligence that Singapore can be a model for building a resilient national critical information infrastructure with regard to national data registration.

In terms of the pertinent issues with regard to the Act, the Senior Minister of State has mentioned earlier the timeframe for rolling out the iris scans. This will take place at various stages when renewing your identity card or passport at border controls. My clarification is, if this was an important part of our security and national registration framework, would the Ministry not consider that this be done as a one-time exercise to allow for all citizens to be registered as quickly as possible?

Related to that, the Senior Minister of State has also related its security implications. Therefore, my second clarification lies with long-term visitors to Singapore ‒ whether they be workers, foreign workers, expatriates ‒ would it not be in the interest of security to also have this done for them?

The changes that are contained within the National Registration Bill are important. But there are, of course, some misguided Singaporeans who may view it as Orwellian measures designed to control Singaporeans. This is one perception that I think needs to be handled carefully and communicated effectively so that it would not have an impact on the Government's standing. Education is essential and I hope the authorities will undertake the necessary measures to allay misconceptions and allegations of invasion of privacy.

With regard to powers that are assigned to registration officers to investigate, could I clarify with the Senior Minister of State if there has been a recent increase in the number of offences that warrants a shift of investigative powers from the Police to ICA? Would there also be a transition period for this to take place?

With regard to names, registration officers currently at hospitals also undertake the registration of children's births. Therefore, would ICA be training these registration officers with regard to the types of names that are allowed or not allowed, or will all names be permissible at registration but denied further downstream by the Registrar or Commissioner?

Also, in terms of cultural sensitivities, under the Schedule, it is indicated that names that relate to titles or positions will be disallowed. But in certain cultures, titles are also born of alien names. Will cultural sensitivities, therefore, also be managed?

Under clause 3, as I have mentioned, the registration officers may change relatively often, depending on their employment with that particular organisation. How will ICA manage the appointment of registration officers that may go through some amount of flux?

A couple of years back, it was also reported in the local papers, and also then aired in the international media, about an individual with a name closely resembling that of a comic superhero. Some joked that even his poor father's name seems to also represent. But in his cultural background, it appears that it is relatively common in Java. So, with regard to names that may appear offensive or may have long-term impact on a child, what are ICA's guidelines on these?

Madam, the amendments that are provided for under the National Registration Amendment Bill are important and timely. Notwithstanding some of the clarifications that I have sought, I wholeheartedly support the Bill.

2.06 pm

Mr Louis Ng Kok Kwang (Nee Soon): Madam, one of the key amendments of this Bill is the introduction of iris imaging, and my speech will focus on that point.

We have sufficient proof that iris imaging is far more accurate than all other biometric identifiers available today. Compared to fingerprints, which can wear off, iris scans have a much lower chance of false matches.

It has already been tried, tested and deployed in other parts of the world – from airports, to banks and smartphones. This year, the UN started to use it to identify refugees. In the private sector, industry watchers also consider it the next big thing.

Thus, if new technology is available for a safer Singapore, then we must seize it – and I am encouraged that this Bill does reflect the Government's vigilance and eagerness to seize opportunities to strengthen security.

That said, in order for us to reap the full benefits of this new technology, I would like to raise a few questions.

Firstly, on the safety of the data collected, as has been previously raised by my fellow colleague, there have been many discussions about the collection of biometric data, since identity theft and security breaches are becoming increasingly sophisticated. Iris scans are especially sensitive because they are so powerful. The most advanced scanners can identify many people in a split second, even from a long-range. The data is almost fool-proof and is permanent. If this data falls into the hands of people with mal-intentions, the consequences can be dangerous. The public could have questions on how secure the database will be, whether third parties, apart from the Government, will have access to the data and so on. There will always be teething issues with the introduction of any new technology, especially one as personal as this, and we should have ready answers. In this light, can the Minister share plans on how it will ensure that the new data collected will be secure? How does the Ministry plan to satisfy the public about this?

Secondly, on user acceptance. Some people might be skeptical – even fearful – of new technology like this, which could be seen as a page out of a science fiction novel. For the older generation, there could be misconceptions ‒ will it hurt my eyes, does it involve lasers? For the younger generation, there could be discomfort from what they see as additional Government "surveillance". Certainly, the technology has been tried and tested, but how does the Ministry plan to educate the public to debunk these myths?

Thirdly, I would like to find out more about the technology deployed at the immigration checkpoints. I have read that iris scanners are able to detect stress through indicators, such as movement of the eyeballs. Once stress is detected, the system will immediately alert authorities. If this is truly available, it would be a real step-up for security at our checkpoints. Can the Minister share if the iris imaging technology we will acquire can provide this extra layer of security?

My final point is to ask which Ministry and Government services will have access to, and use of the data. Apart from immigration and perhaps, the Police, are there plans for schools, hospitals and other relevant services to also use the data for identification – perhaps not immediately, but in the longer term?

Madam, in this era where criminal methods are becoming increasingly sophisticated, the Government needs to invest in superior technology. Iris scans have surely proven its effectiveness and I am in full support of it. But in order for us to reap its full benefits, I hope we have strict safeguards in place, particularly for data protection. Madam, these points notwithstanding, I stand in support of this Bill.

2.09 pm

Ms Joan Pereira (Tanjong Pagar): Mdm Speaker, I rise in support of the Bill. It has been over two decades since the Act was last amended. I agree that the various amendments proposed are necessary to update ICA's operations and to enhance the effectiveness and efficiency of our border controls.

A significant amendment is clause 14 which inserts a Schedule, including the personal identifiers that may be collected. The collection of iris images and, in some cases, recordings of voices, can help to strengthen our identity verification methods.

Iris scans are a proven technology. It is contactless, convenient and highly accurate. It even works in the presence of clear contact lenses and non-mirrored glasses. Due to these advantages, several countries, such as the UK, the Netherlands and India, are using this technology.

However, it is not without its weaknesses. There have been studies that showed that cataract surgeries could change the iris texture and may impact iris pattern recognition. In addition, there is also research suggesting that irises are susceptible to ageing effects that change their appearance over time.

Another concern is the possibility of recreating synthetic eye images that match digital iris codes used by iris-recognition systems to identify people. Some researchers had already found a way to replicate such images, "creating the possibility of stealing someone's identity through their iris". Would the Minister share what measures we have in place to overcome these potential problems and threats to our new iris-recognition system?

Next, I would like to state my support for the amendment to provide our ICA officers with the powers to investigate offences under the NRA. This would be much more efficient and effective than relying only on our Police officers to do so, as is currently the case. The administration and operations would be more streamlined under this new arrangement. This would also free up our Police officers to focus on other criminal investigations.

Lastly, the move to refuse the registration of inappropriate names is overdue. Now, ICA will have the power to protect our young from offensive names, however rarely it occurs. It is particularly important to reject misleading and confusing names which can be used to deceive the general public. Madam, I conclude with my support for the Bill.

2.12 pm

Mr Patrick Tay Teck Guan (West Coast): Mdm Speaker, I rise to support this amendment Bill. This Bill seeks to amend the Act to expand types of personal identifiers of persons registered or required to be registered under the Act that may be collected by ICA. Although I support the Bill, I wish to highlight the need for robust and stronger safeguards with respect to privacy and security arising from the collection of biometric data.

The collection of iris scans from Singapore Citizens and Permanent Residents could begin as early as next year, according to ICA, as an extra personal identifier, besides photographs and fingerprints. MHA says that iris scanning is "a proven technology" that is "convenient, contactless and non-intrusive". I join Members who spoke earlier on their concerns on both counts of privacy and security.

As scanning of irises is contactless and non-intrusive, the technology could potentially scan irises covertly, as opposed to the scanning of thumb prints, which requires active participation of the person being identified. Iris scan technology can be taken from as far as 12 m away, according to scientific sources highlighted publicly. These developments are perceived as Orwellian because they allow iris cameras to be unseen and to operate in a non-consensual surveillance mode.

Once an iris becomes a digital file, that file will need to be adequately protected against attack. Systems can be hacked, biometric identifiers could be stolen and misused.

What are the safeguards which have been and will be put in place to address these privacy and security concerns in collecting biometric data, such as iris scans? How will these safeguards be communicated to the public to allay concerns?

On a different note and point but also on the National Registration Identification system, I had raised previously as a Parliamentary Question earlier this year but reiterate again the need for ICA to renew and re-issue our NRICs again during the later years of our life and at selected intervals because the pictures on the NRIC may be outdated and inaccurate. I urge ICA to do this and at no cost impact to Singaporeans. This updating exercise will also help in the iris scan roll-out.

Mdm Speaker: Senior Minister of State Desmond Lee.

2.15 pm

Mr Desmond Lee: Mdm Speaker, Members have asked questions broadly on the four areas that I have covered earlier ‒ collection of iris images; how data that ICA collects will be safeguarded; appointment of non-ICA employees as registration officers; and the powers to refuse the registration of certain types of names.

Let me start first with the collection of iris images. Mr Melvin Yong asked how and when iris scan technology will be implemented at the checkpoints and how this will affect the efficiency of the checkpoint clearance process. He also asked if iris scans will eventually replace current fingerprint verification.

Madam, ICA plans to introduce iris scan technology progressively at our land, air and sea checkpoints within the next two years. This will complement the current fingerprint matching process at immigration clearance and give ICA another way to verify a traveller's identity. This will enhance border security. Travellers using the automatic clearance lanes who find that their fingerprints cannot be matched, can also use iris scans, instead of being re-directed to manned counters. So, more Singaporeans and Permanent Residents will, therefore, enjoy automated clearance at our checkpoints, with the reduced need to be diverted to manned checkpoints. This will improve the overall efficiency and efficacy of our immigration clearance process.

Mr Louis Ng asked about whether iris scanners can detect stress through the movement of eyeballs, to bolster border security. While potentially useful, our sense is that this technology does not appear mature at present. We continue to look at all these methodologies and will make decisions as they mature.

The collection and verification of iris images are very safe and will not harm our eyes, and the process is similar to taking a photograph ‒ convenient, contactless, non-intrusive and can be done within a matter of seconds.

Mr Alex Yam asked whether existing NRIC holders will be required to enrol their iris images and when ICA intends to begin doing so. Mr Yong wanted to know if this process can be made convenient for the public. And Mr Leon Perera asked about when this iris enrolment can be done outside of these three phases – registration, re-registration and passport collection.

Madam, ICA intends to start collecting iris images from Singapore Citizens and Permanent Resident from next year. To make it convenient for people, ICA will do this as part of ICA's existing interactions with the public. And these include compulsory NRIC registration and re-registration. So, there are two phases, one at 15 and one at 30, as well as during passport application and renewal process.

ICA will enrol an individual's iris images when he collects his new NRIC or passport. There is, therefore, no need to make a separate trip to ICA Building just to have your iris image collected. So, we build it into the existing process and we collect it as and when people make use of ICA's existing services.

Mr Melvin Yong asked about how we will help people with disability or serious illness. The ICA Home Visit Team will enrol their biometric identifiers like iris images at their homes, when they register or re-register for their NRICs. This is an existing service, and all that the applicants need to do is provide documentary proof of their condition or their caregiver can do so on their behalf.

Mr Melvin Yong, Mr Louis Ng and Mr Patrick Tay asked how personal data will be protected and whether the information will be shared with third parties.

ICA has security measures in place. First, ICA has strict user access controls. Only authorised ICA officers can access the database as part of their work. Regular audits are conducted. Those caught misusing the data will be punished. Second, sensitive data like fingerprint and iris images are encrypted before storage in a secure database. Third, ICA servers are protected by physical and software measures, in line with international security standards. Fourth, the National Registration Regulations tightly regulate and restrict the instances under which personal identifiers, such as fingerprints and iris images, may be shared. Unauthorised access or disclosure is an offence.

Ms Joan Pereira said that iris patterns may be affected by cataract surgery and that these patterns may also change over time as a person ages. Mr Yong also asked a similar question.

Mdm Speaker, almost all personal identifiers will have their inherent vulnerabilities or limitations. This is already the case today for fingerprints and photographs, facial features. So, for instance, fingerprints can fade with time or if the person does a lot of manual work. A person will also look different with age. So, if you register at 15 and when you are 30, the photograph will look different over time. The person can also alter physical appearance or assume a fake identity by replicating another person's fingerprints. Based on reports by the National Institutes of Standards and Technology of the US Department of Commerce, iris patterns are relatively stable over time and have lower mismatch rates, as compared to other biometric identifiers.

For those whose iris images cannot be effectively scanned or enrolled due to medical reasons, such as cataracts, ICA will continue to rely on other identifiers, such as fingerprints or facial recognition, to identify such individuals.

Mr Melvin Yong also asked about people who wear very thick glasses. When we enrol iris images, we will request that they remove their glasses in order for the image scan to be more accurately scanned or enrolled.

Ms Joan Pereira asked if identity theft can be committed by replicating a person's iris patterns. Like other biometric identifiers, it is certainly possible. But studies have shown that this requires very sophisticated equipment and is harder to do so accurately. Biometric systems also have built-in mechanisms to ensure that the presented biometrics are authentic.

Carrying out identification using iris images alongside other existing identifiers will make the overall system more secure and robust and make identity theft harder to commit.

Having said that, we cannot be overly reliant on technology and the human dimension is still very important. We will continue to deploy our officers to look out for tell-tale signs or suspicious behaviour amongst travellers that may indicate a possible identity theft.

Mr Leon Perera asked about whether there would be processes beyond what I have just identified for the enrolment of irises. At this point in time, in order to minimise inconvenience to members of the public, we are limiting enrolment to those interfaces that ICA already has with members of the public ‒ registration at 15, and re-registration in subsequent years. And, of course, when a person applies for a passport, there will also be another opportunity and touch-point to enrol the iris. This would necessarily mean that enrolment of the entire population will take quite some time. But let us start with the initial touch points first. That will already allow large numbers of Singaporeans and PRs to have their iris images enrolled.

I will move on to the appointment of non-ICA employees as registration officers. Many Members spoke about this. Mr Alex Yam and Mr Melvin Yong asked why non-ICA employees should be appointed as registration officers. Mr Leon Perera asked whether these non-ICA employees would be subjected to the Official Secrets Act and other forms of security measures and undertakings. Mr Alex Yam asked if this was a productivity measure.

Mdm Speaker, ICA's objective is to partner other agencies and the private sector to deliver certain registration services more conveniently to the public, specifically to provide services at more locations. ICA will be highly selective about what we appoint non-ICA employees to do. These may include functions, such as the issuance of NRICs and enrolling of iris images. They will not be appointed to perform sensitive functions that require them to access, retrieve or alter individuals' personal information in ICA's records.

ICA has also put in safeguards. These includes strict user-access controls to prohibit non-ICA employees from accessing, retrieving or altering any information, such as an individual's personal records, from ICA's systems. Personal information collected by these employees will also be transmitted directly to ICA. Non-ICA employees will not be allowed to edit the information. Their role is to guide the public through the enrolment process and not to manage the information collected.

For greater accountability, ICA will only appoint full-time staff of these entities as registration officers. Private entities will be required to submit to ICA the particulars of each employee whom they intend to appoint with these registration duties. And each of them will have to be individually appointed as a registration officer by the Commissioner of ICA. This will be done only after ICA has assessed the entity and each individual for their suitability, and conduct necessary screening measures. So, apart from the suitability of the institution and the individuals, Mr Leon Perera asked whether there will be a privacy impact assessment or security impact assessment conducted. The entire framework will be put under scrutiny in order to ensure that privacy is secured. In addition, under a new section 3A, these officers and individuals who are appointed by the Commissioner of ICA will be deemed to be public servants for the purposes of the Penal Code.

Every registration officer is required to produce an identification card or document as evidence of the officer's authority. And this will clearly state whether he is from the public sector or he is from one of these external entities that we appoint to carry out some of these functions. If he does not do so, members of the public are well advised not to comply with any order or demand by these individuals.

Madam, I will now move on to the powers to refuse the registration of certain types of names. Mr Alex Yam said that parents should think of the consequences of giving undesirable names to their children and asked if ICA could come up with a set of guidelines on allowable names. Mr Leon Perera wanted to know if time would be given to parents who register names that may not be registered under these new rules instead of being compelled to make a decision there and then, on the spot.

I will deal first with Mr Leon Perera's point. Certainly, this is a very important decision for parents and will affect the children all through their lives. The kind of names to give is not an issue that we expect parents to take lightly. Neither do we want to put them in a position to be rushed. So, certainly, in the rare instance where the name suggested may not comply with the rules, the officers will give the parents ample time to reconsider. Even with the registration of a child's birth, there is a period of time given to parents to make that registration.

Madam, we fully agree that names should be given responsibly and that has, indeed, been ICA's experience so far. So, in response to Mr Leon Perera's question about how often we see such inappropriate names or names exceeding 66 characters, the answer is very few and far between. This is the power that is embedded in the registration legislation of many other developed countries. The legislative language referencing public interest also exists in these other countries. ICA does not intend to prescribe a set of guidelines on allowable names, since the vast majority of names are registered without issue. It is not our intention to regulate the kinds of names parents choose for their children.

Instead, ICA will assess each name at the point of registration to ensure that they do not flout the conditions stipulated in the new section 6A. And names that do not meet the mark will be refused registration. The Commissioner may also refuse to register names that are obscene or offensive. The Commissioner will have to carefully consider each case on its own merits before he exercises his discretionary powers to refuse registration, a power which ought to be exercised sparingly.

Mr Leon Perera asked for examples of names that could possibly flout public interest. I have given a few earlier. Those that used titles like "Sir", "Professor", "President"; names that are offensive or that use expletives. One other example could be names that could possibly be deemed derogatory or highly offensive to any particular race or religion. Again, bearing in mind that this is the parents' right to express the kind of name they would like for their children to carry through their life, we will exercise these powers very sparingly and carefully.

Madam, Mr Patrick Tay asked if ICA can provide NRIC replacements at selected intervals of a person's lifetime due to fair wear and tear and outdated photographs, while Mr Leon Perera asked whether ICA can give more assurance to people who have lost their NRICs, especially if they are impecunious or unable to afford the fee for replacements for either the first or subsequent replacements.

Let me deal with the second query first. ICA considers each application for waiver holistically, taking into account a range of factors. ICA will consider waiving the replacement fees fully or partially for cases where the loss of IC was not through negligence but due to circumstances beyond the cardholder's control, for example, their wallet was stolen or they faced financial difficulties.

Madam, we certainly understand that NRICs are critical for many functions ‒ whether interfacing with Government or in daily life in Singapore. The loss of an NRIC poses not just inconvenience to the individual but also tremendous risks to him or her in terms of identity theft. People could use their ICs to borrow from loan sharks. Identity thefts could also pose national security risks. Criminals, syndicates or even terrorist organisations could use Singapore identity documents or NRICs maliciously. Therefore, it is important to reflect proper safekeeping of the NRIC in the law. We balance the need to emphasise that responsibility with the ability of people to afford the replacement fees. In relation to affordability, I have given the Member the answer that ICA will assess each case based on the person's circumstances and the circumstances under which the identity card was lost.

In relation to Mr Patrick Tay's earlier question, currently, a person registers and receives his first NRIC at the age of 15 and he then has to re-register to receive a second NRIC at 30, with an updated photograph. ICA is looking at introducing another NRIC re-registration at a later phase of a cardholder's life so that the information captured, such as the photograph, will be more up-to-date. ICA will release more details in due course.

Finally, Madam, Mr Leon Perera also asked about the explanatory statement of the Bill which states to that the Bill will not result in any increase in public expenditure. This is, indeed, the case. The enactment of the Bill and its execution will not cause an increase in public expenditure itself. Because when ICA puts the systems in place, MHA will include this amount as part of the Supply Bill and we will reflect that expenditure under that Bill.

2.34 pm

Mr Leon Perera: Mdm Speaker, I thank the Senior Minister of State for his replies. Just a quick point of clarification on the denial of registration of impermissible names because of character limit or other reasons. The Senior Minister of State mentioned that this is very rare. Would the Senior Minister of State be able to share with us his broad ballpark estimate, based on the number of cases ICA has seen of the number of names that are likely not to be approved to be registered each year under these new rules, very broadly speaking?

Mr Desmond Lee: Madam, I do not have these estimates. Suffice to say, as I have said earlier, these are few and far between.

Question put, and agreed to.

Bill accordingly read a Second time and committed to a Committee of the whole House.

The House immediately resolved itself into a Committee on the Bill. – [Mr Desmond Lee].

Bill considered in Committee; reported without amendment; read a Third time and passed.