How much information can be revealed with your IC number?

I was asked by Malaysiakini to comment on the availability of a person’s identity card number to other members of the public, particularly, by the Government to the members of the members of the public.

Open data convenient for public to access

In Malaysia, it is not difficult to obtain another person’s IC number as it is needed for various forms issued by the public and private sectors. It might even be on display on a company’s working pass for employees. Now, even despatch riders ask for an IC number to confirm the identity of the consignee.

…

Another lawyer, Foong Cheng Leong, said the government’s stand on the matter seems to be to allow free access to others’ data for certain purposes based on the personal data published on government websites.

“Take traffic summonses as an example, banks or potential second-hand car buyers can check if a vehicle has pending summonses,” he noted.

Foong, who is the former co-chairperson of the Bar Council Ad-Hoc Committee on Personal Data Protection (2013 to 2016), said many companies also rely on public information on these websites to work. For example, a lawyer can verify whether someone’s name and IC number are correct.

“Open data websites are convenient for the public and companies, they can get information without paperwork and without the hassle and cost of writing to the relevant departments, which usually takes some time. This may free up time for government agencies to do other work,” he said.

Multi-factor authentication for protection

Several experts have suggested that a multi-factor authentication system and accounts registration be implemented to better protect privacy.

…

Meanwhile, Foong said it is difficult to strike a balance between privacy and the right to information, but there should be some barriers such as registering an account with full details or paying a fee before getting access to data.

“The rule of thumb is that if one submits to do something of a public nature e.g. conduct business, sue in court, certainly his or her personal data should be made public to ensure transparency or to protect the public.

“This is so the person is traceable if they commit fraud,” he added.