s 8A Disclosure of password, access code, etc., in relation to national digital identity service
8A.—(1) Any user of the national digital identity service —(a) who discloses any password or access code of the user in relation to the national digital identity service, or provides any other means of securing access in the identity of the user to any program or data held in any computer by way of the national digital identity service; and (b) who does so knowing, or having reasonable grounds to believe, that the purpose of the disclosure or provision is for any person to commit, or to facilitate the commission by any person of, any offence under any written law, shall be guilty of an offence and, subject to subsection (5), shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 years or to both. [Act 21 of 2025 wef 30/12/2025] (2) For the purpose of proving an offence under subsection (1), it is not necessary for the prosecution to prove —(a) that the purpose of committing, or facilitating the commission of, an offence was carried out; (b) that the user knew, or had reasonable grounds to believe, that the purpose was to commit, or facilitate the commission of, any specific offence; or (c) that the disclosure or provision was made to any specific person, if the disclosure or provision was made by the user in a manner that was intended to be accessible or retrievable by another person, whether or not that other person is known to the user. (3) For the purposes of subsection (1)(b), a user of the national digital identity service who does an act mentioned in subsection (1)(a) is presumed, until the contrary is proved, to have reasonable grounds to believe that the purpose of the disclosure or provision is for a person to commit, or to facilitate the commission by a person of, an offence under any written law, if —(a) the user does the act for any gain —(i) whether or not the gain is a wrongful gain; (ii) whether or not the gain is realised; and (iii) whether the gain is to the user or to another person; (b) the user does the act knowing that it is likely to cause wrongful loss to any person; or (c) at the time the user does the act, the user fails to take reasonable steps to ascertain the identity and physical location of the person to whom the password, access code or means of securing access is disclosed or provided. (4) It is not an offence under subsection (1) if the user of the national digital identity service had reasonable grounds to believe that the purpose of the disclosure or provision is to use or access the national digital identity service to carry out a transaction in the identity of the user for a lawful purpose. [Act 16 of 2023 wef 08/02/2024] (5) Where an individual is convicted of an offence under subsection (1), the individual shall, in addition to the punishment under that subsection, be liable to caning of not more than 12 strokes —(a) if the individual knew that the purpose of the disclosure or provision was for any person to commit, or to facilitate the commission by any person of, any scam offence; or (b) if —(i) it is proved, to the satisfaction of the court, that the password, access code, or means of securing access, was used to commit, or to facilitate the commission of, a scam offence; and (ii) the individual is not able to prove, to the satisfaction of the court, that he or she had, at any time, taken reasonable steps to ensure that the password, access code or means of securing access, would not be used to commit, or to facilitate the commission of, a scam offence.[Act 21 of 2025 wef 30/12/2025] (6) For the purposes of subsection (5)(a), it is not necessary for the prosecution to prove that the commission, or facilitation of the commission, of a scam offence was carried out.[Act 21 of 2025 wef 30/12/2025] (7) For the purposes of subsection (5)(b)(i), it is not necessary for the prosecution to prove that any person was convicted of the scam offence.[Act 21 of 2025 wef 30/12/2025]