Bertha Henson raises alarm over full NRIC numbers on ACRA’s new Bizfile system

Veteran journalist Bertha Henson expressed shock in a Facebook post on Thursday (12 December) over the ease with which full NRIC numbers can be obtained from Accounting and Corporate Regulatory Authority (ACRA)’s Bizfile system.

The former Associate Editor of The Straits Times revealed that by simply entering a person’s name under the “People Profile” section, their full NRIC number could be retrieved—even for individuals with no connections to businesses.

In her post, Henson detailed how she tested the platform by searching for her own name, as well as those of friends, family members, and even political figures, including deceased individuals.

To her dismay, she found that full NRIC numbers were publicly displayed for many individuals.

The new Bizfile portal went live on 9 December, and Henson raised concerns about potential glitches on the site.

Henson then reported the issue to the Ministry of Digital Development and Information, the Personal Data Protection Commission (PDPC), and the Ministry of Finance.

While acknowledging that ACRA operates under the Public Sector Governance Act and is exempt from the Personal Data Protection Act (PDPA), she argued that such practices expose sensitive personal information to potential misuse.

Government’s Officer Email Response

Henson noted that she received an email response from a government representative, “Joshua,” stating that her concerns had been forwarded to the relevant agency.

He added, “Please understand that we may take 10-15 working days to investigate the issue, as it depends on the complexity of the issue. We will get back to you as soon as we can.”

Separately, Henson received a call from a PDPC officer, who reiterated that the PDPA did not apply to ACRA.

Henson countered by questioning the rationale behind making full NRIC numbers publicly accessible, noting that partial NRIC numbers are typically used to safeguard identities.

Privacy Concerns and Inconsistencies

Henson raised several concerns regarding the inconsistency in ACRA’s handling of personal data.

While some individuals’ NRIC numbers were freely displayed, others—including those without business ties—were also included, whereas some individuals did not appear in the system at all.

She questioned the logic of revealing NRIC numbers as part of ACRA’s function, calling it unwarranted and illogical.

She argued that the practice poses serious risks to privacy, labelling it an open invitation for scammers and fraudsters.

“How is revealing IC numbers a ‘discharge of its functions?’” she asked, criticising the lack of safeguards for sensitive data.

Henson also highlighted the irony that while ACRA recently amended its rules to shield residential addresses—requiring a $33 fee to access them—NRIC numbers remain freely available.

Bureaucratic Justifications

In a subsequent email, “Joshua” defended the practice, stating that ACRA has “always displayed the full NRIC” to promote transparency and trust in the business environment.

However, Henson questioned this justification, pointing out that ACRA’s own website states that residential addresses are no longer publicly accessible.

She criticised the bureaucratic explanation that revealing full NRIC numbers enhances trust and transparency, arguing that such a “legacy issue” exposes individuals to unnecessary risks.

Henson also drew attention to a vague statement in Joshua’s email about ACRA conducting a review of its policy on displaying full identification numbers:

“Having said that, mindful of the need to reduce the risk of personal data exposure where possible, ACRA conducted a review for (sic) the need to display identification numbers of individuals involved in running and managing the business entities in full in ACRA’s public register.’’

Concerns Over Public Accessibility of Full NRIC Numbers

She questioned whether the review was still ongoing or if it had concluded, and whether this indicated a potential shift towards partial NRIC disclosure.

Henson expressed frustration at the lack of a meaningful response, stating that she found the explanations unsatisfactory.

She urged the authorities to address these concerns, asserting that the continued public accessibility of full NRIC numbers is unacceptable in an era of heightened data security.

She questioned whether the status quo would persist or if the authorities would acknowledge that providing partial NRIC numbers is a sufficient alternative.

Netizens Report Access to Full IC Numbers for Some Individuals Without Login or Payment

In response to Henson’s Facebook post, some followers shared that they tried searching their own names or the IDs of others. Some reported seeing only IC numbers, including that of former Prime Minister Lee Hsien Loong.

Others noted they could access full IC numbers for certain individuals, likely company officers or shareholders, but not for everyone. This was possible without logging in or paying for any reports.

One netizen speculated that this could be a glitch, as previously, viewers were only able to see the last three or four digits of the IC numbers.