Advisory Guidelines on NRIC protection removed for “updates,” raising questions amid ACRA controversy

The Advisory Guidelines on the Personal Data Protection Act (PDPA) for NRIC and Other National Identification Numbers, introduced in 2018, has been removed from the Personal Data Protection Commission’s (PDPC) website.

The page now states: “The document is temporarily unavailable as it is undergoing updates.”

This removal comes shortly after the Ministry of Digital Development and Information (MDDI) defended the Accounting and Corporate Regulatory Authority’s (ACRA) new Bizfile platform, which publicly displays individuals’ full NRIC numbers.

MDDI’s justification for unmasking NRIC numbers

In its response to the controversy, ACRA stated, “This is in line with the broader government effort to move away from using masked NRIC numbers.”

Meanwhile, MDDI revealed in its statement that ACRA had unmasked NRIC numbers on its Bizfile portal before plans for public education were finalised.

It justified the broader policy of unmasking NRIC numbers, describing them as unique identifiers rather than confidential information.

The ministry argued that masking NRIC numbers could provide a “false sense of security” because the masked portion could often be guessed using basic algorithms or supplementary data.

MDDI stated: “There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others.”

This explanation stands in stark contrast to the now-removed guidelines, which explicitly treated NRIC numbers as sensitive data requiring heightened protection.

The removed guidelines

The 2018 Advisory Guidelines outlined strict requirements for organisations handling NRIC numbers, emphasising the risks of unauthorised disclosure.

The document had stated:

“The Protection Obligation requires organisations to make reasonable security arrangements to protect personal data in its possession or under its control. The sensitivity and potential adverse impact to the individual of any unauthorised use or disclosure of his or her NRIC number must be taken into consideration in determining whether an organisation’s collection, use, or disclosure of NRIC numbers meets the requisite standard of reasonableness.

“Given the risks and potential impact of any unauthorised use or disclosure of personal data associated with the individual’s NRIC number, organisations are expected to provide a greater level of security to protect NRIC numbers (or copies of NRIC) in the possession or under the control of the organisations.”

The removal comes at a time when ACRA’s unmasking of NRIC numbers on its Bizfile platform has already drawn significant public concern, particularly with many pointing to the inconsistency of its past position, as cited by the document.

This also raises further questions, as amendments to the PDPA reflecting MDDI’s stance on NRIC numbers have not yet been sent to Parliament for approval.

Without these changes being formalised in law, it is unclear how MDDI can try to justify allowing ACRA to implement such significant changes to NRIC handling practices ahead of the legislative process.

While ACRA has removed the search function in light of the public outcry, it is clear that this would not have been done without former Straits Times editor Bertha Henson raising the issue in her Facebook post on Thursday.

As the public awaits a response, the implications of removing such a pivotal document—particularly amid ongoing controversy over NRIC protection—underscore the need for transparency and clarity from the authorities.

In light of these developments, The Online Citizen has written to the Ministry of Digital Development and Information to seek clarification on why the document has been removed and the rationale behind the updates.