Netizens criticise Govt’s flip-flopping on NRIC unmasking, raising privacy and scam concerns

Despite the government’s apologies and its explanation on 14 December that plans are underway to stop masking National Registration Identity Card (NRIC) numbers, public backlash has continued.

Many Singaporeans have voiced strong concerns over the unmasking of NRIC numbers, highlighting privacy risks, particularly in the context of rising scams and the potential harm to vulnerable groups such as the elderly.

Many also criticised the government’s inconsistent policies and poor communication, calling for better protection of personal data and stronger authentication methods to safeguard against threats.

The NRIC unmasking controversy emerged after former Straits Times editor Bertha Henson highlighted in a viral Facebook post the ease of accessing full NRIC numbers on the Accounting and Corporate Regulatory Authority’s (ACRA)’s new Bizfile portal.

Launched on 9 December, the portal briefly allowed users to retrieve full NRIC numbers by simply entering a person’s name, sparking widespread concerns about privacy and data security.

This marked a significant departure from the earlier system, which masked all but the last three digits of NRIC numbers.

Critics pointed to risks such as identity theft and fraud, especially given that statutory boards like ACRA are exempt from the Personal Data Protection Act (PDPA), which governs private entities.

The Ministry of Digital Development and Information (MDDI) and ACRA apologised on 14 December, acknowledging the premature implementation of the policy and suspending the search function on the platform.

The MDDI clarified that the move to unmask NRIC numbers was part of a broader government initiative to reduce reliance on masked identifiers, which they argued provided a “false sense of security.”

ACRA said the new service was in line with the broader government effort to move away from using masked NRIC numbers.

The search feature has, however, been suspended since the public outcry until the PDPC reviews the guidelines.

Moving forward, the government plans to launch a public education campaign in 2025 to address misconceptions about NRIC use.

Meanwhile, the PDPC reiterated its stance that NRIC numbers should not serve as passwords or verification tools. The Commission emphasised the need for organisations to adopt secure practices, such as biometric verification or multi-factor authentication, for identity verification.

Netizens Slam Government Over Privacy Concerns and Policy Inconsistency

Observing comments on CNA’s Facebook post and YouTube, it is evident that many netizens are questioning the government’s flip-flopping stance on NRIC numbers.

Some strongly disagree with the unmasking of full NRIC numbers, emphasising that they are personal data. They argue that the government has no right to disclose this information and stress that NRIC numbers should not be shared without the individual’s consent.

Concern over Privacy Risks and Rising Scam Vulnerabilities

Some argued that with just an NRIC number, one could easily determine a person’s age and other sensitive information. They found it “incredibly dumb” to make such personal data public, especially given the rising number of convincing scams.

One comment expressed frustration, stating that the increasing scams had made them distrust many aspects of society, fearing the loss of their money, identity, or worse.

The comment urged the government to avoid making it easier for scammers by disclosing NRIC numbers.

Ensuring Elderly Protection Against Scams Through NRIC Privacy

A comment expressed concerns over the wide range of personal data linked to NRIC numbers, such as bank accounts, properties, SingPass access, government handouts, and even mask dispensers.

The YT user argued that to protect Singaporeans, especially the elderly, from scams, NRIC numbers should be kept private and safeguarded by law, in line with the former Prime Minister’s recommendations.

Calls for Accountability Over Government Data Exemptions

Some netizens highlighted concerns over double standards, pointing out that while private companies face penalties under the PDPA for leaking personal data such as full names, NRIC numbers, and addresses, government agencies—exempt from the PDPA—appear to avoid similar accountability.

‘Public Communication Failures’

Meanwhile, some netizens criticised the government, urging it to admit the oversight instead of condescendingly suggesting that the public needs to be “reeducated,” especially given the long-standing practice of using NRIC numbers for authorisation and the legislated PDPA rules on masking such data.

Others highlighted the lack of proper public communication, describing it as a major oversight that caused unnecessary anxiety.

They argued that this could disproportionately affect individuals with anxiety disorders and called for accountability, including a public apology, clear explanations of the changes, and communication in plain language accessible to all age groups.

Netizen Suggests Strengthening Authentication Methods to Combat Threats

Meanwhile, a YT user argued that while NRIC numbers and names themselves are not inherently confidential, but the real threat comes from malicious actors who obtain these details and use them to undermine institutions.

The comment emphasised that it is the responsibility of these institutions to strengthen their authentication methods to protect against such threats.