Government apologises for unmasking Singaporeans’ full NRIC numbers in Bizfile portal

The unmasking of Singaporeans’ full NRIC numbers on the Bizfile portal, which sparked public outcry and privacy concerns, has been attributed to a “lapse in coordination” between government agencies.

A week after the issue surfaced, Minister for Digital Development and Information Josephine Teo and Accounting and Corporate Regulatory Authority (ACRA) Chief Executive Chia-Tern Huey Min addressed the matter at a press conference on 19 December 2024, expressing regret over the mistake.

Teo stated: “I would firstly like to acknowledge the concerns of the public, which we take very seriously. We are very sorry to have caused them much anxiety.”

The incident arose from a misunderstanding of an internal circular issued by the Ministry of Digital Development and Information (MDDI) regarding the use of NRIC numbers in government services. While the circular aimed to phase out masked NRIC numbers internally, ACRA mistakenly applied the directive to its public-facing Bizfile portal.

How the lapse occurred

On 9 December, ACRA launched a new Bizfile portal, enabling public searches on business-associated individuals. Unlike the previous system, which masked NRIC numbers, the new portal allowed full NRICs to be accessed publicly.

Former Straits Times editor Bertha Henson, on 12 December, highlighted this, which then sparked a huge reaction from the public.

The unmasking stemmed from ACRA’s interpretation of MDDI’s circular, which directed agencies to cease using masked NRIC numbers. This directive was intended for internal processes but was misapplied to the public-facing platform.

The rationale behind unmasking

Teo explained that the government sought to discontinue the masking of NRIC numbers to address the false perception that these identifiers were confidential.

“Because the main purpose of the NRIC is to be a unique identifier, it cannot be a secret, just as our names are not secret.”

However, the widespread use of NRICs as both identifiers and authenticators in accessing services has made individuals vulnerable to identity theft and fraud. Partial NRIC numbers, combined with other personal information, can be reconstructed using algorithms to deduce full NRIC numbers.

“This is not a good idea,” Teo said, emphasising the need to reduce reliance on NRIC numbers as authenticators.

Addressing public concerns

Second Minister for Finance Indranee Rajah acknowledged the public’s frustration, clarifying that the issue resulted from miscommunication.

“The plan was to have a phased-out sequence with public communications. But what happened in this instance is that… the [NRIC] numbers inadvertently got put out, and then everything got accelerated,” she said.

Indranee added that measures are being implemented to rectify the error, including enhanced coordination and updated guidelines on NRIC usage.

Temporary suspension and future steps

ACRA has disabled the “People” search feature in the Bizfile portal. The function will be reinstated in the week of 23 December without NRIC numbers, either full or partial.

Additionally, the Personal Data Protection Commission (PDPC) will update its guidelines to ensure appropriate use of NRICs across sectors.

Teo clarified that unmasking NRIC numbers does not mean their full disclosure in all situations. For instance, NRICs may be required in healthcare settings but should not be used for non-critical purposes like lucky draws.

“We will start by focusing on the incorrect uses of NRIC numbers, and stopping such practices,” she stated.

Commitment to improve

Indranee reiterated the government’s commitment to learning from the incident, saying, “MOF and ACRA will learn from this episode and setback. We are thoroughly reviewing the incident to identify areas where we should have done and can do better.”

She assured that public feedback would inform ongoing improvements to the Bizfile portal and related digital services.

MDDI’s earlier clarification

In its response to media queries on 13 December, MDDI outlined the role of NRIC numbers as unique identifiers, akin to an individual’s name:

“The NRIC number is assumed to be known, just as our real names are known. There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others.”

The ministry emphasised that the issue arises from misuse of NRIC numbers, particularly when organisations rely on them for authentication to access sensitive information or conduct transactions. This, MDDI stated, is inappropriate.

“If the NRIC number is used for authentication, it would have to be kept a secret, which would defeat its main purpose as a unique identifier.”

MDDI also addressed the use of masked NRIC numbers (e.g., S0123456A rendered as ****456A), noting that this practice provides a “false sense of security.” Algorithms, combined with partial identifiers like birth year, can potentially reconstruct full NRIC numbers, the ministry explained.