Government’s backtracking on NRIC unmasking and the miscommunication excuse

The unmasking of Singaporeans’ full NRIC numbers on ACRA’s new Bizfile portal has sparked widespread public concern about data privacy and government accountability.

The incident, which came to light following the portal’s launch on 9 December 2024, enabled users to access unmasked NRIC numbers through public searches—a notable shift from the previous practice of masking such information, as highlighted by former Straits Times editor Bertha Henson.

Initially, the government defended the move. On 13 December, statements from ACRA and the Ministry of Digital Development and Information (MDDI) justified the unmasking as part of a broader policy shift to phase out masked NRICs, which were described as creating a “false sense of security.”

However, public backlash quickly mounted, with Singaporeans questioning the exposure of sensitive data and the lack of prior consultation or safeguards.

At a press conference on 19 December, a week after the revelation, Minister for Digital Development and Information Josephine Teo, Second Minister for Finance Indranee Rajah and Chief Executive of ACRA, Chia-Tern Huey Min, addressed the controversy.

They apologised for the anxiety caused but framed the incident as a result of a “miscommunication” between ACRA and MDDI, stemming from a circular issued in July.

The ministers also clarified that the policy shift applied only to government agencies, with private sector guidelines remaining unchanged pending consultation.

This apparent backtracking from a nationwide policy to a government-only approach, coupled with the explanation of miscommunication, raises serious questions about policy consistency, accountability, and communication.

From a Nationwide Policy to a Government-Only Approach

On 13 December, ACRA and MDDI statements presented the unmasking of NRICs as part of a broader, nationwide effort to phase out masked numbers following public outcry.

• ACRA explicitly aligned its actions with the government’s intent, describing the display of full NRICs as necessary for corporate transparency and trust.
• Similarly, MDDI downplayed sensitivity concerns, equating NRICs to names and labelling masking as ineffective and unnecessary.

By 19 December, however, the government’s stance had shifted.

Minister Josephine Teo clarified that the decision to stop using masked NRICs applied only to government agencies, and that private sector policies remained unchanged.

She emphasised the need for consultation before extending the policy to private entities, effectively limiting what was initially portrayed as a national policy.

This shift represents a clear backtrack in framing. The government pivoted from justifying the unmasking as part of a deliberate, broad policy to characterising it as a misunderstanding by ACRA.

This reframing raises critical questions:

• Was the original justification for unmasking accurate? If unmasking NRICs was essential for transparency and corporate trust, why has the policy been limited to internal government use?
• Did public backlash influence the shift? The reversal suggests a reactive approach to managing public concerns rather than a coherent, well-communicated policy.

The Miscommunication Explanation Doesn’t Add Up

The government attributed ACRA’s actions to a “miscommunication” over a circular issued by MDDI in July 2024.

This explanation is problematic for several reasons:

1. The Timeline and Review Process

The circular was issued five months before the portal launched in December. A project of this scale would have involved:

• Extensive planning: Determining how NRICs would be displayed.
• Multiple approvals: Senior executives, including the Chief Executive, would have signed off on key features.
• Testing and reviews: Any misunderstanding of the circular should have been identified and corrected during these stages.

It is difficult to believe that such a significant misunderstanding could persist unnoticed over five months.

2. Chain of Accountability

The decision to unmask NRICs in Bizfile could not have been made unilaterally by mid-level staff. Such a move would require explicit approval from ACRA’s leadership, given its privacy and reputational implications. The explanation of miscommunication shifts blame to staff while avoiding scrutiny of the senior executives responsible for oversight.

3. The Role of Documentation

Decisions of this nature are never made informally. They are documented in directives, emails, and project plans. If miscommunication truly occurred, where is the evidence? Why hasn’t the government released relevant communications to clarify how the error took place?

Contradictions in NRIC Sensitivity

For decades, Singaporeans were told that NRICs are sensitive and must be safeguarded. This principle was reinforced by the 2018 PDPC guidelines, which restricted the collection and use of NRICs.

Yet, in both the 13 December statements and the 19 December press conference, the government dismissed these concerns, equating NRICs to names and portraying public anxiety as misplaced.

This shift is troubling for two reasons:

• It undermines trust. After decades of messaging that NRICs are sensitive, Singaporeans are now being told their concerns are overblown. This sudden reversal erodes confidence in the government’s data policies.
• It ignores risks. While the government insists NRICs are identifiers, not authenticators, bad actors can misuse them, especially when combined with other personal information.

The Removal of NRICs in Bizfile: A Further Backtrack

The decision to remove NRICs entirely—both masked and unmasked—from Bizfile’s “People” search is another policy reversal.

• On 13 December, ACRA argued that displaying full NRICs was critical for transparency and due diligence.
• By 19 December, the government announced that NRICs would no longer appear in the search results.

This reversal undermines the original justification and suggests that the decision to unmask NRICs was poorly thought out or communicated.

A Crisis of Communication and Accountability

The government’s handling of the NRIC unmasking incident highlights flaws in policy communication, decision-making, and accountability. The shift from a nationwide policy to a government-only approach, coupled with vague explanations of miscommunication, raises significant concerns.

Singaporeans deserve transparency, consistency, and accountability from their government. Until these issues are addressed, public trust in how sensitive data is handled will remain fragile.