Govt apologises for Acra lapse, will educate public on proper NRIC use

Efforts to educate the public on the proper use of NRIC numbers will be accelerated, amid uncertainty and anxiety after the disclosure of the identification numbers on the business portal of the Accounting and Corporate Regulatory Authority (Acra) last week.

Plans to consult the private sector on the issue will also be fast-tracked.

At an almost two-hour press conference on Dec 19, Minister for Digital Development and Information Josephine Teo, Second Minister for Finance Indranee Rajah and Acra chief executive Chia-Tern Huey Min apologised multiple times for the anxiety caused.

They also assured Singaporeans that the Government was taking the public’s concerns on the matter seriously.

The move away from the use of masked NRIC numbers is not a U-turn in policy, said Mrs Teo in response to a question from the media.

She explained that the Government has been consistent in its stance on the proper way NRIC numbers should be handled.

The only thing that has changed is that the Government has decided not to use masked NRIC numbers, she said.

This move is meant to protect Singaporeans from the vulnerabilities and risks associated with the incorrect practice of using the number as an authenticator, rather than a unique identifier, said Mrs Teo.

For example, some organisations have started depending on individuals producing their full NRIC numbers as proof of who they are to grant access to privileged information or services – this makes the NRIC an authenticator, beyond simply identification.

Partial NRICs are also not as secure as people think they are, as a good guess of one’s full NRIC can be generated with partial NRIC numbers, especially if the year of birth is known.

Mrs Teo said the Government was intending to address the issue and the false sense of security that has arisen through its broad move to stop using masked NRIC numbers within government functions.

In her opening remarks, she said: “I would firstly like to acknowledge the concerns of the public, which we take very seriously. We are very sorry to have caused them much anxiety.

“We had wanted to give them better protection, and this required a change in our policy involving the use of NRIC numbers.”

The confusion started on Dec 9 when Acra launched its new Bizfile portal, which allowed users to search for individuals linked to business entities. It then provided the full NRICs, along with other information, as part of its aim to provide transparency of business operations.

This caused anxiety and outcry among Singaporeans long used to having NRIC numbers as private and confidential information.

The Ministry of Digital Development and Information’s (MDDI) response on Dec 13 revealed the move as a coordination mishap – Acra had run ahead of the Government’s intent to phase out the use of masked NRIC numbers.

At the press conference, Acra chief executive Chia-Tern said the authority had misunderstood an MDDI circular issued earlier to government agencies to cease any planned use of masked NRIC numbers in new business processes and services.

It had taken this to mean that it should unmask NRIC numbers in its new portal, for example, rendering *****456A as S0123456A.

“This was a mistake on Acra’s part and I apologise for this. Our oversight has caused anxiety and confusion to the public,” she said.

The search function in question was disabled on Dec 13 night, and a new version will be launched next week with search results that do not show any NRIC numbers.

Ms Indranee said that while this change will make it less convenient for some users of Bizfile, the authorities had assessed this to be the right balance to strike between corporate transparency and public concerns regarding personal information.

She added that the ministry and Acra are “thoroughly reviewing the incident to identify areas where we should have done and can do better, including improving the communication and coordination between agencies, and the features of our digital services”.

When asked how many NRICs had been made accessible in the new Bizfile portal, Ms Indranee said that was something the authorities are checking on.

The Government had intended for this move away from the use of masked NRIC numbers to first be a within-government effort, such as in cross-agency functions, said Mrs Teo.

This would improve efficiency and also address a false sense of security regarding the numbers within the Government itself.

The ministry knew that changing mindsets would have to be done over a period of time, and a major effort would be needed to help Singaporeans understand the risks, due to longstanding practices, said Mrs Teo.

Within the government, some steps to do this had already been taken. Agencies were instructed to stop using NRIC numbers as a password or to prove someone is who he claims to be.

They were also told to discontinue the use of masked NRIC numbers, starting with new services first, then followed by existing services as each service is updated, said Mrs Teo.

The ministry had also made plans for a public education campaign covering three broad areas.

These include the risks currently faced with NRIC numbers being used improperly, as well as how Singaporeans can better protect themselves and organisations can change their incorrect practices.

Further down the road, the authorities would need to educate the public on how they view the NRIC number and to return it to its original purpose as a unique identifier, said Mrs Teo.

These were all in the works, and the current situation is not for a want of trying or an unwillingness to communicate, she said.

“All this was at the back of our minds…. This timeline has become very compressed as a result (of this incident),” said Mrs Teo.

“We had thought that we could stage it out properly, but clearly, given people’s anxiety, we’ve got to compress the timeline and do it much earlier,” she said.

The concepts surrounding this change are not easily explained to people and there are different dimensions to consider, such as the difference between not using masked numbers versus unmasking numbers or using other identifiers, she noted.

“Not using masked NRIC numbers does not mean that we will unmask all currently masked NRIC numbers. We should have made this clear,” she said.

There is also a public consultation scheduled for 2025, to get feedback from the private sector and members of the public.

While the Government has made clear its stance on the use of NRIC numbers, it recognises that its usage of the numbers is different from the private sector.

Mrs Teo said the Government has not decided on updated guidelines for private sector usage, adding that consultation is necessary to inform changes to these guidelines set out by the Personal Data Protection Commission.

For now, the guidelines that were issued in 2018 remain valid, stressed Mrs Teo.

Organisations and individuals that have been careful and responsible in how they collect and use NRIC numbers should continue with their current practices.

Those who are using NRIC numbers – full or partial – as a password or authenticator, should stop as soon as possible.

“We are not making drastic overnight changes. We do, however, need to move decisively to phase out the incorrect uses of the NRIC number, the sooner, the better,” said Mrs Teo.