Govt plans to stop masking NRIC numbers, apologises for ACRA publishing details in search results before public education

SINGAPORE: The government said early Saturday (Dec 14) that it intends to change the practice of masking National Registration Identity Card (NRIC) numbers, after privacy concerns were raised over the new Bizfile portal showing people's details for free in its search results.

The Ministry of Digital Development and Information (MDDI) said in response to media queries that the government had planned to make this change "only after explaining the issue and preparing the ground".

However, the Accounting and Corporate Regulatory Authority (ACRA)'s new Bizfile portal had a search function that produced people's names and full NRIC numbers. This new portal was launched on Dec 9, before the government had announced its plans.

"We acknowledge that coordination could have been better so that ACRA’s move would not have run ahead of the government’s intent," said MDDI in its statement.

"We apologise for this mistake and for causing anxiety to the public."

The issue was first raised by former journalist Bertha Henson on Facebook. She posted about how easy it was to access NRIC numbers on Bizfile, a digital service portal for business registration, filing and information. 

Many commenters on Ms Henson's post were surprised and concerned about the privacy of their personal data.

CNA searched several names on the site on Friday morning, and the system came up with a list of people with their names and full NRIC numbers. This appeared to work when CNA searched for some Cabinet ministers on Bizfile.

Under ACRA's previous system, users could search for people who are office holders or business owners in Singapore. Their names, as well as their masked NRIC numbers, would turn up in the search results.

Users could then pay for the complete set of information about an individual, which would include his or her full NRIC number as well as an address. Some people provide a different contact - such as an office address - for the database.

This information is available to support corporate transparency and trust in the business environment.

ACRA acknowledged in a separate statement early Saturday morning that the new portal had displayed a person's full NRIC number in the search results, which meant people no longer have to pay for that information.

"This is in line with the broader government effort to move away from using masked NRIC numbers," it added.

ACRA said it recognised that it had "moved ahead with unmasking" before public education on the appropriate use of NRIC information could be done.

"As a result, many reacted negatively to the new search feature, and expressed unease about their full NRIC numbers being made public," the authority said, adding that the search function has been disabled for now.

"We are sorry for the mistake and for causing anxiety to the public.  We will continue to review and update the Bizfile portal to fulfil our role as the national business register of Singapore."

When CNA tried to use the search feature early Saturday morning, a pop-up message stated: "This service is temporarily unavailable. We apologise for the inconvenience caused."

NRIC NUMBER NOT MEANT TO BE PRIVATE: MDDI

MDDI said in its statement that NRIC numbers are meant to be used to identify individuals and "should be used as such".

"As a unique identifier, the NRIC number is assumed to be known, just as our real names are known," said the ministry.

"There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others."

It added that it has been a practice for some time to use masked NRIC numbers. But there is no need to mask the number, nor is there much value in doing so, said MDDI.

"Using some basic algorithms, one can make a good guess at the full NRIC number from the masked number, especially if one also knows the year of birth of the person."

This is why public agencies are phasing out the use of masked NRIC numbers, so as to avoid giving a "false sense of security", said MDDI.

A problem arises when the NRIC number is misused - for example, when organisations rely on it as a form of authentication to access privileged information or perform privileged transactions.

But just as names alone would not be suitable for such authentication, neither should NRIC numbers, said the ministry.

"Likewise, the NRIC number should not be used as passwords, just as we should not be using our names as passwords. If the NRIC number is used for authentication, it would have to be kept a secret, which would defeat its main purpose as a unique identifier," MDDI added.

The ministry said it recognises that some Singaporeans have "long treated" the NRIC number as private and confidential information, and will need time to adjust to this "new way of thinking".

In 2025, MDDI and the Personal Data Protection Commission (PDPC) will be carrying out public education about the purpose of the NRIC number and "how it should be used freely as a personal identifier".

They will also aim to educate people on how they can protect themselves through the proper use of authentication and passwords.

Since September 2019, organisations in Singapore had to stop the practice of indiscriminately collecting people's NRIC details.

They can only request for it if it is required by law, or if it is necessary to prove your identity. 

In 2018, CNA reported that people could provide a partial NRIC number instead, if the full number was not required by law.