SINGAPORE – The Singapore government has apologised after a misstep led to the accidental disclosure of full national registration identity card (NRIC) numbers on a public business portal.
The mishap, caused by a misunderstanding between agencies, sparked anxiety and outrage among Singaporeans who view their NRIC numbers as sensitive and private information.
At a press conference yesterday, which has been published as clips by several outlets and the general public on social media, Digital Development and Information Minister Josephine Teo expressed regret, saying, “We are very sorry to have caused much anxiety. We had wanted to give them better protection, and this required a change in our policy involving the use of NRIC numbers.”
The government had been planning to phase out the use of masked NRIC numbers – those partially obscured like “*****456A” – to improve data security. Officials believed that masking NRIC numbers gave a false sense of protection, as masked numbers could still be guessed by combining them with other available information, such as the year of birth.
The issue arose on December 9 when the Accounting and Corporate Regulatory Authority (Acra) launched an updated version of its Bizfile portal. The new system, designed to provide transparency in business dealings, inadvertently made full NRIC numbers searchable alongside the names of individuals linked to business entities.
Acra’s chief executive Chia-Tern Huey Min explained that the problem stemmed from a misinterpretation of a government directive.
“The Digital Development and Information Ministry (MDDI) had in July issued a circular for government agencies to cease any planned use of masked NRIC numbers in new business processes and services,” she said.
“Unfortunately, there was a lapse of coordination between the staff on how this was to be implemented. Acra then proceeded on the misunderstanding that it should unmask NRIC numbers in the new Bizfile portal,” she added.
Chia-Tern apologised for the incident, acknowledging the concerns raised by the public.
“As the owner of the Bizfile portal, Acra should have been more mindful that many Singaporeans have long treated their NRIC numbers as private and confidential information, and would not want to have their full NRIC numbers searchable on the new portal,” she said during the press conference.
The disclosure prompted a strong public reaction, leading the government to disable the search function on December 13 with a new version of the portal that excludes NRIC numbers will be launched next week.
Second Finance Minister Indranee Rajah clarified the situation, emphasising that the move to phase out masked NRIC numbers does not equate to unmasking them.
“Ceasing the use of partially masked NRIC numbers does not mean that masked NRIC numbers should necessarily become unmasked,” she said.
Indranee explained how the misunderstanding occurred. “That’s exactly what Acra thought too, so I’m just trying to illustrate that that’s how the error occurred,” she said.
She also noted that while the updated portal aimed to balance corporate transparency and data privacy, the unmasking of NRIC numbers tipped the scales.
“While this change will make it less convenient for some users of Bizfile, the authorities had assessed this to be the right balance to strike,” she said.
The government had originally planned to gradually phase out masked NRIC numbers, beginning with internal systems and followed by a public education campaign. However, the incident accelerated the timeline.
Josephine Teo highlighted the broader risks of using NRIC numbers improperly, particularly as authenticators for access to sensitive information.
“Partial NRIC numbers are also not as secure as people think they are, as a good guess of one’s full NRIC number can be generated with partial numbers, especially if the year of birth is known,” she said.
Teo also acknowledged that the government had intended to roll out the policy change in a phased manner with proper communication.
The MDDI and Acra are now reviewing the incident to identify weaknesses in coordination and communication.
Chia-Tern also expressed Acra’s commitment to tightening processes and ensuring sensitive data is handled more carefully in the future.
Meanwhile, Indranee said it was premature to determine whether any staff members would face disciplinary action.
“This is an instance of a misunderstanding. One has to ascertain exactly how that came about and have a look at the full facts, before deciding on what, if anything, needs to be done,” she said.
The government also acknowledged the public’s frustration over the five-day delay between the incident and the first media statement, explaining that: “Before (yesterday’s) press conference could be convened, more thorough checks had to be done all the way down to the staff level, as the situation occurred suddenly and also involved multiple parties, with two ministries and one agency,” Indranee explained.
“We are not making drastic overnight changes. We do, however, need to move decisively to phase out the incorrect uses of the NRIC number, the sooner the better,” said Teo.
For now, existing guidelines on the use of NRIC numbers, issued by the Personal Data Protection Commission in 2018, remain valid. The government has assured citizens that it will work to regain public trust and ensure sensitive information is better protected.
“If things had gone according to plan, we would have had the chance to do the proper communications. And that is just really something that should not have happened, but it did happen, and for which we are very sorry,” said Teo. – December 20, 2024