SINGAPORE: The Accounting and Corporate Regulatory Authority (Acra) has temporarily disabled the function allowing people to access the IC numbers of individuals on its new portal.
This is after members of the public surfaced concerns that they were able to access NRIC numbers through a search, without paying, via the Bizfile portal launched on Dec 9.
The authorities clarified, however, that the NRIC number is a unique identifier assigned by the Singapore Government as a means to identify individuals, and should be used as such.
Said a Ministry of Digital Development and Information (MDDI) spokesperson in a statement early on Dec 14: “As a unique identifier, the NRIC number is assumed to be known, just as our real names are known.
“There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others.”
In a separate statement, Acra said that its new Bizfile portal provides the full NRIC, in line with a broader government effort to move away from using masked NRIC numbers.
Said an Acra spokesperson: “We recognise that we had moved ahead with the unmasking before public education on the appropriate use of NRIC information could be done.
“As a result, many reacted negatively to the new search feature, and expressed unease about their full NRIC numbers being made public.
“Acra has therefore disabled the search function for now. We are sorry for the mistake and for causing anxiety to the public.”
MDDI noted that problems arise when the NRIC number is misused, citing examples like when organisations rely on the identifier as a form of authentication to access privileged information or perform privileged transactions.
“But just as our names alone would not be suitable as the basis for such authentication, neither should the NRIC number be used for this purpose,” said MDDI. It added that NRIC numbers, just as names, should not be used as passwords.
“If the NRIC number is used for authentication, it would have to be kept a secret, which would defeat its main purpose as a unique identifier,” said MDDI.
Acknowledging that there has been a practice of using masked NRIC numbers (for example, rendering S0123456A as *****456A), MDDI said that there is no need, and not much value to mask the NRIC number.
“Using some basic algorithms, one can make a good guess at the full NRIC number from the masked number, especially if one also knows the year of birth of the person. That is why public agencies are phasing out the use of masked NRIC numbers to avoid giving a false sense of security,” said MDDI.
It added that the Government’s intent was to change the existing practice of masking the NRIC number only after explaining the issue and preparing the ground.
“We acknowledge that coordination could have been better so that Acra’s move would not have run ahead of the Government’s intent. We apologise for this mistake and for causing anxiety to the public,” said MDDI.
The ministry added: “We recognise that some Singaporeans have long treated the NRIC number as private and confidential information, and will need time to adjust to this new way of thinking about the NRIC number.”
In the coming year, MDDI and the Personal Data Protection Commission will be conducting a public education effort about the purpose of the NRIC number, and how it should be used freely as a personal identifier in the same way names are used, as well as the correct steps Singaporeans ought to take to protect themselves, which involve proper use of authentication and passwords. - The Straits Times/ANN
