S'poreans' NRIC numbers publicly listed on new ACRA website, no login or payment required

A recently-launched digital portal by the Accounting and Corporate Regulatory Authority (ACRA) was found to have a somewhat alarming new feature: the ability to search for citizens' NRIC numbers.

Through the platform's new "People Profile" feature, Singaporeans' full NRIC numbers can be searched, simply by keying in the citizen's name.

The feature was described as a means to help users "search for business information" and "[track] the business entities a person is/was involved in", according to the website.

As at 2:45pm on Dec. 13, the feature still appears to be available.

Cabinet ministers, everyday citizens

When Mothership tried out the feature on Dec. 13, we were able to access the NRIC details of quite a few Singapore Citizens — including ourselves.

The NRIC numbers of many public figures — including cabinet ministers — were readily available.

The information was also available for free, without the need to login to the platform.

However, interested parties can purchase a "full profile" — with additional information, like a citizen's residential address — for S$33.

Former Straits Times associate editor Bertha Henson said in a Facebook post that once she learnt of the new feature, she reported it to the Ministry of Digital Development and Information (MDDI).

She believed that it might have been a glitch as the new platform — dubbed Bizfile — only went live several days ago, on Dec. 9.

"I also got a call from a PDPC officer (he named himself) who tried telling me that PDPA did not apply to ACRA," she wrote.

"I said I knew about that but it simply cannot be the case that IC numbers are so easily obtainable. Isn’t the practice to give a partial IC number when an identity is called for?"

In a Frequently Asked Questions segment about the platform, ACRA explained that the NRIC numbers are not masked to allow for "clear and unambiguous identification of individuals associated with businesses".

"By providing access to full identification numbers, ACRA helps to promote transparency in Singapore's business environment," it said.

PDPA exemption

In 2019, the Personal Data Protection Commission (PDPC) announced that organisations would be legally barred from collecting, using, or disclosing NRIC numbers.

Part of a series of updated guidelines to protect Singaporeans' personal data, the regulation — which falls under the Personal Data Protection Act — comes with a financial penalty of up to S$1 million.

Singaporeans can also refuse to disclose their full NRIC numbers, unless required by law, or when it is necessary to identify a person to a high degree of accuracy.

However, public sector organisations — including ACRA, which is a statutory board under the Ministry of Finance — are exempt from the guidelines.

In an article explaining the rationale behind the law, the PDPC said at the time that the "indiscriminate collection or negligent handling of NRIC numbers can increase the risk of unintended disclosure and may result in NRIC numbers being used for illegal activities such as identity theft or fraud".

The website further explains that NRIC numbers are "permanent and irreplaceable", and are issued by the government primarily for public administration purposes, and to facilitate transactions with the government.

Mothership has reached out to the Ministry of Digital Development and Information for comment.

Top image from ACRA Bizfile and ACRA/Facebook