Govt intends to stop masking NRIC numbers, says there is not 'much value in doing so'

The government intends to move away from the practice of masking the National Registration Identity Card (NRIC) number, the Ministry of Digital Development and Information (MDDI) said in a statement on Dec. 13.

The statement was made in response to media queries on the disclosure of NRIC number on the Accounting and Corporate Regulatory Authority's (ACRA) new Bizfile portal.

The change would be made "only after explaining the issue and preparing the ground".

"We acknowledge that co-ordination could have been better so that ACRA's move would not have run ahead of the government's intent," the statement read.

"We apologise for this mistake and for causing anxiety to the public."

There should not be any sensitivity in having one's full NRIC number made public

The NRIC is a permanent and irreplaceable identifier issued by the Singapore Government as a means to identify individuals.

"As a unique identifier, the NRIC number is assumed to be known, just as our real names are known," said MDDI in the statement.

As such, there should "not be any sensitivity in having one's full NRIC number made public".

The problem lies only when NRIC number is misappropriated, which could happen when organisations rely on NRIC numbers as a form of authentication to gain access to information or to perform transactions.

However, using NRIC number as a means for authentication would mean it would have to be kept a secret, "which would defeat its main purpose as a unique identifier".

Not "much value in doing so"

While there has been some practice of using masked NRIC numbers, MDDI stressed there is no need for such practice as there is not "much value in doing so".

The statement added that one can make a good guess at the full NRIC number from the masked numbers with basic algorithms, especially if the year of birth of the person is known.

"We recognise that some Singaporeans have long treated the NRIC number as private and confidential information, and will need time to adjust to this new way of thinking about the NRIC number," the statement read.

In the coming year, MDDI and the Personal Data Protection Commission (PDPC) intend to raise awareness on the correct steps to protect ourselves, which involve the proper use of authentication and passwords.

Full disclosure of NRIC number "in line with broader government effort"

In response to media queries, ACRA said the full disclosure of full NRIC numbers in the Bizfile system is "in line with the broader government effort to move away from using masked NRIC numbers".

The statutory board said that as the national business registry of Singapore, one of its functions is to provide access to information, including full NRIC numbers, so businesses can confirm the identity of the individuals associated with the businesses.

The availability of this information "supports corporate transparency and trust in the business environment" as well as facilitates diligence checks and guards against illicit activities.

ACRA's previous Bizfile portal provides an individual's masked NRIC numbers. One could then pay for a complete set of information about an individual, which would include his or her full NRIC number, as well as address.

The new Bizfile portal retains the same feature but provides the full NRIC instead of the masked NRIC.

"We recognise that we had moved ahead with the unmasking before public education on the appropriate use of NRIC information could be done," the statutory board said.

Function disabled for now

ACRA has disabled the search function for now.

When Mothership tried out the feature on Saturday morning (Dec. 14), a pop-up message wrote: "This service is temporarily unavailable. We apologise for the inconvenience caused."

"We are sorry for the mistake and for causing anxiety to the public. We will continue to review and update the Bizfile portal to fulfil our role as the national business register of Singapore," ACRA said in its statement.

Top image via ICA and Bizfile