SINGAPORE: She loves me. She loves me not. She loves me. She loves me not.
Our beloved National Registration Identity Card (NRIC) must have recently felt like a teenager entering a sea of raging hormones and feeling overwhelmed.
Upon receiving an internal circular signalling a broader policy shift to gradually move away from using NRIC numbers as a method of authentication, the Accounting and Corporate Regulatory Authority (ACRA) misunderstood it as a green light to unmask the numbers in the roll-out of its new Bizfile portal.
Once netizens discovered that the Bizfile portal’s people search function was turning up NRIC numbers as well, a furore ensued. ACRA has since withdrawn that feature and apologised for the confusion.
A LEGACY SYSTEM MOVING INTO A DIGITAL WORLD
The NRIC was introduced in a time when modes of identity verification were primarily physical. It was used to ascertain individuals’ identities for all types of actions and transactions – entry into buildings, opening and operating bank accounts, registration for government services.
For many, it was associated with the ability to access or exercise one’s rights and privileges living in Singapore. However, its use quickly expanded over time to extend to other less formal purposes – announcing the winners of lucky draw prizes, for instance, and even as security for the renting of leisure bicycles, leading to worries that the NRIC had been “cheapened”.
This (and similar) practices were legislated away with the introduction of the Personal Data Protection Act, which by its guidelines restricted the use of NRICs and mandated the masking of NRIC numbers where their use was needed or involved. The love had returned.
Today, it has evolved into a multi-purpose identifier used across government agencies, private businesses, and digital platforms. Its ubiquitous use has made it indispensable – but this convergence has also made it a possible single point of failure.
In the recent Bizfile portal fuss, there was a moment where it felt as if the NRIC was going to be abandoned – damaged beyond repair. However, assurances and explanations by the government suggest that it still has a role to play, albeit a different one than previously assumed.
ACRA’s mishap highlights the vulnerabilities of such centralised systems. If compromised, the fallout affects not just personal privacy but also national security and public trust.
This incident also reignited a critical conversation about the role and security of the NRIC in Singapore.
