SINGAPORE: There was no “deliberate wrongdoing or wilful inaction” by government officers involved in the events leading to full National Registration Identity Card (NRIC) numbers being displayed on a business portal last December.
A report by the review panel set up to look into the incident said on Monday (Mar 3) that it was a “confluence of several shortcomings” that resulted in NRIC numbers being unmasked on the Accounting and Corporate Regulatory Authority’s (ACRA) Bizfile portal.
The panel, chaired by the head of civil service Leo Yip, was asked to review the government’s policy on responsible use of NRIC numbers, determine what led to the Bizfile incident and identify learning points to avoid similar incidents in future.
“While the panel did not find any factual evidence of deliberate wrongdoing or wilful inaction by the (Ministry of Digital Development and Information) and ACRA officers involved in this incident, it found several shortcomings by both ACRA and MDDI in this incident, which should have been avoided,” the Prime Minister’s Office said in a press release.
The panel submitted its report to Senior Minister and Minister-in-charge of the Smart Nation Group Teo Chee Hean on Feb 25. Prime Minister Lawrence Wong approved the report for public release on Feb 27. Mr Teo will deliver a ministerial statement on the report on Mar 6 in parliament.
ACRA, its parent ministry the Ministry of Finance, and MDDI accepted the panel’s findings and laid out the steps being taken to address the shortcomings.
Last December, there was a public outcry over privacy concerns when queries made on ACRA’s Bizfile portal produced full NRIC numbers for free in search results.
ACRA chief executive Chia-Tern Huey Min said a “lapse of coordination” and a misunderstanding led to the NRIC numbers being unmasked.
TIMELINE OF EVENTS
In August 2022, the former Smart Nation and Digital Government Office (SNDGO), which is now part of MDDI, began reviewing the policy on the use of NRIC numbers.
The intention was to stop the incorrect use of NRIC numbers for authentication and to move away from the use of partial NRIC numbers.
SNDGO issued a circular to government agencies in September 2023 addressing the first issue – the incorrect use of NRIC numbers for authentication. NRIC numbers are meant to identify people, rather than prove that they are who they claim to be.
Separate from the SNDGO’s review, ACRA in early 2024 proposed that it start providing partial NRIC numbers instead of full NRIC numbers when users purchase a People Profile on the Bizfile portal.
