ADDRESSING THE SHORTCOMINGS
MDDI and ACRA also laid out the steps they will take in light of the Bizfile incident.
The ministry said it is developing further guidance to government agencies on how to apply the policy on NRIC numbers.
It has identified close to 800 existing use cases of partial NRIC numbers in public-facing systems, each with their specific context and characteristics.
MDDI said it would improve coordination with agencies to support them in the implementation.
It will also strengthen internal processes and staff training to provide clear explanations of the broader policy context and considerations when issuing directives.
The ministry has also reminded agencies of the government’s existing data management policies and standards regarding the collection, use and disclosure of personal data, including NRIC numbers. It will conduct refresher briefings to reinforce understanding.
MDDI said the government remains committed to protecting the personal data of citizens. It will also consult industry and the public before making any changes in guidelines on the use of NRIC numbers in the private sector.
ACRA said it would improve communications internally and externally so that important information is sufficiently shared and leaders can make informed decisions.
It will also conduct more regular system reviews to evaluate data security and protection risks, and implement appropriate security measures if vulnerabilities are found. Such reviews will especially be conducted before, during and after major IT system changes.
ACRA said it will strengthen oversight of vendors to ensure that systems are implemented effectively and in line with requirements. For Bizfile, a review by the Government Technology Agency (GovTech) found that some security features were not adequately implemented.
The agency will refine its vendor management framework to put additional safeguards in place.
MOF said it would support ACRA in its follow-up actions and share the learning points with other MOF agencies.
“We are taking the necessary steps to ensure such incidents do not recur.”
In response to queries from CNA, ACRA said it is studying alternative approaches, such as adding new search parameters, to the People Search function that will meet users’ needs while addressing data protection concerns.
The NRIC number will continue not to be shown on the results of People Search, said a spokesperson.
