Use of NRIC numbers – Acra jumped the gun
Singapore’s data privacy watchdog is updating guidelines on how National Registration Identity Card (NRIC) numbers can be collected, used and shared.
This follows a Dec 14 statement that the Government intends to move away from the practice of masking NRIC numbers.
Checks on the Personal Data Protection Commission’s (PDPC) website show that the guidelines are no longer available.
A notice on the website says: “The document is temporarily unavailable as it is undergoing updates.”
ST has contacted the Infocomm Media Development Authority, which the PDPC is part of, for more details.
In its 2018 guidelines, the commission had advised people not to provide their full NRIC numbers to companies, unless doing so was legally required or needed to prove one’s identity.
NRIC numbers “can potentially be used to unlock large amounts of information relating to the individual”, it noted.
It advised them instead to provide other personal data, such as handphone numbers or partial NRIC numbers (for instance, by rendering S0123456A as ****456A), for verification.
On Dec 9, the Accounting and Corporate Regulatory Authority (Acra) launched its new Bizfile web portal, which allowed people to view others’ full NRIC numbers using a search function for free, without having to log in. This function was temporarily disabled on Dec 13 following public backlash.
But in its Dec 14 statement, the Ministry of Digital Development and Information (MDDI) said people can make a good guess at someone’s full NRIC number from the masked number using basic algorithms, “especially if one also knows the year of birth of the person”.
As such, the ministry said “there is no need to mask the NRIC number, nor is there much value in doing so”.
It said the Government had intended to change the existing practice of masking NRIC numbers “only after explaining the issue and preparing the ground”.
Acra’s move on its Bizfile portal had “run ahead of the government’s intent”, said MDDI. It apologised for not co-ordinating better between agencies, and causing public anxiety.
As a public agency, Acra is exempt from provisions under the Personal Data Protection Act (PDPA) – the set of laws that govern the collection, use and disclosure of personal data by organisations.
Singapore Management University Associate Professor of Law Eugene Tan said the government’s Dec 14 stance is consistent with the PDPA, but “at odds with the public understanding and comfort level” on the use of NRIC numbers.
“The official shift in practice towards revealing full NRIC numbers cannot simply ignore this lived reality,” said Prof Tan.
“Singaporeans have been socialised into being sensitive to having their full NRIC number made public, and have accepted and internalised this.”
A public education campaign could “re-socialise people’s and organisation’s approach towards the non-masking of NRIC numbers”, he suggested.
Only when non-masking NRIC numbers is “widely practised and accepted” should public agencies proceed with using full NRIC numbers where necessary, said Prof Tan.
MDDI has said it will conduct public education efforts with the PDPC in 2025.
These will address how NRIC numbers “should be used freely as a personal identifier in the same way we use our names, as well as the correct steps we ought to take to protect ourselves, which involve proper use of authentication and passwords”, said the ministry.
Get The New Paper on your phone with the free TNP app. Download from the Apple App Store or Google Play Store now