Bertha Henson highlights NRIC exposure on ACRA’s Bizfile
Veteran Singaporean journalist Bertha Henson has raised concerns over a privacy issue involving the Accounting and Corporate Regulatory Authority’s (ACRA) Bizfile platform, which has made individuals’ full NRIC numbers publicly accessible.
On Thursday (12 Dec), Ms Henson shared the issue on her Facebook page, providing a detailed explanation of her findings.
She revealed that any member of the public can visit the Bizfile website, search for a name under the “People” section, and view the corresponding NRIC number.
Ms Henson emphasised the potential dangers of exposing full NRIC numbers in such a public manner, warning that this information could easily be exploited for identity theft or other malicious purposes.
ACRA, a statutory board responsible for regulating business entities, financial reporting, public accountants, and corporate service providers, launched the Bizfile platform on 9 Dec.
The website allows users to file business-related transactions.
As a government agency, ACRA is exempt from the Personal Data Protection Act (PDPA).
NRIC numbers of non-business owners also exposed
Ms Henson reported that the NRIC numbers made publicly available on the Bizfile platform were linked to individuals who were not business owners.
To test the system, she searched using her own name, as well as the names of a friend, his sister, and his mother.
All of them were returned with their NRIC numbers.
Although Ms Henson previously owned a business, none of her family members or friends were shareholders, directors, or held any business positions.
In addition, Ms Henson was able to track the NRIC numbers of political leaders, including those of deceased individuals.
MS News searched for several prominent political figures and found results displaying their NRIC numbers, along with an option to purchase their profiles for S$33.
Searches for some MS News team members also yielded results.
However, Ms Henson noted that not all personal information was accessible, describing the exposure as a “random selection”.
ACRA to review whether displaying full NRIC numbers is necessary
Ms Henson contacted three departments to address the issue: the Ministry of Digital Development and Information, the Personal Data Protection Commission (PDPC), and a contact at the Ministry of Finance.
She received a response from a representative at the Government Data Security Contact Centre, who informed her that it would take 10 to 15 working days to respond to her query.
“I can forgive a templated reply but I cannot understand why something like this would take so long nor the need for a civil servant to have anonymity when engaging with the public,” the former news editor remarked.
Later in the afternoon, the same person sent another email to Ms Henson, explaining that ACRA has “always displayed the full NRIC in their information products” to “enhance the transparency and trust in business environments”.
However, acknowledging the importance of protecting personal data, the representative assured Ms Henson that ACRA would review whether displaying full NRIC numbers in the public register is necessary.
Ms Henson noted that the response did not provide any details on the progress of the review or any conclusions reached.
“Will it be status quo or is it conceding that giving partial IC numbers is enough?” she questioned.
MS News has reached out to ACRA for further comments.
Also read: S’porean journalist raises questions on Lee Wei Ling’s passing & revisits debate on Oxley Road House
Have news you must share? Get in touch with us via email at news@mustsharenews.com.
Featured image adapted from Bizfile and by TheSmartLocal, for illustration purposes only.