NRIC number should be used freely as a personal identifier, no need to mask it: MDDI
In future, Singaporeans’ NRIC numbers might be as accessible as our names as the Government intends to stop the existing practice of masking them.
That’s according to a statement from the Ministry of Digital Development and Information (MDDI), which said there is “no need to mask the NRIC number”.
Not much value to mask NRIC number as people can guess the full number: MDDI
For some time, Singapore has followed the practice of masking NRIC numbers by replacing the first four numbers with asterisks, leaving only the last three numbers and the letter.
There is not much value to doing this, MDDI said, as people can “make a good guess” at the full number using basic algorithms, “especially if one also knows the year of birth of the person”.
As the NRIC number is a unique identifier, it “is assumed to be known, just as our real names are known”, explained MDDI, adding:
There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others.
NRIC numbers shouldn’t be used for authentication purposes
However, a problem will arise when the NRIC number is misused, MDDI noted.
This may happen when NRIC numbers are used to access privileged information or perform privileged transactions.
NRIC numbers should not be used for authentication purposes, MDDI said, just like our names alone wouldn’t be enough for doing so.
Neither should NRIC numbers be used as passwords, the ministry added, saying:
If the NRIC number is used for authentication, it would have to be kept a secret, which would defeat its main purpose as a unique identifier.
Source: Glenn Carstens-Peters on Unsplash. Photo for illustration purposes only.
Thus, public agencies are phasing out the use of masked NRIC numbers “to avoid giving a false sense of security”.
NRIC guidelines will be updated: PDPC
Accordingly, the website of the Personal Data Protection Commission (PDPC) said it would be updating its advisory guidelines for NRIC and other national identification numbers.
The guidelines, which were temporarily unavailable, remain valid in the meantime, the message said.
In a statement issued on Saturday (14 Dec), PDPC said it will not be making any further changes to the guidelines until consultations with industry and members of the public have been completed.
“The guidelines will then be updated to align with the new policy intent,” it added.
Referring to MDDI’s earlier statement, PDPC also said NRIC numbers shouldn’t be used as passwords or for authentication purposes. Organisations using them in such a way should phase out such practices as soon as possible.
Acknowledging the questions and feedback from the public on NRIC numbers, PDPC said:
We are sorry for the confusion caused to the public and will fully address the public’s concerns and questions as soon as possible.
Full NRIC numbers found on ACRA platform
The issue came to the fore when veteran Singaporean journalist Bertha Henson raised concerns that Singaporeans’ full NRIC numbers could be found on the Accounting and Corporate Regulatory Authority’s (ACRA’s) Bizfile platform, which was launched on 9 Dec.
This included the NRIC numbers of political leaders, deceased individuals and those who had never had shareholdings or positions in businesses.
She questioned whether this was a breach of the Personal Data Protection Act (PDPA), warning that this information could easily be exploited for identity theft or other malicious purposes.
Acra and other government organisations are exempted from the PDPA.
Govt planned not to mask NRIC number but ACRA’s move had ‘run ahead’
In response, MDDI said the Government had already intended to change the existing practice of masking the NRIC number.
However, it planned to do so only after explaining the issue and preparing the ground.
ACRA’s move had “run ahead” of the Government’s intent, and MDDI acknowledged that “co-ordination could have been better”, adding:
We apologise for this mistake and for causing anxiety to the public.
In its reply to Ms Henson, ACRA referenced MDDI’s statement, saying Bizfile provides a full NRIC number rather than the masked one “in line with the broader government effort to move away from using masked NRIC numbers”.
Source: Bertha Henson on Facebook
Public education effort on NRIC numbers to be conducted
MDDI said some Singaporeans will need time to “adjust to this new way of thinking about the NRIC number”, having treated it as private and confidential information.
Thus, MDDI and PDPC will be conducting a public education effort about the NRIC number.
This includes its purpose, how it should be “used freely as a personal identifier” and the correct steps to protect ourselves, involving “proper use of authentication and passwords”.
Have news you must share? Get in touch with us via email at news@mustsharenews.com.
Featured image from TheSmartLocal.
