[Singapore] NRIC numbers: brief background and personal thoughts
I had planned to spend the weekend writing a post about an interesting China court case, but my WhatsApp was buzzing with many chatgroups complaining about the NRIC issue and friends asking what I thought. I was also reading the surprising number of media articles that sprung up to discuss this issue, though they started to go off tangent. A friend pointed out that one article even went on to talk about quantum computing 😂
I laugh here but there’s so much muddy chatter and unclear messaging that I think laypersons and younger DPOs can get confused about what the position is.
At the end of the day, business people and busy people just want to know one thing: any change? If so, what?
Answer: No change. Wait for further guidance from PDPC.
With this settled, I want to share some personal thoughts.
But first, a quick background for foreign friends reading this post. Singaporeans, you can skip the next section and scroll down to the section ‘Some personal thoughts’.
Brief background
On 31 Aug 2018, the PDPC published the Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers. It stated that:
The Singapore National Registration Identification Card (“NRIC”) number is a unique identifier assigned by the Singapore Government to Singapore citizens and permanent residents of registrable age under the National Registration Act. It is often used for transactions with the Government as well as in commercial transactions. The NRIC number of an individual is considered personal data as the individual can be identified from the unique sequence of numbers and letters.
As the NRIC number is a permanent and irreplaceable identifier which can potentially be used to unlock large amounts of information relating to the individual, the collection, use and disclosure of an individual’s NRIC number is of special concern. Indiscriminate or negligent handling of NRIC numbers increases the risk of unintended disclosure with the result that NRIC numbers may be obtained and used for illegal activities such as identity theft and fraud.
Organisations are generally not allowed to collect, use or disclose NRIC numbers (or copies of NRIC). They may do so only in the following specified circumstances:
a) Collection, use or disclosure of NRIC numbers (or copies of NRIC) is required under the law (or an exception under the PDPA applies); or
b) Collection, use or disclosure of NRIC numbers (or copies of NRIC) is necessary to accurately establish or verify the identities of the individuals to a high degree of fidelity.
On 28 May 2019, ex-presidential hopeful Tan Kin Lian published his NRIC number online. This led to him being locked out of his government digital identity account for about 7 hours (which used his NRIC number as the login), when someone entered the wrong password too many times, probably intentionally.
On 10 Dec 2024, Singapore’s Straits Times published an article about a couple who found their bank accounts blocked and credit cards cancelled while they were overseas on holiday. Someone rang the banks, pretended to be them, even failed identity verification requests a few times, but subsequently passed and managed to get the banks to block the accounts and cancel the cards. One of the banks only needed callers to provide the account holder’s full name and phone number or NRIC number for credit cards to be blocked.
On 12 Dec 2024, ex-journalist Bertha Henson published a Facebook post saying that people’s NRIC numbers were easily accessible through Bizfile, the business filing portal of the Accounting and Corporate Regulatory Authority (ACRA).
The Straits Times reported that it was able to obtain the NRIC numbers and full names of several prominent businessmen and Cabinet ministers from Bizfile, for free. This alarmed the public.
On 13 Dec 2024, The Minitry of Digital Development and Information (MDDI) issued a press statement saying that:
The NRIC number is a unique identifier assigned by the Singapore Government as a means to identify individuals, and should be used as such. As a unique identifier, the NRIC number is assumed to be known, just as our real names are known. There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others. … In the coming year, MDDI and PDPC will be conducting a public education effort about the purpose of the NRIC number, and how it should be used freely as a personal identifier in the same way we use our names, as well as the correct steps we ought to take to protect ourselves, which involve proper use of authentication and passwords.
Based on the messages in my WhatsApp chatgroups and on Reddit, people became more alarmed and upset.
I think you can pick up the rest from the governments’ press statements, and reports by local media.
Press statement from the Singapore government
Articles from local media
Concerns raised over ease of accessing NRIC numbers from Acra portal
ACRA disables search function for NRIC numbers on portal for now
Personal Data Protection Commission updating guidelines on use of NRIC numbers
NRIC numbers should not be used as passwords or for authentication: S’pore data privacy watchdog
CNA Explains: What does it mean for Singaporeans now that NRIC numbers will be unmasked?