The availability of unmasked NRIC information on Bizfile sparked security concerns and confusion.
To address these concerns, the Ministry of Digital Development and Information, Ministry of Finance, and the Accounting and Corporate Regulatory Authority held a joint press conference on Thursday (Dec 19) to clarify and address the issue.
Watch more: https://www.asiaone.com/video
To address these concerns, the Ministry of Digital Development and Information, Ministry of Finance, and the Accounting and Corporate Regulatory Authority held a joint press conference on Thursday (Dec 19) to clarify and address the issue.
Watch more: https://www.asiaone.com/video
Category
π
NewsTranscript
00:00It arose out of a misunderstanding.
00:02If things had gone according to plan,
00:05we would have had the chance to do the proper communications.
00:08And that is just really something that should not have happened,
00:13but it did happen, and for which we are very sorry.
00:21MDDI had issued a circular for government agencies
00:25to cease any planned use of masked NRIC numbers
00:29in new business processes and services.
00:33Unfortunately, there was a lapse of coordination
00:38between the staff on how this was to be implemented.
00:41ACQUA then proceeded on the misunderstanding
00:45that it should unmask NRIC numbers in the new Bisval portal.
00:50This was a mistake on ACQUA's part,
00:53and I apologise for this.
00:55Our oversight has caused anxiety and confusion to the public.
01:00We should also have taken more deliberate care
01:03to ensure that such information, deemed sensitive by many,
01:07is provided only when needed.
01:10ACQUA will learn from this lesson
01:12and tighten our systems and processes.
01:15We had planned to discontinue the use of masked NRIC numbers
01:21within the government, starting with new services
01:24and progressively changing out other services as they are updated.
01:30For the private sector, we had intended to consult
01:35before making any change.
01:38We should have made that clear.
01:41We should also have made clear what we meant
01:47by moving away from using masked NRIC numbers.
01:51It does not mean automatically unmasking
01:56and using the full NRIC number in all circumstances.
02:02In some instances, for example,
02:05when the doctor performs a procedure
02:08or a nurse dispenses us medication,
02:11it would be safer and more accurate
02:14to use the full NRIC number.
02:17In other instances, such as signing up
02:20for retail membership or Lucky Draws,
02:24there is no need to use the NRIC number at all.
02:29There are alternatives like phone numbers
02:33or email addresses that can be used.
02:36In other words, not using masked NRIC numbers
02:41does not mean we will unmask all currently masked NRIC numbers.
02:49Having said that, I would like to re-emphasise
02:53why a current use, current practices
02:56around the use of NRIC numbers today
03:00makes us vulnerable and why we should act
03:04while the problem is relatively contained.
03:08Say a caller on the phone who can tell us our NRIC number,
03:15we may assume that this person is a figure of authority
03:19and this makes us vulnerable to potential scammers.
03:24Some organisations also accept NRIC numbers,
03:29whether full or partial, as a way to prove
03:33that the person who he claims to be is who he is
03:39and that allows him to access confidential documents
03:43like e-statements or controlled services.
03:46This is not secure.
03:49These practices and mindsets must change.
03:53We know this will take time
03:55and that is why we are not rushing to change policy.
04:00We will start by focusing on the incorrect uses of NRIC numbers
04:05and stopping such practices.
04:08This means moving away from using the NRIC number as a password
04:13and moving away from using the NRIC number as an authenticator.
04:18Taking into consideration users' needs and the public's concerns,
04:22we will introduce a revised people search function next week
04:27but the search results will not show any NRIC number,
04:32masked or unmasked.
04:35For those who require more information about a specific individual,
04:40including the full NRIC number,
04:43they will then pay and obtain the necessary information from BizFile.
04:50This is the service that ACRA has to provide
04:53as a National Business Register of Singapore.
04:57We believe it is the right balance to strike
04:59between corporate transparency
05:01and public concerns regarding personal information.
05:05We are having a review of this to see how this could have been avoided
05:11and what can be done better going forward.
05:14The government's own use of mask numbers
05:17versus the private sector use of mask numbers is not the same thing.
05:24We only decided what it should be for the government.
05:28We have not decided what it should be for the private sector.
05:32What it should be for the private sector
05:34is something that should be borne out of the consultation process.
05:40The position for the private sector is the same today as it was in 2018
05:47when the advisory guidelines were issued by the PDPC
05:53outlining all the steps that must be taken
05:57when organisations collect and use NRIC numbers.
06:10For more UN videos visit www.un.org