S'pore's privacy watchdog updating guidelines on use of NRIC numbers

Govt to end masking of NRIC numbers and intends to explain the issue to the public

- Ng Keng Gene

Singapore's data privacy watchdog is updating guidelines on how National Registration Identity Card (NRIC) numbers can be collected, used and shared.

This follows a Dec 14 statement that the Government intends to move away from the practice of masking NRIC numbers.

Checks on the website of the Personal Data Protection Commission (PDPC) show that the guidelines are no longer available.

A notice on the website says: "The document is temporarily unavailable as it is undergoing updates." The Sunday Times has contacted the Infocomm Media Development Authority, which the PDPC is part of, for more details.

In its 2018 guidelines, the commission had advised people not to provide their full NRIC numbers to companies, unless doing so was legally required or needed to prove one's identity.

NRIC numbers "can potentially be used to unlock large amounts of information relating to the individual", it noted.

It advised them instead to provide other personal data, such as cellphone numbers or partial NRIC numbers for instance, by rendering S0123456A as ****456Á - for verification.

On Dec 9, the Accounting and Corporate Regulatory Authority (Acra) launched its new Bizfile web portal, which allowed people to view the full NRIC numbers of others, using a search function for free, without having to log in.

This function was temporarily disabled on Dec 13 following public backlash.

But in its Dec 14 statement, the Ministry of Digital Development and Information (MDDI) said people can make a good guess at someone's full NRIC number from the masked number using basic algorithms, "especially if one also knows the year of birth of the person".