What the shift from masked NRIC numbers means for Singaporeans

Singaporeans have been asked to change the way they think about NRIC numbers and how they are used.

- Osmond Chia, Lee Li Ying

The current practice of masking NRIC numbers creates a false sense of security that such data is secret, Digital Development and Information Minister Josephine Teo said in a press conference on Dec 19.

It also means organisations have started wrongly using NRIC numbers as passwords, or as ways to authenticate a person's identity and grant them access to privileged information.

Mrs Teo said government agencies had intended to start moving away from these practices by discontinuing the use of masked NRIC numbers.

But a miscommunication between her ministry and the Accounting and Corporate Regulatory Authority (Acra) led to NRIC numbers being fully revealed on Acra's new business portal.

The Straits Times highlights the changes.

Q Is this a policy U-turn? Can all organisations collect NRIC numbers now?

A The only thing that has changed is the Government deciding not to use masked NRIC numbers, said Mrs Teo.

It had planned to discontinue the use of masked NRIC numbers internally, starting with new services. Mrs Teo said the authorities have been consistent on the proper way NRIC numbers should be handled.

For the private sector, the Personal Data Protection Commission's (PDPC) 2018 guidelines will remain for now.

This includes all the steps that must be taken when organisations collect and use NRIC numbers and NRICs.

Current guidelines will be updated to include the Government's new position on masked NRIC numbers, and the improper usage of NRIC numbers for passwords and authentication.

The private sector will be consulted before any changes are made. This process will be sped up in the light of the incident involving Acra.

Q What does unmasking NRIC numbers mean?

A Singapore is moving away from using masked NRIC numbers, but this does not mean people should fully reveal NRIC numbers in all circumstances.