Explanation and Impact of Policy Change on Full NRIC Number and Further Measures on Public Education and Protection of Sensitive Identifiable Information

The following question stood in the name of Ms Tin Pei Ling –

1 To ask the Minister for Digital Development and Information (a) whether an individual’s NRIC number is considered confidential requiring privacy protection; (b) if not, how does the Personal Data Protection Act reconcile with this; and (c) what measures are put in place by the Government to protect sensitive or personal identifiable information data.

2 Ms Usha Chandradas asked the Minister for Digital Development and Information how does the Ministry intend for its new standards regarding the appropriate handling of NRIC numbers to be applied across different sectors including public agencies, private enterprises and non-profit organisations.

3 Mr Zhulkarnain Abdul Rahim asked the Minister for Digital Development and Information (a) whether NRIC, being data from which an individual can be identified as defined under the Personal Data Protection Act, shall be expressly excluded from the Act; (b) to date, how many complaints have been made to the Personal Data Protection Commission that is related to NRIC data being used or collected wrongfully and what actions are taken; and (c) what are the measures taken to mitigate against the risks of identity theft and scams from the use of NRIC which will be publicly available.

4 Mr Yip Hon Weng asked the Minister for Digital Development and Information (a) whether the Government’s move to unmask NRIC numbers can pose a risk in the rise of NRIC-related scams especially among elderly; and (b) how will the Ministry proactively combat NRIC-related scams, considering that public education takes time to be effective.

5 Mr Edward Chia Bing Hui asked the Minister for Digital Development and Information (a) how will the Ministry update and strengthen guidance for private organisations on their authentication and verification processes to safeguard against identity theft in light of new policies to unmask NRIC numbers; (b) what additional measures will be introduced to reassure the public and mitigate heightened concerns about susceptibility to scams and identity theft; and (c) how will the Ministry enhance public education efforts and promote best practices in personal data protection amidst the evolving digital landscape.

6 Mr Christopher de Souza asked the Minister for Digital Development and Information how will the Government ensure that Singaporeans are not exposed to the risks of scams and identity thefts arising from the unmasking of NRIC numbers.

7 Mr Leong Mun Wai asked the Minister for Digital Development and Information (a) what was the process by which the internal circular that was issued by MDDI, instructing Government agencies to stop using unmasked NRIC numbers in new business processes and services, was drafted and circulated; (b) when was it circulated; and (c) whether full text of the circular can be made public.

8 Mr Lim Biow Chuan asked the Minister for Digital Development and Information (a) whether the Ministry will take into consideration Singaporean's concerns about their NRIC number being publicly available before making any further decision on the unmasking of the full NRIC number; and (b) whether the Ministry will respond to concerns from cyber security experts that NRIC numbers can be used by bad actors to trick victims into believing they are authority figures or to commit crime.

9 Ms Joan Pereira asked the Minister for Digital Development and Information (a) whether the Ministry was closely involved in the new ACRA Bizfile project conceptualisation and implementation; (b) whether the Ministry had raised any concerns regarding data protection and privacy prior to the project go-live; and (c) whether the Ministry can share its plans for any upcoming projects or initiatives where the unmasking of NRIC numbers is being considered.

10 Mr Ong Hua Han asked the Minister for Digital Development and Information (a) what is the timeline for the Government’s public education efforts about the purpose and safe handling of NRIC numbers; (b) how is the Government supporting healthcare and financial institutions in the shift away from NRIC numbers as a method of authentication; and (c) what additional steps can be taken to protect potential scam victims during this transition period.

11 Mr Liang Eng Hwa asked the Minister for Digital Development and Information (a) whether the Ministry can provide the details of the circular issued to agencies to cease further planned use of masked NRIC numbers in new business processes and services; (b) whether sufficient clarity has been given to agencies to implement this new move; and (c) whether the circular addresses the readiness of the public to treat NRIC numbers as non-private unique identifiers.

12 Mr Liang Eng Hwa asked the Minister for Digital Development and Information (a) what is the rationale for phasing out the use of masked NRIC numbers; (b) whether the full availability of NRIC numbers to the public will pose security risks or individual privacy issues; and (c) whether private sector practices on the use of NRIC numbers are aligned with the Government’s latest policy position.

13 Mr Xie Yao Quan asked the Minister for Digital Development and Information what is the compressed timeline for (i) consultation with the private sector and updating of guidelines on the appropriate use of masked NRIC numbers and (ii) public education on the use of full NRIC numbers as a unique identifier.

14 Ms Hazel Poa asked the Minister for Digital Development and Information what steps will be taken by the Government to ensure that the private sector will move away from using NRIC numbers as a means of authentication.

15 Mr Xie Yao Quan asked the Minister for Digital Development and Information whether the Government will consider (i) stepping up enforcement actions (ii) encouraging or mandating entities to adopt other measures such as conducting audits and (iii) enhancing punitive actions against entities in the private sector for the non-compliance and improper use of NRIC numbers as a form of authentication.

16 Mr Xie Yao Quan asked the Minister for Digital Development and Information (a) why has the public service accepted and promulgated the masking of NRIC numbers in past years; (b) what has caused the change in thinking; and (c) whether all Government services will be reviewed for the possible use of other identifiers in lieu of unmasked NRIC numbers going forward, given the latest position that not using masked NRIC numbers does not mean unmasking all currently masked NRIC numbers.

17 Mr Gerald Giam Yean Song asked the Minister for Digital Development and Information (a) whether, prior to 9 December 2024, the Personal Data Protection Commission had issued any directives to organisations against the use of NRIC numbers to authenticate an individual’s identity or as default passwords; (b) if such directives were issued, how did the Ministry ensure their enforcement and compliance during this period; and (c) how many organisations, including banks and large insurers, continued using NRIC numbers for authentication or default passwords despite these directives.

18 Ms Jessica Tan Soon Neo asked the Minister for Digital Development and Information as NRIC numbers are being used by many organisations including financial institutions to authenticate identity (a) what measures will be taken to ensure that security enhancement of Government systems are made before discontinuing with the masking of NRIC numbers; and (b) what measures will be taken to reassure and address Singaporeans' concerns about the cybersecurity risks associated with the unmasking of NRIC numbers within the Government.

19 Ms Sylvia Lim asked the Minister for Digital Development and Information (a) whether any sanctions will be imposed on ACRA or its officers for the exposure of Singaporeans’ NRIC numbers through its Bizfile portal in December 2024; and (b) whether the continued exemption of Government agencies from the obligations of the Personal Data Protection Act needs to be reviewed.

20 Ms Sylvia Lim asked the Minister for Digital Development and Information whether the proposed change in policy to treat NRIC numbers as equivalent to the full names of individuals is justifiable.

21 Mr Chua Kheng Wee Louis asked the Minister for Digital Development and Information in respect of the decision to unmask NRIC numbers (a) whether the Government has considered the data security implications of full NRIC numbers being made readily available; and (b) what is the Government’s assessment of the risk of NRIC numbers being potentially used to unlock large amounts of information relating to the individual.

22 Mr Dennis Tan Lip Fong asked the Minister for Digital Development and Information (a) what inter-Ministerial consultations were conducted prior to the decision to unmask NRIC numbers; (b) when was the decision taken to unmask NRIC numbers; (c) how does this policy align with international best practices on personal data protection; and (d) what measures are being taken to ensure that other personal identifiers can remain secure.

23 Mr Melvin Yong Yik Chye asked the Minister for Digital Development and Information with the move to unmask NRIC numbers (a) how will services such as telecommunication providers and banks be required to authenticate the identity of legitimate consumers moving forward; and (b) what is the timeline for updating the Personal Data Protection Commission’s 2018 guidelines that govern the collection and protection of NRIC numbers.

24 Miss Cheryl Chan Wei Ling asked the Minister for Digital Development and Information with regard to the Government’s intention to change the practice of masking NRIC numbers, (a) how can citizens understand the implications if their NRIC numbers were to be utilised by bad actors; and (b) why was the use of NRIC as an identifier versus authenticator in the private sector not considered earlier as a requirement to amend, given the strong push towards a digital-first society.

25 Mr Pritam Singh asked the Minister for Digital Development and Information (a) when was the Ministry’s circular that sought to change the practice of masking NRIC numbers dated and communicated to Government agencies; (b) when did the Ministry determine that such a change was necessary and begin planning for it; (c) whether any whole-of-Government discussions took place before and after the issuance of the circular; and (d) how many other agencies, apart from ACRA, misread or misunderstood the circular.

26 Assoc Prof Jamus Jerome Lim asked the Minister for Digital Development and Information (a) what were the specific incidents that led the Government to form its view that masking NRIC numbers gives one a false sense of security; (b) how long ago did the Government adopt this stance; and (c) what will the Government do to restore public trust from the pre-emptive move by ACRA’s Bizfile ahead of a full and proper public consultation.

27 Assoc Prof Jamus Jerome Lim asked the Minister for Digital Development and Information (a) whether the loss of individuals’ identification numbers through the actions of private organisations is still considered a data breach under regulation 3(1)(a) of the Personal Data Protection (Notification of Data Breaches) Regulations; and (b) if so, whether such private organisations will be penalised according to regulations before the unmasking of NRIC numbers by ACRA took place.

28 Ms He Ting Ru asked the Minister for Digital Development and Information (a) in the last 12 years, how many organisations have been investigated and fined under the PDPA for disclosing NRIC numbers; (b) what is the total quantum of fines collected; (c) whether there is any public concern about the fines previously levied and, if so, what is the Government’s response to such concerns; and (d) what is the projected cost of the public re-education campaign to desensitise citizens to information that organisations were previously punished for disclosing.

29 Mr Sharael Taha asked the Minister for Digital Development and Information (a) when is the policy to discontinue the use of masked NRIC numbers in new business processes and Government services planned to be implemented; (b) what plans does the Ministry have on educating the public regarding the policy change and the rationale behind the change; (c) whether public concerns on the policy change will expedite the initial public education plans; and (d) how will the Ministry address concerns regarding the potential misuse and abuse of unmasked NRIC numbers by scam syndicates.

30 Mr Saktiandi Supaat asked the Minister for Digital Development and Information (a) what are the Government’s and statutory boards’ obligations in relation to citizens’ personal data under the Public Sector Governance Act and their own internal rules; (b) whether ACRA’s release of unmasked NRIC numbers between 9 and 14 December 2024 breached any of these obligations; (c) what recourse does an affected individual have if there is a breach; and (d) what other actions will be taken to hold those involved in the release of the unmasked NRIC numbers accountable.

31 Dr Tan Wu Meng asked the Prime Minister and Minister for Finance (a) for what period has ACRA’s Bizfile online portal allowed searches to readily access an individual person’s NRIC number; (b) whether the Government has assessed the additional risks of identity theft and scams when NRIC numbers are readily searchable digitally such as via the Bizfile online portal; and (c) how is Bizfile’s public access, ease and rapidity of search considered against the whole-of-Government approach towards the handling of NRIC numbers as personal data.

32 Mr Don Wee asked the Prime Minister and Minister for Finance (a) what are the reasons for allowing ACRA's Bizfile platform to display full NRIC numbers of individuals searchable by name; (b) how does this align with Singapore’s data protection policies under the Personal Data Protection Act; and (c) how will the Ministry ensure that Government platforms do not prematurely launch features that may lead to privacy and cybersecurity concerns without adequate public and industry consultation.

33 Mr Ang Wei Neng asked the Prime Minister and Minister for Finance (a) what are the reasons for ACRA’s decision to implement a feature that allows public access to full NRIC numbers despite established guidelines on data protection and privacy risk considerations; (b) how does the Government reconcile ACRA’s approach in treating NRIC numbers as a public identifier with Singaporeans’ expectations of privacy and the risks of identity theft; and (c) whether the Ministry will conduct a comprehensive review of all Government portals to ensure compliance with data protection best practices.

34 Ms Joan Pereira asked the Prime Minister and Minister for Finance (a) whether there are processes and checks in place for inter-agency coordination before a new initiative, like the refreshed ACRA Bizfile portal, is rolled out; and (b) whether the Ministry has considered that a publicly searchable database of all Singaporeans’ names and their NRICs can pose a risk or cause distress to people.

35 Mr Liang Eng Hwa asked the Prime Minister and Minister for Finance (a) whether ACRA has taken into consideration the likely public concerns and reactions with regard to NRIC numbers being searchable on the Bizfile portal when deciding to allow the unmasking of NRIC numbers on the portal; and (b) whether ACRA is aware of the prevailing public understanding that NRIC numbers should be treated as private and confidential.

36 Mr Dennis Tan Lip Fong asked the Prime Minister and Minister for Finance for Singaporeans whose NRIC were unmasked on ACRA’s Bizfile portal between 9 December 2024 and 13 December 2024 (a) what is the Government’s assessment of the likely risks and exposure that any of their NRIC numbers may have actually been accessed and downloaded by malicious actors for scams or onward sale during that period; and (b) if so, whether the Government is prepared to provide suitable compensation or remedy to such individuals.

37 Ms He Ting Ru asked the Prime Minister and Minister for Finance (a) what is the exact number of unique NRIC numbers that were available to be viewed publicly on the ACRA Bizfile portal between 9 and 13 December 2024; (b) how many distinct users have conducted searches that returned these numbers; and (c) whether ACRA will contact individuals who have had their NRIC numbers returned in the results to inform them that their details have been disclosed and to educate them about the potential misuse and heightened scam risks.

Dr Tan Wu Meng (Jurong): Question No 1.

The Senior Minister of State for Digital Development and Information (Mr Tan Kiat How) (for the Minister for Digital Development and Information): Mr Speaker, Question Nos 1 to 37 in the Order Paper today relate to the Government policy on National Registration Identity Card (NRIC) numbers and the recent incident where the numbers were disclosed on the Accounting and Corporate Regulatory Authority (ACRA) BizFile Service.

The Minister for Digital Development and Information Josephine Teo and the Second Minister for Finance Indranee Rajah have given notice that they will be delivering Ministerial Statements on these topics tomorrow, 8 January. As their Ministerial Statements will be addressing the issues raised in these Parliamentary Questions (PQs), I ask your leave for these PQs to be deferred for answer via the Ministerial Statements on 8 January.

Mr Speaker: This will cover Question Nos 1 to 37. I give my consent.