NATIONAL Registration Identity Card (NRIC) numbers should not be treated as sensitive information, and instead be viewed as full names currently are, a Ministry of Digital Development and Information (MDDI) spokesperson said on Saturday (Dec 14).
"As a unique identifier, the NRIC number is assumed to be known, just as our real names are known.
“There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others,” the spokesperson said.
The response comes after
public concern over the availability of full NRIC numbers of citizens on the Accounting and Corporate Regulatory Authority’s (Acra) Bizfile online portal. The portal is used for business registrations and filings.
The MDDI spokesperson added that NRIC numbers can be misused when organisations rely on them as a form of authentication to access information or perform transactions.
“But just as our names alone would not be suitable as the basis for such authentication, neither should the NRIC number be used for this purpose,” the spokesperson said.
The spokesperson acknowledged the existing practice of collecting masked NRIC numbers (which, for instance, reveal only the last four digits) by organisations – however, these numbers can already be easily derived through basic algorithms, especially if the birth year of the person is known.
Furthermore, the spokesperson noted that public agencies have been phasing out the use of masked NRIC numbers to avoid giving a false sense of security.
“The government’s intent was to change the existing practice of masking the NRIC number only after explaining the issue and preparing the ground.”
https://www.businesstimes.com.sg/si...gVv7XilK76rqup7yPQ_aem_EW-kAIxLzSqFIR38oG3FzA