SINGAPORE: There was no “deliberate wrongdoing or wilful inaction” by government officials involved in the events that led to the display of full National Registration Identity Cards ( NRC ) numbers on a business portal last December.
The review panel’s report claiming the incident was a” confluence of several shortcomings” that led to the removal of NRIC numbers from the Accounting and Corporate Regulatory Authority’s (ACRA ) Bizfile portal on Monday ( Mar 3 ) stated in a report released on Monday ( Mar 3 ) that it was a result of the review panel’s (ACRA ) review panel’s ( Mar 3 ) report.
The board, which is led by Leo Yip, the head of the civil service, was asked to review the administration’s plan on responsible usage of NRIC numbers, find out what caused the Bizfile incident, and draw lessons to prevent similar incidents from occurring in the future.  ,
The Minister’s Office stated in a press release that the board found several shortcomings by both the ACRA and MDDI in this event that should have been avoided. The panel also found no scientific evidence of deliberate crime or intentional inaction by the ( Ministry of Digital Development and , Information ) and ACRA officers involved in this event.
On February 25, the Smart Nation Group’s Senior Minister and Minister-in-charge, Teo Chee Hean, received the panel’s statement. On February 27, Prime Minister Lawrence Wong approved the report’s release for the general public. On March 6 in parliament, Mr. Teo may make a ministerial statement on the document.
The committee’s findings and recommendations were made by ACRA, its family department, the Ministry of Finance, and MDDI.
When inquiries made on ACRA’s Bizfile site resulted in total NRIC figures for completely in search results in December, there was a public outcry over privacy issues.
A “lapse of synchronization” and a miscommunication, according to ACRA CEO Chia-Tern Huey Min, led to the unveiling of the NRIC numbers.
TIMING OF EVENTS
The former , Smart Nation and Digital Government Office ( SNDGO ), which is now a part of MDDI, started revising the NRIC number policy in August 2022.
The goal was to stop NRIC numbers being used incorrectly for verification and to stop using fractional NRIC numbers.
SNDGO addressed the second issue , the inappropriate use of NRIC figures for authentication in a circular issued to government organizations in September 2023. NRIC figures are meant to recognize individuals rather than establish their identity.
ACRA suggested in early 2024 that it start offering limited NRIC numbers rather than complete NRIC numbers when users buy a People Profile on the Bizfile site in contrast to the SNDGO’s evaluation.
SNDGO informed ACRA that limited NRIC amounts would no longer be used, and the organization opted not to change that.
At this point, ACRA has now misinterpreted SNDGO’s purposes. It argued that the long-term goal was for common organizations to “unmask” NRIC figures.  ,
SNDGO did not correct ACRA or make it clear that using only limited NRIC figures was not comparable to using whole NRIC figures when using them.
The review panel stated in its report that” This contributed to subsequent misunderstandings between ACRA and MDDI.
In a circular released in July 2024, MDDI stated its intention to stop using partial NRIC numbers internally and stop creating new applications for partial NRIC numbers both internally and externally.
Before making plans on how to stop masked NRIC numbers, MDDI intended to gather information about existing external uses for them.
11 days later, two ACRA officers who were not involved in the creation of the new Bizfile portal attended the meeting.
The following day, data governance teams received a video recording of the briefing and a document with frequently asked questions, but they were not included as an appendix to the initial circular or shared with ACRA senior leadership.
Within ACRA, discussions arose regarding the potential sensitivity of including full NRIC numbers in its People Search function, but the organization was “heavily influenced” by its earlier exchange with SNDGO, in which the term “unmask” was used.
Additionally, it made reference to a phrase in the July circular that states that organizations must stop intending to use masked NRIC numbers in new digital products. Bizfile is not a new website, but ACRA viewed the updated portal as a brand-new digital product.