MDDI-ACRA joint press conference on unmasking of NRIC numbers

AsiaOne

The availability of unmasked NRIC information on Bizfile sparked security concerns and confusion.  To address these concerns, the Ministry of Digital Development and Information, Ministry of Finance, and the Accounting and Corporate Regulatory Authority held a joint press conference on Thursday (Dec 19) to clarify and address the issue. Watch more: https://www.asiaone.com/video

Transcript

00:00It arose out of a misunderstanding.

00:02If things had gone according to plan,

00:05we would have had the chance to do the proper communications.

00:08And that is just really something that should not have happened,

00:13but it did happen, and for which we are very sorry.

00:21MDDI had issued a circular for government agencies

00:25to cease any planned use of masked NRIC numbers

00:29in new business processes and services.

00:33Unfortunately, there was a lapse of coordination

00:38between the staff on how this was to be implemented.

00:41ACQUA then proceeded on the misunderstanding

00:45that it should unmask NRIC numbers in the new Bisval portal.

00:50This was a mistake on ACQUA's part,

00:53and I apologise for this.

00:55Our oversight has caused anxiety and confusion to the public.

01:00We should also have taken more deliberate care

01:03to ensure that such information, deemed sensitive by many,

01:07is provided only when needed.

01:10ACQUA will learn from this lesson

01:12and tighten our systems and processes.

01:15We had planned to discontinue the use of masked NRIC numbers

01:21within the government, starting with new services

01:24and progressively changing out other services as they are updated.

01:30For the private sector, we had intended to consult

01:35before making any change.

01:38We should have made that clear.

01:41We should also have made clear what we meant

01:47by moving away from using masked NRIC numbers.

01:51It does not mean automatically unmasking

01:56and using the full NRIC number in all circumstances.

02:02In some instances, for example,

02:05when the doctor performs a procedure

02:08or a nurse dispenses us medication,

02:11it would be safer and more accurate

02:14to use the full NRIC number.

02:17In other instances, such as signing up

02:20for retail membership or Lucky Draws,

02:24there is no need to use the NRIC number at all.

02:29There are alternatives like phone numbers

02:33or email addresses that can be used.

02:36In other words, not using masked NRIC numbers

02:41does not mean we will unmask all currently masked NRIC numbers.

02:49Having said that, I would like to re-emphasise

02:53why a current use, current practices

02:56around the use of NRIC numbers today

03:00makes us vulnerable and why we should act

03:04while the problem is relatively contained.

03:08Say a caller on the phone who can tell us our NRIC number,

03:15we may assume that this person is a figure of authority

03:19and this makes us vulnerable to potential scammers.

03:24Some organisations also accept NRIC numbers,

03:29whether full or partial, as a way to prove

03:33that the person who he claims to be is who he is

03:39and that allows him to access confidential documents

03:43like e-statements or controlled services.

03:46This is not secure.

03:49These practices and mindsets must change.

03:53We know this will take time

03:55and that is why we are not rushing to change policy.

04:00We will start by focusing on the incorrect uses of NRIC numbers

04:05and stopping such practices.

04:08This means moving away from using the NRIC number as a password

04:13and moving away from using the NRIC number as an authenticator.

04:18Taking into consideration users' needs and the public's concerns,

04:22we will introduce a revised people search function next week

04:27but the search results will not show any NRIC number,

04:32masked or unmasked.

04:35For those who require more information about a specific individual,

04:40including the full NRIC number,

04:43they will then pay and obtain the necessary information from BizFile.

04:50This is the service that ACRA has to provide

04:53as a National Business Register of Singapore.

04:57We believe it is the right balance to strike

04:59between corporate transparency

05:01and public concerns regarding personal information.

05:05We are having a review of this to see how this could have been avoided

05:11and what can be done better going forward.

05:14The government's own use of mask numbers

05:17versus the private sector use of mask numbers is not the same thing.

05:24We only decided what it should be for the government.

05:28We have not decided what it should be for the private sector.

05:32What it should be for the private sector

05:34is something that should be borne out of the consultation process.

05:40The position for the private sector is the same today as it was in 2018

05:47when the advisory guidelines were issued by the PDPC

05:53outlining all the steps that must be taken

05:57when organisations collect and use NRIC numbers.

06:10For more UN videos visit www.un.org

Category

Transcript

Recommended