Press Release
The Government Completes Review Into the Public Disclosure of Full NRIC Numbers on Bizfile People Search
People
Prime Minister's Office
Topics
Governance
3 March 2025
The Government has released its Report of the Review into the Public Disclosure of Full NRIC Numbers on BizfilePeople Search.
This article has been migrated from an earlier version of the site and may display formatting inconsistencies.
The Government has released its Report of the Review into the Public Disclosure of Full NRIC Numbers on Bizfile People Search (“Report”).
Background
On 9 December 2024, the Accounting and Corporate Regulatory Authority (“ACRA”) launched its new Bizfile portal with the People Search function that displayed full NRIC numbers (“the Bizfile incident”). Following public concerns, the People Search function was disabled on the night of 13 December 2024.
The Government subsequently set up a Panel, chaired by Head, Civil Service, Leo Yip, to (a) review the Government’s policy on the responsible use of NRIC numbers where it pertained to the Bizfile portal, (b) determine what led to the Bizfile incident, and (c) identify learning points so that similar incidents do not recur. The Panel also reviewed the design and implementation of the People Search function, in addition to ACRA and the Ministry of Digital Development and Information (“MDDI”)’s management of the incident from when public concerns arose on 12 December 2024 until the People Search function was disabled on 13 December 2024.
The Panel reported to Senior Minister and Coordinating Minister for National Security Teo Chee Hean, who is Minister-in-charge of the Smart Nation Group, and Digital Government and Public Sector Data Governance. The Chair of the Panel submitted its report to Senior Minister Teo on 25 February 2025, who in turn, submitted it to the Prime Minister on 26 February 2025.
Key Findings
While the Panel did not find any factual evidence of deliberate wrongdoing or wilful inaction by the MDDI and ACRA officers involved in this incident, it found several shortcomings by both ACRA and MDDI in this incident, which should have been avoided.
MDDI should have been clearer in its policy communications in its July 2024 Circular Minute1 (CM). MDDI and ACRA staff did not realise that ACRA had misunderstood how the July 2024 CM applied to the new Bizfile portal.
There were internal shortcomings within ACRA in sharing and acting on the information from MDDI on the July 2024 CM.
MDDI should have paid more attention to the implementation plan for new use cases of partial NRIC numbers that were more complex, such as public registries.
In deciding to disclose full NRIC numbers in People Search, ACRA did not first assess the proper balance between sharing full NRIC numbers and ensuring that they were not too readily accessible. This contravened the Government's internal rules on data management.
Certain security features for the People Search function were not adequately implemented.
The incident management after public concerns on the new Bizfile portal surfaced on 12 December 2024 should have been better.
The Public Service Division, MDDI and ACRA are separately following up to review the actions and responsibilities of the relevant individual officers. This is being conducted in accordance with the applicable accountability and disciplinary frameworks and processes in the respective public agencies involved. The lessons that the Panel had identified will be disseminated across the whole of the Public Service, so that agencies can take these on board and similar incidents do not recur.
Members of public may access the report here: Report of the Review into the Public Disclosure of Full NRIC Numbers on Bizfile People Search [PDF, 512 KB]. Senior Minister Teo Chee Hean will deliver a Ministerial Statement on the report in Parliament on 6 March 2025.
* * * * *
PRIME MINISTER’S OFFICE
3 MARCH 2025
[1] The CM issued in Jul 2024 required public agencies to (a) stop the use of NRIC numbers for authentication; (b) stop internal uses of masked NRIC numbers within the public sector; (c) not introduce any planned (i.e. new) uses of masked NRIC numbers both internally and externally, e.g. in new business processes or digital products; and (d) provide information to MDDI on the agencies’ existing uses of masked NRIC numbers in communications or correspondence with the public.
Explore related topics