PUBLISHED ONMarch 03, 2025 10:20 AMByChing Shi JieA Government review into the National Registration Identity Card (NRIC) unmasking issue found no evidence of deliberate wrongdoing or wilful action by officers from the Ministry of Digital Development and Information (MDDI) and Accounting and Corporate Regulatory Authority (Acra).
However, the review panel, led by civil service head Leo Yip, said on Monday (March 3) there was a "confluence of shortcomings" by both agencies that should have been avoided.
Privacy concerns were raised over Acra's Bizfile portal, which showed names and full NRIC numbers for free via its search function from Dec 9 to 13 last year.
This caused public alarm and the number of searches on the portal spiked to 500,000 during the five-day period, instead of the usual daily traffic of 2,000 to 3,000 searches.
The Government subsequently apologised for the anxiety caused and explained that the error was due to a misunderstanding between MDDI and Acra.
They had intended to change the practice of masking NRIC numbers, but Acra launched its new portal before these plans were publicly announced.
Delivering a ministerial statement in Parliament in January, Second Minister for Finance Indranee Rajah said that a review panel had been set up to study the root cause of the incident.
She added that the panel, which reported to Senior Minister Teo Chee Hean, would "study what happened, how the decisions were made, the implementation and communication processes, the coordination across public sector agencies, and where the Government should have done and can do better".
In a report released by the panel on Monday following a month-long review, they elaborated on what Acra's chief executive Chia-Tern Huey Min previously described as a "lapse of coordination" between her agency and MDDI.
On July 5 last year, MDDI issued a circular for government agencies to "stop the use of NRIC numbers for authentication and the use of masked NRIC numbers within the public sector".
They also required agencies to immediately cease "any planned use of masked NRIC numbers in new business processes or digital products".
The panel, however, found that the Government should have been "clearer in its policy communications" through the circular as these led to misunderstandings between MDDI and Acra staff.
The first, was MDDI's use of the word "planned use", which the ministry intended to require Government agencies to stop new uses of masked NRIC numbers.
But Acra interpreted that this requirement applied to its portal because it was a "new digital product".
The MDDI circular also stated that Government agencies are to stop using masked NRIC numbers.
But the report said that the ministry did not explain that this did not mean showing full NRIC numbers, which is something Acra interpreted and displayed in its portal.
The panel also noted that Acra and MDDI had exchanged multiple emails "without engaging each other on the crux of the misunderstandings".
The report also found "internal shortcomings" within Acra.
According to the report, the July 2024 circular was emailed to senior public service leaders, including those with key responsibilities in IT and data matters with their agencies.
MDDI also held a briefing 11 days later in which two officers from Acra's data governance team attended the briefing.
"They were not involved in the development of the new Bizfile portal," said the panel in its report.
It added that MDDI also emailed a video recording of the briefing and a "Frequently Asked Questions" document to the Acra's data governance team.
But the latter did not share these documents to its senior leadership and project leads for the new Bizfile portal, said the panel.
"The insufficient sharing of information within Acra had contributed to the misunderstandings between Acra and MDDI on the July 2024 circular," it added.
Besides the security features on its Bizfile portal that were not "adequately implemented", the panel also took issue that Acra did not first access the proper balance between sharing full NRIC numbers to promote corporate transparency and ensuring that they are not too readily accessible.
Acra disabled its People Search function only on the night of Dec 13 when public concerns about the unmasked NRIC numbers first surfaced on Dec 12.
The report said that the agency should have done so sooner.
"The panel was also of the view that agencies should have been better coordinated and responded more fully to the public's concerns about the People Search function," it added.
In response to the report's findings, MDDI, the Ministry of Finance and Acra said that "appropriate actions are being taken with the officers and leaders involved".
These include reviewing performance assessments, which they said carry "financial consequences", as well as counselling and additional training.
On its immediate steps to address the shortcomings, MDDI said it will be developing further guidance to Government agencies on how the policy on NRIC numbers should be applied.
The ministry said in a press release that it has identified almost 800 existing cases of partial NRIC numbers in its systems which are accessible to the public.
Meanwhile, Acra said that it will take immediate steps such as "strengthening" staff training and conduct more regular system reviews, among other measures.
In a separate press release, the Prime Minister's Office said that Senior Minister Teo will deliver a Ministerial Statement on the report in Parliament on Thursday (March 6).
Prime Minister Lawrence Wong said in a statement that he agreed with the assessment of the shortcomings as well as the learning points identified.
"The Government will take these lessons to heart, improve its processes and strive to do better moving forward," he said.
For more original AsiaOne articles, visit here.
