Review of NRIC saga uncovers key shortcomings of Acra, MDDI

Panel finds no evidence of malicious intent in disclosure of full NRIC numbers on portal

- Irene Tham

A review panel that investigated the disclosure of individuals' full NRIC numbers on a government business portal has found no evidence of malicious intent or wilful wrongdoing.

But the panel, led by head of civil service Leo Yip, uncovered shortcomings by both the Accounting and Corporate Regulatory Authority (Acra) and the Ministry of Digital Development and Information (MDDI) in the incident.

The six shortcomings included security lapses at Acra that contravened the Government's internal data management rules, and lack of clear communication between Acra and MDDI that led to full NRIC numbers being published on Acra's refreshed business portal Bizfile in December 2024.

"In this incident, the public service did not perform to the level we set for ourselves. We should have done better, and this review contains important lessons which we will apply," said the panel in its report released on March 3.

"More importantly, the lessons that the panel had identified will be disseminated across the whole of the public service, so that agencies can take these on board and similar incidents do not recur."

The report was submitted to Prime Minister Lawrence Wong on Feb 26. In a letter to the media, he said he agreed with the assessment of the shortcomings as well as the learning points identified.

"The report sets out key lessons for the public service. The Government will take these lessons to heart, improve its processes, and strive to do better moving forward," he said.

On Dec 9, 2024, Acra refreshed its Bizfile portal with a search feature that allowed the full NRIC numbers of registered people on its database to be accessed for free. The feature was taken down on Dec 13 after public backlash.