Mr Gerald Giam Yean Song asked the Minister for Digital Development and Information (a) whether, prior to 9 December 2024, the Personal Data Protection Commission had issued any directives to organisations against the use of NRIC numbers to authenticate an individual’s identity or as default passwords; (b) if such directives were issued, how did the Ministry ensure their enforcement and compliance during this period; and (c) how many organisations, including banks and large insurers, continued using NRIC numbers for authentication or default passwords despite these directives.
Ms Sylvia Lim asked the Minister for Digital Development and Information (a) whether any sanctions will be imposed on ACRA or its officers for the exposure of Singaporeans’ NRIC numbers through its Bizfile portal in December 2024; and (b) whether the continued exemption of Government agencies from the obligations of the Personal Data Protection Act needs to be reviewed.
Ms Sylvia Lim asked the Minister for Digital Development and Information whether the proposed change in policy to treat NRIC numbers as equivalent to the full names of individuals is justifiable.
Mr Chua Kheng Wee Louis asked the Minister for Digital Development and Information in respect of the decision to unmask NRIC numbers (a) whether the Government has considered the data security implications of full NRIC numbers being made readily available; and (b) what is the Government’s assessment of the risk of NRIC numbers being potentially used to unlock large amounts of information relating to the individual.
Mr Dennis Tan Lip Fong asked the Minister for Digital Development and Information (a) what inter-Ministerial consultations were conducted prior to the decision to unmask NRIC numbers; (b) when was the decision taken to unmask NRIC numbers; (c) how does this policy align with international best practices on personal data protection; and (d) what measures are being taken to ensure that other personal identifiers can remain secure.
Mr Pritam Singh asked the Minister for Digital Development and Information (a) when was the Ministry’s circular that sought to change the practice of masking NRIC numbers dated and communicated to Government agencies; (b) when did the Ministry determine that such a change was necessary and begin planning for it; (c) whether any whole-of-Government discussions took place before and after the issuance of the circular; and (d) how many other agencies, apart from ACRA, misread or misunderstood the circular.
Assoc Prof Jamus Jerome Lim asked the Minister for Digital Development and Information (a) what were the specific incidents that led the Government to form its view that masking NRIC numbers gives one a false sense of security; (b) how long ago did the Government adopt this stance; and (c) what will the Government do to restore public trust from the pre-emptive move by ACRA’s Bizfile ahead of a full and proper public consultation.
Assoc Prof Jamus Jerome Lim asked the Minister for Digital Development and Information (a) whether the loss of individuals’ identification numbers through the actions of private organisations is still considered a data breach under regulation 3(1)(a) of the Personal Data Protection (Notification of Data Breaches) Regulations; and (b) if so, whether such private organisations will be penalised according to regulations before the unmasking of NRIC numbers by ACRA took place.
Ms He Ting Ru asked the Minister for Digital Development and Information (a) in the last 12 years, how many organisations have been investigated and fined under the PDPA for disclosing NRIC numbers; (b) what is the total quantum of fines collected; (c) whether there is any public concern about the fines previously levied and, if so, what is the Government’s response to such concerns; and (d) what is the projected cost of the public re-education campaign to desensitise citizens to information that organisations were previously punished for disclosing.
Mr Dennis Tan Lip Fong asked the Prime Minister and Minister for Finance for Singaporeans whose NRIC were unmasked on ACRA’s Bizfile portal between 9 December 2024 and 13 December 2024 (a) what is the Government’s assessment of the likely risks and exposure that any of their NRIC numbers may have actually been accessed and downloaded by malicious actors for scams or onward sale during that period; and (b) if so, whether the Government is prepared to provide suitable compensation or remedy to such individuals.
Ms He Ting Ru asked the Prime Minister and Minister for Finance (a) what is the exact number of unique NRIC numbers that were available to be viewed publicly on the ACRA Bizfile portal between 9 and 13 December 2024; (b) how many distinct users have conducted searches that returned these numbers; and (c) whether ACRA will contact individuals who have had their NRIC numbers returned in the results to inform them that their details have been disclosed and to educate them about the potential misuse and heightened scam risks.
The Senior Minister of State for Digital Development and Information (Mr Tan Kiat How) (for the Minister for Digital Development and Information): Mr Speaker, Question Nos 1 to 37 in the Order Paper today relate to the Government policy on National Registration Identity Card (NRIC) numbers and the recent incident where the numbers were disclosed on the Accounting and Corporate Regulatory Authority (ACRA) BizFile Service.
The Minister for Digital Development and Information Josephine Teo and the Second Minister for Finance Indranee Rajah have given notice that they will be delivering Ministerial Statements on these topics tomorrow, 8 January. As their Ministerial Statements will be addressing the issues raised in these Parliamentary Questions (PQs), I ask your leave for these PQs to be deferred for answer via the Ministerial Statements on 8 January.
Mr Speaker: This will cover Question Nos 1 to 37. I give my consent.
Ministry of Digital Development and Information
7 January 2025
https://sprs.parl.gov.sg/search/#/sprs3topic?reportid=oral-answer-3743
Office of the Leader of the Opposition 