Private sector urged to stop using NRIC numbers as passwords, with new advisory issued
The Government has been taking steps since January to ensure the proper use of NRIC numbers in the private sector. ST PHOTO: MARK CHEONG
Private sector urged to stop using NRIC numbers as passwords, with new advisory issued
SINGAPORE - A new guide to stop the use of National Registration Identity Card (NRIC) numbers as passwords in the private sector was issued on June 26, with organisations advised to stop this practice 'as soon as possible'.
The advisory by the Personal Data Protection Commission and Cyber Security Agency of Singapore has been posted on both their websites, said the Ministry of Digital Development and Information (MDDI) in a statement on June 26 .
The Government has been taking steps since January to ensure the proper use of NRIC numbers in the private sector, and is working with the finance, healthcare and telecommunications sectors, among others, in the coming months to develop targeted guidance, the ministry added.
Private sector organisations currently may require a person to use their NRIC number as a password to access information intended only for them in certain documents, such as insurance records .
This is unsafe because the person's NRIC number may be known to others, allowing others to impersonate them and have access to their personal data or records, MDDI said.
This is different from organisations using NRIC numbers to identify a person over the phone or online.
Private sector organisations are advised to move away from using full or partial NRIC numbers to authenticate a person's identity 'as soon as possible', MDDI said.
This includes stopping the use of NRIC numbers as default passwords or partial NRIC numbers that are combined with a date that is easily obtainable, such as date of birth, in documents like password-protected files sent via e-mail.
If it is necessary to authenticate a person, MDDI suggested that organisations use methods such as asking the person to use strong passwords, use a security token or have a fingerprint identification system.
'The government remains committed to protecting citizens' personal data and ensuring its secure use for rightful purposes,' added MDDI.
The issue of privacy of NRIC numbers arose in December 2024, when users of the Accounting and Corporate Regulatory Authority's new Bizfile web portal raised concerns after realising that people could search for and view the full NRIC numbers of others, without having to log in.
Join ST's WhatsApp Channel and get the latest news and must-reads.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Business Times
4 hours ago
- Business Times
Stop use of NRIC numbers for authentication, agencies urge private sector: MDDI
[SINGAPORE] The Personal Data Protection Commission (PDPC) and Cyber Security Agency (CSA) advised private organisations to stop using national registration identity card (NRIC) numbers for authentication in a joint advisory posted on their websites on Thursday (Jun 26). This comes on the back of government efforts, since January, to ensure the proper use of NRIC numbers in the private sector to better protect citizens, the Ministry of Digital Development and Information (MDDI) said in a statement on the same day. 'NRIC numbers should not be used to prove that a person is who he claims to be for the purposes of trying to gain access to services or information meant only for that person,' the MDDI statement said. 'It is unsafe for organisations to use NRIC numbers in this manner because a person's NRIC number may be known to others, permitting anyone who knows his NRIC number to impersonate him and easily access his personal data or records,' the MDDI statement added. The ministry noted that some private sector organisations currently require individuals to use their NRICs as passwords to access information intended solely for them, such as insurance documents. Organisations that use full or partial NRIC numbers for authentication should transition away from this practice as soon as possible, it said. This includes not setting NRIC numbers as default passwords and not using full or partial NRIC numbers with other easily obtainable personal data. 'If it is necessary to authenticate a person, organisations should consider alternative methods, for example requiring the person to use strong passwords, a security token or fingerprint identification,' the MDDI statement said.
CNA
6 hours ago
- CNA
Bishan to get 200,000 sq m of new office space, matching scale of Paya Lebar Central: Chee Hong Tat
SINGAPORE: Plans to develop Bishan into a new business hub could see the introduction of around 200,000 sq m of new office space to the area, said National Development Minister Chee Hong Tat on Thursday (Jun 26). This will match the scale of that in Paya Lebar Central, which currently includes office spaces spread out across the sprawling Paya Lebar Quarter mixed-use development and SingPost Centre. In a video posted on Facebook, Mr Chee also said that work on a new hawker centre integrated with a revamped bus interchange, and a polyclinic in Bishan town centre will start in this term of government and take several years to complete. Plans to refresh Bishan town centre were unveiled in the Urban Redevelopment Authority's (URA) Draft Master Plan 2025 on Wednesday. Redevelopment plans for the area are part of a "decentralisation strategy" to create economic areas beyond the city centre and bring jobs closer to homes. To kickstart the development of this new business hub, selected government agencies are exploring the feasibility of relocating their offices to Bishan town centre, URA has said. Other plans for the area include turning Bishan Place – located next to Junction 8 shopping centre and the bus interchange – into a pedestrian mall, and improved connectivity for residents, said Mr Chee, who is a Member of Parliament for Bishan-Toa Payoh GRC. For instance, residents will be able to cycle to upcoming recreational spaces such as those along the North-South Corridor and Kallang River via new cycling paths. There are also plans for a walking and cycling street along the developments in Bishan Road that will be connected to Bishan-Ang Mo Kio Park, he said. The draft master plan is a statutory land use plan that outlines Singapore's development priorities over the next 10 to 15 years. It is reviewed every five years. The latest edition also included plans for new neighbourhoods in areas such as Newton, Paterson, Dover-Medway along Dover Road, the former site of Singapore Racecourse in Kranji, as well as Paya Lebar Air Base and the Sembawang Shipyard area. Together with earlier announced housing developments in Bukit Timah Turf City and Mount Pleasant, at least 80,000 new public and private homes are expected to be built in more than 10 new neighbourhoods across Singapore over the next 10 to 15 years.
Business Times
6 hours ago
- Business Times
Stop using NRIC numbers - full or partial - for authentication, private organisations told
[SINGAPORE] The Personal Data Protection Commission (PDPC) and Cyber Security Agency (CSA) urged private organisations to stop using national registration identity card (NRIC) numbers for authentication in a joint advisory posted on their websites on Thursday (Jun 26). This comes on the back of government efforts, since January, to ensure the proper use of NRIC numbers in the private sector to better protect citizens, the Ministry of Digital Development and Information (MDDI) said in a statement on the same day. 'NRIC numbers should not be used to prove that a person is who he claims to be for the purposes of trying to gain access to services or information meant only for that person,' the MDDI statement said. 'It is unsafe for organisations to use NRIC numbers in this manner because a person's NRIC number may be known to others, permitting anyone who knows his NRIC number to impersonate him and easily access his personal data or records,' the MDDI statement added. The ministry noted that some private sector organisations currently require individuals to use their NRICs as passwords to access information intended solely for them, such as insurance documents. Organisations that use full or partial NRIC numbers for authentication should transition away from this practice as soon as possible, it said. This includes not setting NRIC numbers as default passwords and not using full or partial NRIC numbers with other easily obtainable personal data. 'If it is necessary to authenticate a person, organisations should consider alternative methods, for example requiring the person to use strong passwords, security token or fingerprint identification,' the MDDI statement said.
