When you go for an operation, the nurse or doctor will first ask you for your NRIC number before pushing you into the operating theatre and before proceeding with the operation.
They won’t depend on your name to identify you before operating on you because many people have the same names.
Because the main purpose of the NRIC number is to be a unique identifier, it cannot be a secret.ย
Difference between identifier and authenticator
A personโs name and NRIC number identifies who the person is.
๐๐๐๐ต๐ฒ๐ป๐๐ถ๐ฐ๐ฎ๐๐ถ๐ผ๐ป ๐ถ๐ ๐ฎ๐ฏ๐ผ๐๐ ๐ฝ๐ฟ๐ผ๐๐ถ๐ป๐ด ๐๐ผ๐ ๐ฎ๐ฟ๐ฒ ๐๐ต๐ผ ๐๐ผ๐ ๐ฐ๐น๐ฎ๐ถ๐บ ๐๐ผ ๐ฏ๐ฒ.
This requires proof of identity, for example, through a password, a security token or biometric data.
Over time, increasingly, NRIC numbers have become more than just an identifier.
They have also become an authenticator. ๐๐ป๐ฑ ๐๐ต๐ฎ๐’๐ ๐ฎ ๐ฝ๐ฟ๐ผ๐ฏ๐น๐ฒ๐บ.ย
As the NRIC number is not a secret, it should not be used by an organisation for authentication purposes.
Some organisations have started depending on a person producing his full NRIC number as proof that the person is who he or she claims to be. He or she is then granted access to privileged information or services. That is, the NRIC number has also become an authenticator. This is not a good idea. Since our NRIC numbers are known to some other people, someone unauthorised may misuse our NRIC number to get access.
Moving away from using NRIC number as authenticator while problem is still contained
As Minister Josephine Teo explained at the Press Conference on the responsible use of NRIC numbers, it is not a good idea to use the NRIC numbers as an authenticator because we must assume that our NRIC numbers are known to quite a few people.ย
“We therefore had to change the status quo, to move away from the NRIC number as an authenticator, and from using masked NRIC numbers for that false sense of security,” Mrs Teo said.
“We knew this had to be done over a period of time, and that a major effort would be needed to help Singaporeans understand the risks, because of our longstanding practices and habits. And it is better to do this while the problem is relatively contained,” she added.ย
Do you know that the PDPC (Personal Data Protection Commission) has previously taken action against organisations which have used NRIC numbers for authentication and breached their data protection obligations?
What moving away from using masked NRIC numbers means
“It does not mean automatically unmasking and using the full NRIC number in all circumstances,” Mrs Teo said.
“In other words, just because we move away from using masked NRIC numbers, doesnโt mean that we switch everything into an unmasked NRIC number, fully exposing the NRIC number.”
In instances such as before the doctor performs a procedure or a nurse dispenses medication, it will be safer and more accurate to use the full NRIC.
In other instances, such as signing up for retail membership or lucky draws, there is no need to use the NRIC number at all. There are alternatives like mobile numbers or email addresses that can be used.
Mr Teo explained that the current practices around the use of NRIC numbers today makes us vulnerable.ย
“We may assume a caller who can tell us our NRIC number to be a figure of authority. This makes us vulnerable to potential scammers. Some organisations also accept NRIC numbers โ whether full or partial โ as a way to prove that the person is who he claims to be, and that allows him to access confidential documents like e-statements or controlled services. This is not secure.”
No rush to change policy. Focus first on incorrect use of NRICย
Changing wrong practices and mindset take time. The Government is not in a rush to change the policy, Mrs Teo said.ย
“We will start by focusing on the incorrect use of NRIC numbers and stopping such practices. This means moving away from using the NRIC number as a password; and moving away from using the NRIC number as an authenticator, to prove that a person is who he claims to be,” she said.ย ย
The proper way to handle NRIC numbers is spelt out in the PDPCโs Advisory Guidelines on the use of NRIC.ย
“We are taking the publicโs concerns on this matter seriously and we want to offer them better protection.
We are not making drastic overnight changes. We do however need to move decisively to phase out the incorrect uses of the NRIC number, the sooner, the better. This will allow us to more confidently use the full NRIC number as a unique identifier,” Mrs Teo said.ย
We need to move decisively to phase out the incorrect uses of the NRIC number, the sooner, the better. This will allow us to more confidently use the full NRIC number as a unique identifier.
