In the ID number incident, there were shortcomings in the Accounting and Enterprise Control Bureau (ACRA) and the Digital Development and News Department, but there was no evidence that some personnel deliberately inaction or misconduct.

After investigation, the review team listed six major deficiencies. The Public Services Department, the Digital Department and the Business Administration will conduct a review. The performance evaluation and performance rewards of the leaders and personnel involved will be affected.

State Counselor and National Security Coordinator Zhang Zhixian will issue a ministerial statement on the incident review report in Congress on Thursday (March 6). He is also the Minister in charge of the Smart National Working Group and Digital Government and Public Data.

The new Bizfile platform launched by the Enterprise Administration on December 9 last year once allowed the public to obtain the ID number of relevant people for free by looking for names, which caused concerns. The search function will be paused after four days. After restarting, no ID number will be displayed during the free query stage.

The government then established a review team led by civil servant leader Ye Chengchang to discuss the cause of the incident, the policies on the use of relevant ID numbers, and how to learn from it. The review report was released on Monday (3rd), listing the six major shortcomings that caused the incident and the actions taken afterwards.

Further reading

Yang Liming: The government does not intend to widely disclose ID numbers and attach importance to the public department's data protection responsibilities

Yang Liming: The government does not intend to widely disclose ID numbers and attach importance to the public department's data protection responsibilities

The government will speed up the promotion of the correct usage of ID numbers

The government will speed up the promotion of the correct usage of ID numbers

The review report pointed out that avoidable shortcomings occurred on both sides. This includes the internal notice issued by the Ministry of Digital in July last year requiring public institutions to stop using ID numbers for identity verification and that policies should be communicated more clearly when local hidden ID numbers are no longer used in new business processes and digital products.

Neither the Digital Department nor the Enterprise Management Bureau realized at that time that the staff of the Enterprise Management Bureau mistakenly thought that the newly developed Bizfile platform must disable the local hidden ID number and use the full ID number instead. However, in fact, the platform's query function is an existing function and does not need to be disable immediately.

The review report pointed out that the Digital Department originally planned to provide more detailed policy guidance for existing more complex application scenarios. This measure should also be extended to new and complex applications such as public registries to assist agencies in understanding how to stop using local ID numbers and determine whether a full ID number must be used.

In addition, when the Digital Department held a briefing to explain the content of the internal notice, the staff of the Business Administration Bureau attending did not forward the briefing information and Q&A documents to the Bizfile project leaders and the Business Administration Bureau executives, resulting in the Business Administration Bureau deciding to disclose the complete ID number if the information is incomplete.

The purpose of exposing the complete ID number is to improve corporate transparency, but many people still believe that ID card data is sensitive data and cannot be easily leaked. The CA also did not pre-evaluate how to balance the two public interests, which violated the Instruction Manual on Information Communications Technology & Smart Systems Management.

The security assessment conducted by the Government Science and Technology Bureau on December 14 last year also found that the information technology contractors on Bizfile platform did not fully implement security functions, including restricting the scope of searches. These safety issues have been resolved when the restart was restarted on December 28, and the Enterprise Management Bureau is still following up with the contractors and considering follow-up actions.

The review team also believes that the Digital Department and the Enterprise Management Bureau should take more quickly when the public expresses their concerns, identify key information about the incident and suspend the query function.

The Ministry of Digital, the Bureau of Business Administration and the Ministry of Finance issued a statement Monday to accept the results and suggestions of the review report, and once again apologized for the public anxiety and concerns caused by the loss. “In this incident, the public service department did not meet the standards we set for ourselves.”

Both the Digital Department and the Business Administration have thoroughly reviewed the behavior and responsibilities of the leaders and personnel involved and will take action against them. This includes coaching, additional training, and reevaluating their performance, which may affect their compensation.

Prime Minister Wong Xuncai has agreed to publicly release the review report and discuss it in Parliament.