Bill introduced to spell out use of TraceTogether, SafeEntry data for investigations and contact tracing

• A draft law specifies that the data from TraceTogether, SafeEntry may be used only for contact tracing and criminal investigations into serious offences
• Public agencies must also stop collecting such data and delete them “as soon as reasonably practicable” after the pandemic ebbs
• More than 84 per cent of the population have downloaded the TraceTogether app or collected the token

SINGAPORE — An amendment to temporary Covid-19 laws tabled in Parliament on Monday (Feb 1) spells out how the Government is allowed to use contact-tracing data, formalising assurances set out earlier by government leaders on its use.

For instance, users whose data is needed for contact tracing or criminal investigations will be asked to surrender their TraceTogether token or submit their data by entering a personal identification number.

The Covid-19 (Temporary Measures) (Amendment) Bill was tabled by Dr Vivian Balakrishnan, Minister-in-charge of the Smart Nation Initiative, on behalf of Law Minister K Shanmugam under a certificate of urgency signed by President Halimah Yacob. 

This allows the legislation to be fast-tracked in a single parliamentary sitting. It will be debated in the House on Tuesday. 

The revelation in Parliament last month that the police may obtain data from TraceTogether, a key contact-tracing tool, for criminal investigations under the Criminal Procedure Code upset some people, as the Government had earlier assured the public that the data would be used solely for contact tracing to combat Covid-19.

The Smart Nation and Digital Government Group (SNDGG) under the Prime Minister’s Office said that more than 84 per cent of Singapore’s population have downloaded the TraceTogether mobile application or collected the TraceTogether token. 

With data from these digital tools, the average time it takes to identify a Covid-19 patient’s close contacts has been cut from an average of four days to less than one-and-a-half days.

WHY IT MATTERS 

• The law, if passed, gives legal force to the authorities’ commitments that data from TraceTogether and the SafeEntry check-in system may be used only for contact tracing, except when there is a pressing need to use such data for criminal investigations into serious offences 

• The draft laws also specify that after the pandemic ends, public agencies must stop collecting contact-tracing data and delete any personalised contact-tracing information collected “as soon as reasonably practicable”

• The authorities hope the legislation will encourage the public to continue taking part in the TraceTogether programme by removing any doubt about the purpose and use of the data 

HOW YOUR DATA WILL BE PROTECTED

The law applies to contact-tracing data that will identify an individual. It does not cover anonymised or aggregate data recorded by these systems.

It will apply to all data collected through TraceTogether and SafeEntry since the programmes were launched early last year.

Under the amendments, any public officer or contractor found guilty of unauthorised use or disclosure of personal contact-tracing data can be fined up to S$20,000 or jailed up to two years, or punished with both. 

No other law can override this legislation when it pertains to the use or disclosure of personal contact-tracing data.

Once the pandemic ebbs, the TraceTogether and SafeEntry programmes will be stood down.

WHAT DATA IS PROTECTED

There are safeguards in place to protect the data of users. 

TraceTogether exchanges Bluetooth signals with other users who are nearby to track people exposed to confirmed Covid-19 cases. 

• The data is encrypted and stored on a user’s device. It is automatically deleted after 25 days

• If data is needed for contact tracing or criminal investigations, users will be asked to surrender their token or submit their data by entering a personal identification number

SafeEntry keeps a log of a person’s visits to certain public places. 

• The data is encrypted and stored on a government server. It is also automatically deleted after 25 days

• Data needed for contact tracing or criminal investigations will be retained until it is “deemed no longer necessary”, SNDGG said

BluePass is a contact-tracing token distributed to more than 500,000 migrant and resident workers housed in dormitories as well as those in the construction, marine shipyard and process sectors.

• The tokens work similarly to TraceTogether tokens. Users must surrender their tokens if their data is needed for contact tracing or criminal investigations 

• While the BluePass token is developed by technology firm D’Crypt, which is owned by state investment firm Temasek Holdings, any person who misuses the contact-tracing data will be dealt with under this legislation

Parliament must approve the removal of any system from this list of contact-tracing systems covered by the amendment, but the minister may give the go-ahead for more systems to be added. 

That is because any data added to the list will come with greater safeguards on its use, compared with when it is not on the list.

WHAT IS A SERIOUS OFFENCE

The police and law enforcement agencies will be allowed to use personal contact-tracing data for seven categories of serious offences: 

• Those involving the use or possession of corrosive substances, or offensive or dangerous weapons (for example, the possession of firearms or armed robbery with the use of firearms)

• Terrorism-related offences under the Terrorism (Suppression of Bombings) Act, Terrorism (Suppression of Financing) Act, and Terrorism (Suppression of Misuse of Radioactive Material) Act

• Crimes where a victim is seriously hurt or killed, such as murder, culpable homicide not amounting to murder or voluntarily causing grievous hurt (where the victim’s injury is life-threatening)

• Drug trafficking offences that carry the death penalty

• Escape from legal custody where there is reasonable belief that the subject will cause imminent harm to others

• Kidnapping

• Serious sexual offences such as rape or sexual assault by penetration 

This list cannot be amended without Parliament’s approval.

HOW ANONYMISED DATA WILL BE USED 

As for information collected through TraceTogether or SafeEntry that does not identify an individual, it may be used for other purposes, such as research on the spread and nature of Covid-19 or to monitor the effectiveness of precautions against Covid-19 that businesses have put in place.

Although the use of such anonymised data will not be covered under this legislation, public agencies must comply with government instruction manuals and the Public Sector (Governance) Act, which provides a consistent governance framework across Singapore’s public agencies and supports a whole‑of‑government approach to the delivery of public-sector services.