SINGAPORE - Proposed changes to the law to restrict the use of contact tracing data in criminal investigations to serious crimes will override all other laws.
This means that public agencies cannot cite other laws to compel the use or disclosure of the personal data except for contact tracing in the fight against the coronavirus pandemic or for investigations into only serious crimes, such as murder and terrorism.
The contact tracing data that the Covid-19 (Temporary Measures) (Amendment) Bill protects includes the proximity data of nearby users of contact tracing devices, the places that people visited and their personal information such as their names, identification numbers and contact details.
The Bill was introduced in Parliament on Monday (Feb 1) by Minister Vivian Balakrishnan on a Certificate of Urgency, which means that the proposed law is urgent enough to be put through all three readings in one parliamentary sitting, instead of separate sessions.
Dr Balakrishnan, who is Foreign Minister, is also Minister-in-charge of the Smart Nation Initiative, and introduced the Bill on behalf of Law Minister K. Shanmugam.
The Smart Nation and Digital Government Office (SNDGO) said in a statement on Monday that the Government is introducing the Bill "under extraordinary circumstances".
"For contact tracing to be carried out effectively, we continue to require the strong support and active usage of the TraceTogether app or token, to keep ourselves and Singapore safe," said the office. "The legislation is intended to remove any doubt about what personal contact tracing data can be used for."
The Bill also stipulates that any unauthorised use or disclosure of personal contact tracing data is an offence. Those found guilty of flouting the rule can be fined up to $20,000, jailed up to two years or both.
[[nid:509008]]
This is higher than the penalties under the Public Sector (Governance) Act, which states that public officers who recklessly or knowingly disclose the personal data of Singaporeans without authorisation or misuse it may be fined $5,000, jailed for two years, or both.
The proposed law's introduction follows an outcry after Minister of State for Home Affairs Desmond Tan revealed on Jan 4 that under the Criminal Procedure Code, the police can obtain any data under Singapore's jurisdiction for criminal investigations, including TraceTogether data.
It appeared to contradict statements the Government had made last year - that TraceTogether data would be used only for contact tracing to tackle the pandemic.
On Jan 8, the SNDGO said a Bill would be tabled in Parliament to formalise assurances made earlier that data from the TraceTogether contact tracing programme, if needed for criminal investigations, can be used to look into only seven categories of serious offences.
It said at the time that it was "not in the public interest to completely deny the police access to such data, when the safety of the public or the proper conduct of justice is at stake".
But the office added: "We acknowledge our error in not stating that data from TraceTogether is not exempt from the Criminal Procedure Code".
[[nid:517258]]
On Monday, the SNDGO said contact tracing must continue to be done well so that Singapore can manage the Covid-19 crisis successfully, ring-fence cases quickly and keep community cases from rising.
It cited how TraceTogether, together with other digital contact tracing tools, has shortened the average time required for contact tracing from four days to fewer than 1½ days.
So far, more than 80 per cent of the population have either downloaded the TraceTogether app or collected the token.
The new Bill covers personal data collected through digital contact tracing solutions, including the Government's TraceTogether and SafeEntry programmes, as well as the private sector's BluePass programme which contributes data to TraceTogether.
The TraceTogether app and token exchange Bluetooth signals with nearby users to quickly track those who are exposed to Covid-19 patients.
SafeEntry logs the places a person has visited via QR code scanning.
[[nid:506003]]
BluePass includes contact tracing tokens used by migrant and local workers living or working in dormitories, as well as those in the construction, marine shipyard and process sectors. The BluePass tokens are compatible with the TraceTogether token or app, which means they can exchange information with one another.
The proposed law protects only contact tracing data which identifies an individual.
It does not cover aggregated or anonymised data that does not identify a person, which the SNDGO said may be used in epidemiological research to "strengthen our public health response", or to monitor the effectiveness of safe management measures businesses put in place.
After the pandemic is over, the Government will stop using the TraceTogether and SafeEntry systems, said the SNDGO.
Public agencies must then stop collecting data under the two programmes and delete the personal contact tracing data collected as soon as reasonably possible.
Parliament will debate the Bill on Tuesday. If passed, the amendments to the law are expected to come into force in the middle of February.
1. Unlawful use or possession of corrosive and explosive substances, firearms or dangerous weapons.
2. Terrorism-related offences under the Terrorism (Suppression of Bombings) Act, Terrorism (Suppression of Financing) Act, and Terrorism (Suppression of Misuse of Radioactive Material) Act.
3. Crimes against people where the victim is seriously hurt or killed, such as murder, culpable homicide not amounting to murder and voluntarily causing grievous hurt, where the victim's injury is of a life-threatening nature.
4. Drug trafficking offences in which the penalty is death.
5. Escape from legal custody where there is reasonable belief that the subject will cause imminent harm to others.
6. Kidnapping, abduction or hostage-taking.
7. Serious sexual offences such as rape and sexual assault by penetration.
This article was first published in The Straits Times. Permission required for reproduction.