For a country that prides itself on being on the cutting edge of high-tech governance, there has been little national discussion in Singapore on the balance between data collection and individual privacy.
Now, COVID-19 has forced the conversation, after it was revealed that data from the government’s contact-tracing app, contrary to initial promises, could also be used for criminal investigations.
The public backlash prompted the government to not only acknowledge that it had made a mistake but also to introduce new legislation to restrict the use of the data.
Under the new amendments to the COVID-19 (Temporary Measures) Act, passed in the Singapore Parliament this month, personal data collected by digital pandemic contact-tracing programmes can only be used to contact trace, unless it is required by law enforcement for investigations into “serious offences”.
Pritam Singh, the leader of the opposition, has called for an “immediate conversation” on the balance between individual privacy and the use of technology and data collection in Singapore.
“To counter scepticism and its resultant behaviours and to replace it with trust and cooperation, Singaporeans also need to better understand the necessity and ambit of data collection. This is especially so for a new generation who are more likely to be concerned about privacy and individual rights,” he said in Parliament.
Prepared by the country’s experience with SARS in 2003, the Singapore government quickly rolled out a test-and-trace strategy in the early days of the coronavirus’ emergence and poured resources into developing digital solutions to speed up the process.
Throughout the pandemic, Singaporeans have been introduced to contact-tracing programmes such as SafeEntry, which uses QR codes to register people’s entry into and exit from public venues, and TraceTogether, a Bluetooth-enabled app that swaps anonymous pings with other devices to generate a list of close contacts.SafeEntry is currently mandatory across the island, applying to a wide range of venues, such as shopping malls, restaurants and workplaces.
The response to TraceTogether was lukewarm when it first launched in March 2020, but adoption shot up later in the year, after the government indicated its intention to make it mandatory. Apart from the smartphone app, wearable devices – operating on the same principles – were also made available. More than 80 percent of the city-state’s 5.7 million residents has adopted either the TraceTogether app or the device so far.
To assuage concerns over privacy, the government had assured Singaporeans that digital contact-tracing data would only be used to track people down who might have been exposed to the virus. “TraceTogether app, TraceTogether running on a device and the data generated, is purely for contact-tracing. Period,” Vivian Balakrishnan, the minister in charge of Singapore’s Smart Nation initiative said at a press conference on 8 June last year. Teo Chee Hean, the coordinating minister for national security, made a similar assertion in Parliament just days before.
Half a year later, Balakrishnan was forced to admit in Parliament that he had not been thinking of the Criminal Procedure Code – which gives law enforcement expansive powers to obtain information for their investigations – when he spoke at that press conference.
“Perhaps I was so enamoured by what I thought was the ingenuity and brilliance of this that I got blindsided,” he said in Parliament last week. “I regret the consternation and anxiety caused.”
However, the Ministry of Home Affairs confirmed last week that the police had requested, and obtained, TraceTogether data for a murder investigation in May 2020 – about a month before Balakrishnan spoke at the press conference. The minister has said that he did not know of the case until October, when he was first made aware of the oversight following questions from a member of the public.
In deploying their own contact-tracing technology, other countries have also had to contend with questions about privacy and data security. Australia, for instance, developed the COVIDSafe app based on the same application protocol behind TraceTogether but passed legislation to ensure that the gathered data could only be used in contact-tracing efforts.
The government hopes that the new legislation will remedy any erosion of public trust in Singapore’s contact-tracing programmes. The new law limits police access to such data to investigations into seven classes of offences, such as rape, kidnapping, murder, or drug offences punishable by death.
Arguing that Singapore is in “exceptional circumstances”, Balakrishnan emphasised the urgent need to focus on dealing with the pandemic.
“This is crucial because the virus is a clear, present and growing threat. And it will remain so for some time. We cannot afford to be distracted from our fight against COVID-19,” he said.