Contact tracing data is reserved strictly for the fight against the coronavirus and investigations into the most serious crimes, under proposed legal changes that will override all other legislation.
This means that public agencies cannot cite other laws to compel the use or disclosure of the personal data. It can be used only for tracing contacts to combat the pandemic or for investigations into very serious crimes such as murder and terrorism.
The proposed law follows an outcry after it emerged that the police could obtain TraceTogether data for criminal inquiries.
Called the Covid-19 (Temporary Measures) (Amendment) Bill, it protects information including that of nearby contact tracing device users, the places people visited and personal information such as their names, identification numbers and contact details.
The Bill was introduced in Parliament yesterday by Foreign Minister Vivian Balakrishnan on a Certificate of Urgency. This means that the proposed law is urgent enough to be put through all three readings in one parliamentary sitting, instead of separate sessions.
Dr Balakrishnan, who is in charge of the Smart Nation drive, introduced the Bill on behalf of Law Minister K. Shanmugam. The Smart Nation and Digital Government Office (SNDGO) said in a statement yesterday that the Government is introducing the Bill "under extraordinary circumstances".
"For contact tracing to be carried out effectively, we continue to require the strong support and active usage of the TraceTogether app or token, to keep ourselves and Singapore safe," said the office. "The legislation is intended to remove any doubt about what personal contact tracing data can be used for."
The Bill also stipulates that any unauthorised use or disclosure of personal contact tracing data is an offence. Those found guilty of flouting the rule can be fined up to $20,000, jailed for up to two years or both.
This is higher than the penalties under the Public Sector (Governance) Act, which states that public officers who recklessly or knowingly disclose Singaporeans' personal data without authorisation or misuse it may be fined $5,000, jailed for two years, or both.
The changes follow a backlash after Minister of State for Home Affairs Desmond Tan revealed on Jan 4 that the Criminal Procedure Code allowed the police to obtain any data under Singapore's jurisdiction for criminal investigations, including TraceTogether data.
It appeared to contradict statements the Government made last year that TraceTogether data would be used only for contact tracing to tackle the pandemic.
On Jan 8, the SNDGO said a Bill would be tabled in Parliament to formalise assurances made earlier that data from TraceTogether, if needed for criminal investigations, can be used to look into only seven categories of serious offences.
It said then that it was "not in the public interest to completely deny the police access to such data, when the safety of the public or the proper conduct of justice is at stake".
But the office added: "We acknowledge our error in not stating that data from TraceTogether is not exempt from the Criminal Procedure Code."
The seven types of serious crime listed in the Bill cannot be changed without Parliament's approval. The Ministry of Home Affairs said that within the police, all requests for contact tracing data must be approved by the Criminal Investigation Department.
Yesterday, the SNDGO said contact tracing must continue to be done well so that Singapore can manage the Covid-19 crisis successfully. So far, more than 80 per cent of the population have either downloaded the TraceTogether app or collected the token.
The Bill covers personal data collected through digital contact tracing solutions, including the Government's TraceTogether and SafeEntry programmes, as well as the private sector's BluePass programme which contributes data to TraceTogether. Removing any of these from the Bill requires Parliament's approval but adding more solutions, and thus limiting the use of more data, can be approved by a minister.
The proposed law protects only data which identifies an individual. It does not cover aggregated or anonymised data, which the SNDGO said may be used in epidemiological research.
After the pandemic is over, the Government will stop using TraceTogether and SafeEntry, said the SNDGO. Public agencies must then stop collecting data under the programmes and delete the personal contact tracing data collected as soon as reasonably possible.
Parliament will debate the Bill today. If passed, the amendments to the law are expected to come into force in the middle of this month.