SINGAPORE - Several MPs yesterday had questions for Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan and Home Affairs and Law Minister K. Shanmugam following the disclosure in Parliament on Monday that TraceTogether data can be used in police investigations, and yesterday's clarification on how it will be used judiciously. Here are edited excerpts of the exchange.

Leader of the Opposition Pritam Singh (Aljunied GRC):

(On the) comment Minister made about the police judiciously using information collected by TraceTogether, can the Minister further explain under what circumstances the police would be calling on that information?

The expectation cannot be that this information would be used at first instance whenever a police investigation commences.

Some clarification of this would be quite important for members of the public because everybody wants TraceTogether to succeed in view of the public health considerations.

But this particular point has caused consternation and that also probably explains why Minister has decided to make this clarification.

Mr Shanmugam: Under Section 20 of the Criminal Procedure Code (CPC), the police are authorised to recover, seek any information within the possession of a person.

Let's say there is a murder and information is available on the TraceTogether token. If police choose not to seek that information, you can imagine how the victim's family and the rest of Singapore might react to that. You could even argue that there can be a judicial review application in such a situation.

However, given that this TraceTogether token is necessary for dealing with the epidemic and it's of national importance and its purposes are to help us deal with the pandemic, the police approach has been - and will be - that it is pretty much restricted to very serious offences. And while that requirement is not in the legislation, it will be carefully considered within the police and discretion will be exercised in seeking this information.

Mr Christopher de Souza (Holland-Bukit Timah GRC):

Will the data be deleted at the end of the investigations if it doesn't yield anything, or at the end of the case?

Mr Shanmugam: If the data is of no particular use, yes, it will be deleted, otherwise it will have to be produced in court... or used for trial purposes even if not produced in court.

Mr Gerald Giam (Aljunied GRC):

Minister Balakrishnan just said that once the pandemic has passed, the TraceTogether programme will be stood down. Will the data that's collected, including data that's beyond 25 days, will that be stored on a server and will that still be accessible by the police if they invoke the CPC?

And has the Government considered the impact that yesterday's clarification would have on the adoption and the usage of the TraceTogether app as well as the token, because although we might have 78 per cent adoption, there's no real way of finding out whether people are actually using the system?

Dr Balakrishnan: First, let me deal with the data in your phones and in your tokens. All that is encrypted and it's auto purged after 25 days. So you don't need to wait for the end of the pandemic before your longer-term historical data, beyond 25 days, is auto deleted.

Second, what impact does all this open discussion have on participation and on the way we handle the pandemic itself? There were people who said: "Well, you've got a tool, make it compulsory, just enforce it. This is a clear and present emergency." And Members will recall that on numerous occasions in this House and outside, I've asked that to the maximum extent, I'm going to try to make this voluntary - a much harder target, an approach which requires constant explanation, and sometimes I will get it wrong. And when I get it wrong, I will just come clean and say so.

You should be asking me: Why do you take such a leceh, laborious approach? And that's because I believe that our victory over this pandemic is not by us sitting up here issuing rules and edicts, but that our people must understand not only the measures that we are implementing, but why we are implementing it, the spirit behind it, so that with their understanding and voluntary and full cooperation, we can achieve success.

And the reason we are now in this happy situation, in stark contrast to virtually anywhere else in the world, is not just because we've got two wonderful co-chairmen, Minister Gan (Kim Yong) and Mr Lawrence Wong, and it's not because we've got such technological wizardry, but it's trust, it's understanding, it's cooperation and it's collective responsibility.

So the purpose of the answer to the question yesterday by Minister of State (for Home Affairs) Desmond Tan, is that we want to be completely above board and transparent. The reason I asked Speaker's permission to make this clarification is because of this.

If there's disquiet, if there's uncertainty, we must answer it.We must be forthright, honest, open, transparent... It is in that spirit that we have these open discussions and why I remain confident that the participation rate in contact tracing using the latest tools that we have will remain high, and why I hope we will continue to be one of the bright spots in the world.

I appeal to you, by all means, continue to push us, ask us, question us, disagree with us. This is the attitude by which we will make progress and overcome.

Ms Tin Pei Ling (MacPherson):

The TraceTogether token does not have the GPS function and the data will be deleted after 25 days. For the handphone app, because the handphone itself has GPS function, would this also apply to the TT applications on phones?

Next, the police has a range of ways of collecting the data or information that they need for criminal investigations. Given the exchanges of Bluetooth information, how is the data from TraceTogether useful to police investigation into crimes?

Lastly, I would like to ask Minister for his reaffirmation that the vast majority of Singaporeans will not be affected by this.

Dr Balakrishnan: First, the token has no GPS chip, and we've opened it up, we've allowed external parties to dissemble it. So there's no way the token can keep track of location. Ms Tin makes the point that most smartphones nowadays do have a GPS chip. But we have been very careful in our coding for the TraceTogether app that it does not keep a record of GPS locations. The only thing the TraceTogether app keeps track of is proximity on the basis of Bluetooth data.

On your second question whether this is useful, that's an operational question which I will leave to the police - whether proximity data is useful or not, and how they would use it.

Your final question was on the assurance that the majority will not be affected. The vast majority of Singaporeans are not involved in or assisting in criminal investigations. In that sense, they are not affected.

But TraceTogether, and its success, affects the welfare and the public health of all of us.

And in that sense, confidence in this programme makes a difference to all of us.

Non-Constituency MP Leong Mun Wai:

How many instances are there where the police have tapped the data from the TraceTogether app?

I would also like the Minister to clarify further, when did he discover that his statement (on TraceTogether being used only for contact tracing) is going to be affected by the CPC?

Two, his message today, is it (that) he wants to apologise that the Government or the Minister had made an oversight, or is he telling us that in Singapore, we should just take it that under the CPC, they will be able to access all the information they have on us?

Dr Balakrishnan: As far as I'm aware, there's been only one, which involved a murder case. But I'm not privy to operational details, and I shouldn't be, and therefore I'm not in a position to comment further on the investigations.

(When) I made the comments and statements earlier, the CPC was not in my mind. Subsequently, we've been having discussions, especially over the last few weeks, as to whether we should in fact change the law or whether we continue as we are now. In any case, we decided it's better to be upfront.

That's why we're very glad Mr de Souza asked the question and Minister of State Desmond Tan answered it yesterday.

I've been in the House now for almost 20 years and all the staff who have worked with me over the years will know that I am obsessively concerned with accuracy, needless to say, absolute adherence to honesty. And that means over the years, from time to time, when I have misspoken, I have said so.

I've never shied away from saying so because, as I said, it is far more important to maintain trust. And I might be right or I might be wrong or I might have mistaken something or overlooked something, but rest assured when I discover it, I will say so, and to the best extent possible, we will find a solution together. That is my approach and I don't see any need to change from that and I hope you understand.

Mr Murali Pillai (Bukit Batok):

I recall Mr Giam, in the debate on the Personal Data Protection (Amendment) Bill raised the possibility of linking the standards under the Personal Data Protection Act (PDPA) and the government standards in relation to data protection with the General Data Protection Regulation (GDPR) of the European Union.

Now, as far as the general data protection regulations of the EU are concerned, there is a carve-out in relation to police investigations.

In fact, police may access personal data in relation to detection, prevention, investigation, as well as prosecution for criminal offences. So in a sense, there's parity in relation to the Singapore situation with that of the situation in the EU.

Mr Giam: My purpose for raising that intervention yesterday was mainly in the interest of maximising the adoption of TraceTogether. I have been a strong advocate of it on the ground with my residents, in the face of quite a bit of scepticism about the system. And I've actually tried to convince people to not only use the token, but also use the app, and use the app instead of using the token if they have a mobile phone. I just want to put on record that I do support the TraceTogether system and I do encourage Singaporeans to use the token or the app as much as they can.

In response to Mr Murali's point about the GDPR and the PDPA, I don't intend to open up a whole debate about this, but just to clarify that what I said during the debate was that the GDPR does have carve-outs for security purposes.

So it is possible to have a PDPA that has carve-outs that allow the police to do certain things and access certain data. So it's not incongruent to what I said earlier on.