Police's ability to use TraceTogether data raises questions on trust: Experts

A moviegoer using the TraceTogether app to scan a QR code to check in at a Cathay cinema on Oct 31, 2020.
A moviegoer using the TraceTogether app to scan a QR code to check in at a Cathay cinema on Oct 31, 2020.PHOTO: ST FILE

SINGAPORE - The revelation that TraceTogether data can be used for police investigations has raised questions over trust in government, especially in relation to data privacy, said observers on Tuesday (Jan 5).

Associate Professor Eugene Tan from the Singapore Management University said the news came across as the Government backtracking on its earlier assurance that TraceTogether would be used only for contact tracing.

"It clearly undermines their trust and credibility," said the former Nominated MP.

"This damage could undermine its future efforts, given its reiteration that Singapore has managed to keep Covid-19 under control due only to the people's trust in the Government's measures."

Former Nominated MP Calvin Cheng said in a Facebook post that the Government "should have been upfront that some privacy will be sacrificed for safety and security".

After Minister of State for Home Affairs Desmond Tan on Monday said police are empowered under the Criminal Procedure Code (CPC) to obtain TraceTogether data for criminal investigations, netizens were quick to cite remarks by Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan during a June 8 press conference.

He had said then that TraceTogether data would be used "purely for contact tracing, period".

Addressing the House on Tuesday in an unscheduled statement on the issue, Dr Balakrishnan said: "Frankly, I had not thought of the CPC when I spoke earlier."

National University of Singapore sociologist Tan Ern Ser noted that Singaporeans generally have a high degree of trust in the Government.

But he suggested that an additional layer of safeguards should be created to allay concerns about data privacy, and make sure such data is not misused.

This could come in the form of a committee comprising prominent public figures to which the police would be accountable to, should they plan to use the TraceTogether data, he said.

"I don't think there's an easy, straightforward response to this issue," he added. "The best safeguard, in my view, is the degree to which citizens trust the Government and Police that any data collected would only be used to protect citizens, rather than against them."

Ms Sheena Jacob, a partner at law firm CMS Holborn Asia, said that people's concerns about how their TraceTogether data could be used is a communications and public relations issue.

She called for better clarity around how this data will be used, to provide assurance to Singaporeans and encourage them to participate in the national contact tracing programme.

SMU's Prof Tan suggested that the Government exclude TraceTogether data from the CPC's ambit, given its original intended use for contact tracing as well as the need to convince as many people to get on it as possible.

He added: "A by-the-way or incidental use of TraceTogether should be resisted because it is far more important to have many people to use the programme."

But others noted that TraceTogether data is not the only piece of information the authorities can request, and that the law allows the police to ask for any document or data they deem necessary for investigations.

Mr Gilbert Leong, a senior partner at law firm Dentons Rodyk & Davidson, said it was not practical for the Government to review the law and declare to the public the effect of existing laws on new initiatives each time it launches something like TraceTogether.

He added that there was no backtracking of previous assurances from the Government. While the Government uses TraceTogether data only for contact tracing, it cannot ignore provisions in the law to use the data for law enforcement, he said.

Lawyers The Straits Times spoke to echoed a point that Dr Balakrishnan had made on how the CPC applies not only to TraceTogether, but to other kinds of sensitive data protected by privacy laws such as phone or banking records.

Mr Jonathan Kok, a technology lawyer at Withers KhattarWong, said the police have always been empowered under the CPC to issue a written order to require a person to produce any document or data they believe are necessary for their investigations.

"So if the police require a person to produce his TraceTogether device for their investigations, they are already empowered to do so under the CPC," he said.

LISTEN TO THE BIG STORY PODCAST