Who's speaking?

Vivian Balakrishnan, Minister-in-charge of the Smart Nation Initiative.

Why is he speaking?

Vivian gave a final wrap-up speech in Parliament after hearing questions asked by Members of Parliament (MPs) about the Covid-19 (Temporary Measures) (Amendment) Bill, which codifies how the government can use data from contact tracing systems like TraceTogether or Safe Entry.

The 48-minute-long speech took place on Feb. 2 in Parliament during the second reading of the bill.

What happened previously?

In January, it was revealed in Parliament that the data from the TraceTogether programme, intended for contact tracing to fight the Covid-19 pandemic, was also subject to the Criminal Procedure Code (CPC).

This meant that the police could access the data for purposes unrelated to contact-tracing, if they deem it necessary.

Ministers then clarified that the data will only be accessed in cases of serious offences, and a bill was introduced to codify that into law.

What did he say?

In response to a question asked by Leader of the Opposition, Workers' Party (WP) chief Pritam Singh, Vivian laid out the timeline of his TraceTogether journey.

The potential use of the data by the police did not cross his mind or that of his engineers. That is why in June 2020, he said that the TraceTogether data would only be used for contact tracing purposes, which Vivian said was wrong.

Vivian said his "enthusiasm" for the technology "blindsided" him and he did not read Section 20 of the Criminal Procedure Code (CPC).

When did he realise the error?

Vivian said towards the end of October 2020, a member of the public asked him if he was certain TraceTogether data would not be used in murder cases.

He asked his staff to double-check that application. Vivian explained:

"At that point, I was informed that the CPC applied, and that in fact the police had requested TraceTogether data on one previous occasion."

What happened next?

Vivian had many "sleepless nights" and engaged in several rounds of discussion with Cabinet colleagues whether they should carve out the contact tracing data from the application of the CPC.

He said his own "strongly held view" was that even if the CPC applied, and data was to be accessed, it should be exercised with the utmost restraint.

Regardless of the outcome of the internal review, he said he would return to Parliament to clarify matters.

In response to another of Singh's questions, Vivian said that Member of Parliament Christopher de Souza filed his parliamentary question on TraceTogether data use in early December 2020, about a month after he had commenced this internal review.

Vivian said he was giving this information as he had nothing to hide, and remarked that if in June he had added a caveat -- "subject to prevailing legislation" -- the members would not be discussing this today.

Addressing three broad categories of comments and queries

Vivian said he would elaborate on three categories:

1. How to maintain trust in participation in digital contact tracing.
2. Technical features and safeguards of TraceTogether and Safe Entry.
3. Clarifications on specific clauses within the bill.

Maintaining trust

Vivian drew on his experience as a doctor, saying that when mistakes occur, complete transparency is important.

He will acknowledge the error, take full responsibility, and do everything he can to remedy the problem. "It's no different from a complication in surgery," he said.

He also warned the House to "beware of false dichotomies", such as choosing between saving the life of a child, or participation in digital contact tracing.

Vivian said that by being completely open, he believes Singapore could have both a successful contact tracing programme and allow the police to help keep Singapore safe and secure.

He gave a few examples, including, "If the parents of a kidnapped child found the token and desperately asked the police to unlock it. Which one of you would refuse?"

Vivian said he believes the bill strikes the right balance between restricting the use of accessing personal data, and allowing the police to do their duty.

Don't politicise contact tracing

He also added that in the past month, 350 people have asked the government to delete their data, but 390,000 have come on board the TraceTogether programme.

He acknowledged WP's Gerald Giam and Louis Ng's questions about how users can "game" the system by downloading the app but rendering it non-functional.

However, Vivian reminded everyone that the programme is meant to protect themselves and their loved ones, and added, "I would just ask you why. Why deprive yourself and your loved one that sort of protection?"

He said that one reason Singapore is better off in terms of its Covid-19 response is that Singapore has avoided politicising mask-wearing, and he was grateful for Singh and the Workers' Party for not politicising the matter.

Technical safeguards

In response to Ang Mo Kio GRC MP Nadia Samdin, Vivian explained that by design, TraceTogether data will be stored in the user's device before it is shared with the authorities.

Active participation as the government will send the affected user a PIN, which must be entered before the data is uploaded.

Users can still delete their data upon request, but in cases where data has already been uploaded because there was an active Covid-19 case, the Ministry of Health (MOH) will retain the data for as long as the cluster remains active.

The bill also does not prohibit individuals from requesting their own personal contact tracing data, even in cases where they are being charged for a serious offence, provided they have a right to do so. They can share their own data with anyone, including the police or the court, as evidence if needed to strengthen their own defence.

Clarifications on how data will be used and deleted

In response to Choa Chu Kang GRC MP Zhulkarnain Abdul Rahim, who suggested that an independent channel could be set up to investigate breaches or complaints about misuse of the data, Vivian said that such cases will be investigated by an authorised person under the Government Data Office, and will be appointed by Senior Minister Teo Chee Hean as a "clear separation" of roles and duties.

In response to Giam, Vivian said in general, the police will not be able to obtain data after the 25-day mark because the data would have been auto-deleted.

However there are some exceptional scenarios where data could be stored for more than 25 days, such as active Covid-19 tracing, or if the data is used for investigations into serious offences, and it will be deleted once the criminal and court proceedings are over.

Personal data that is no longer required will also be deleted when the Covid-19 pandemic is declared over.

Bill is not a precedent

Vivian emphasised that this bill is meant to strike a balance between privacy, public health and public safety, it comes about during an extraordinary time, and is not meant to set a precedent.

Instead, the bill is about ensuring maximum support from the public in the fight against Covid-19.

He reminded the House that such debates over privacy, advancing technology and public safety requires open consultation and debate, and should not be settled in one day.

Instead, there will be opportunities in the future to have that debate.

You can see the full video at this link.

In his follow-up, Singh urged the public to download and make use of TraceTogether in the interest of public health, to which Vivian thanked him for the vote of confidence.