Mission Update

Singapore’s reply to the letter from Special Rapporteur on the right to privacy Professor Joseph Cannataci on the thematic report on the management of pandemics with the respect to the right to privacy

14 Sep 2021

14 September 2021

Professor Joseph Cannataci

Special Rapporteur on the right to privacy

Dear Professor Cannataci,

1. I refer to your letter dated 31 July 2021 circulating an advance unedited version of your thematic report on the management of pandemics with respect to the right to privacy that will be presented to the 76^th Session of the UN General Assembly.

    

2. Your concerns about the use of TraceTogether App data and amendments to Singapore’s COVID-19 (Temporary Measures) Act 2020 are based on several misunderstandings. We wish to address your concerns and correct key errors on Singapore’s TraceTogether programme in your report.

    

   Corrections

    

3. First, at 12(1), the report cited the TraceTogether programme as an example of “surveillance creep”. This language is an inaccurate description of the situation.

    

   1. The technical design of TraceTogether precludes its use as a surveillance tool. The data is always stored in the individual’s device in an encrypted form. It is automatically deleted after 25 days. It is only extracted when an individual tests positive for COVID-19 and upon request by the health authorities to upload the data for contact tracing purposes. These were conscious decisions taken to limit the app’s or token’s ability to collect more data than what is necessary for contact tracing.

    

   1. Singapore has been open about how we engineered TraceTogether. We have open-sourced the contact tracing code (called BlueTrace) and have organised open sessions for independent experts to dismantle the token and probe deeper into its design. We are happy to provide further technical information as necessary.

       

   2. Singapore has also committed to decommissioning the TraceTogether programme when it is no longer required to prevent or control the spread of COVID-19, including the deletion of collected data.

    

4. The report correctly states that the Singapore Police Force (the Police) had requested access to TraceTogether data to aid in a murder investigation. This request was made under Section 20 of Singapore’s Criminal Procedure Code (CPC). Section 20 of the CPC empowered the Police to request any data for the purpose of criminal investigations. The provision applied to TraceTogether data just as it did to other forms of sensitive data such as that stored on mobile phones and banking data.

    

5. Second, the effect of the amendments to the COVID-19 (Temporary Measures) Act 2020 which came into effect on 1 March 2021 was to legislate the limits to which existing powers may apply to personal contact tracing data from digital contact tracing solutions. The amendments demonstrate the need for us to review and adapt personal data protection policies as the public health situation calls for new uses of personal data to save lives. The amendments were neither to “formalise the ability of police to access such data”, nor an instance of “function creep”. On the contrary, the amendments restrict the Police’s powers to request TraceTogether data to specified categories of serious offences including terrorism, murder, kidnapping and serious sexual offences such as rape. These categories of serious crimes cannot be changed or expanded without the approval of Singapore’s Parliament. In the interest of transparency, Singapore also publishes half-yearly disclosure reports on requests for TraceTogether data by law enforcement[1].

    

   Importance of TraceTogether data

    

6. TraceTogether enhances Singapore’s contact tracing efforts in the fight against COVID-19 by facilitating quicker identification of individuals who were in close proximity to an infected person using the proximity data collected. With TraceTogether, the average contact-tracing time was reduced from four days to less than two days. TraceTogether data has contributed significantly to Singapore’s success in managing COVID-19. This success has been recognised by the Director-General of the World Health Organisation (WHO) Dr Tedros Adhanom Ghebreyesus.

    

7. I hope that the above helps in your understanding of the importance of TraceTogether data in Singapore’s management of the COVID-19 pandemic. Our laws on the use of this data strike a balance between maintaining confidence in our public health measures, respecting our citizens’ privacy and protecting the safety of our citizens. We do not take the trust of our people lightly.

Yours sincerely,

UMEJ BHATIA

Ambassador and Permanent Representative

[1]Disclosure reports: https://support.tracetogether.gov.sg/hc/en-sg/articles/360062064014-TraceTogether-Disclosure-Report.

TraceTogether Privacy Statement: https://www.tracetogether.gov.sg/common/privacystatement/