COVID-19 (Temporary Measures) (Amendment) Bill

Order for Second Reading read.

1.32 pm

Mr Speaker: Minister Vivian Balakrishnan.

The Minister for Foreign Affairs (Dr Vivian Balakrishnan): Mr Speaker, on behalf of the Minister for Law, I beg to move that "The Bill be now read a Second time."

Let me begin with a mea culpa. We acknowledge our error in not stating that data from TraceTogether is not exempt from the Criminal Procedure Code. I take full responsibility for this mistake and I deeply regret the consternation, the anxiety that was caused by my mistake.

In Parliament last month, the Minister for Home Affairs and I stated that the use of TraceTogether data in investigations or criminal proceedings would be restricted to serious offences. This Bill before us gives legal force to these statements. The legislation specifies that personal data collected through digital contact tracing systems can only be used by public agencies for the specific purpose of contact tracing, except where there is a need to use that data for investigations or criminal proceedings in respect of serious offences. We have decided that these restrictions will cover personal contact tracing data not only from TraceTogether, but also SafeEntry and a private sector system called BluePass insofar as BluePass is interoperable with TraceTogether.

Mr Speaker, this pandemic is not going to go away for quite a long time more. In fact, I do not know exactly when the pandemic will end.

What I do know is that contact tracing, augmented by digital tools, enables us to quickly break the chains of transmission by identifying and isolating close contacts. This is precisely why we need high participation rates in digital contact tracing.

Contact tracing is traditionally a manual, painstaking and very resource-intensive task. Members of the House may recall that – cast your minds back a year ago – at the start of the pandemic, when the number of cases started to grow. And we had to rapidly expand the pool of contact tracers to keep up with the load. We even had to call in reinforcements from the Singapore Armed Forces. But we all knew that this would not be sustainable if the numbers continued to rise. And the numbers did continue to rise.

So, we realised, very early on, that we needed to make better use of both technology and data, including especially proximity data, generated from Bluetooth technology, in order to help our contact tracers carry out their work more effectively and efficiently.

And I say this with the experience of SARS 17 years ago. SARS had much fewer cases than COVID-19 and it was a manual contact tracing system. We would not have been able to cope with the sheer volume this time if we were still using the methods of 17 years ago.

This was why we conceptualised and introduced TraceTogether – to reduce the time and the resources needed to collect some of these essential data for contact tracing. And, if I may add, these efforts have paid off.

TraceTogether, alongside the other digital contact tracing systems, such as SafeEntry, has shortened the average time required for contact tracing from four days to now less than 1.5 days. This means that people who have been exposed, or potentially exposed, are isolated more swiftly. It reduces the probability of them passing on the virus to their family members, friends and the community at large. And where there is widespread adoption of digital contact tracing, the enhanced effectiveness can be very significant.

Let me cite one recent example. In the recent Royal Caribbean Quantum of the Seas case, the use of TraceTogether data helped MOH to quickly identify more than three-quarters of the close contacts – although thankfully, in this case, it turned out to be a false positive.

TraceTogether has also enabled us to trace contacts more comprehensively and to identify many contacts whom the person may not have recalled meeting or even realised that he had been in close contact with. And this is particularly so, when you are with someone whom you do not already know. The probability of your forgetting that interaction is much higher.

TraceTogether was always designed for contact tracing purposes. And this is obvious, if you consider the safeguards and the features of the system. TraceTogether only collects proximity data, which is necessary in order to identify close contacts. It does not collect GPS data; it does not collect movement data. The token does not even have cellular connectivity. These were conscious design decisions made at conception.

Furthermore, the app and the token only keep a temporary record, in an encrypted form, locally on the device itself. And this data is automatically purged after 25 days. The Government also intends to deactivate TraceTogether, along with the other digital contact tracing programmes, once the pandemic is over.

The GovTech engineers and I took great pains to create an app that was fundamentally privacy protecting at its core – privacy by design. We even open sourced the code. We invited experts to come and tear down the TraceTogether token to prove this. Perhaps, I was so enamoured by what I thought was the ingenuity and brilliance of this that I got blindsided.

Prof Ang Peng Hwa of NTU very elegantly described our ethical dilemma as one in which we are dealing with a choice between "right" versus "right". A choice between "right" and "wrong" is very easy to make. But in this case, it is right to protect public health by protecting the data in TraceTogether. But it is also right, and just as important, to protect public safety, especially when it comes to serious crimes – "right" versus "right".

It would indeed be unconscionable to inhibit the ability of the Police to act, when it comes to a serious offence that affects someone's life or safety. Someone came up to me and said, "Think about the example of a kidnapped child. And all that was left was a dropped phone or a token. And if that mother brought that token or phone to the Police, would it be right for us to say, 'No, we cannot and would not do anything about it.'?" In fact, it would be untenable – to adopt a purist ideological stance and to deliberately refuse to check that data and pursue all leads available.

Singapore is one of the safest countries in the world. Our people walk the streets safely, day or night, alone or in groups, with peace of mind, precisely because there is high trust in an effective Police Force that always acts for the public good, that legally pursues all information and leads available to solve and to prevent crimes. We cannot take this safety and security that we value so much for granted even in the midst of this pandemic.

Let me go through the specific legislative amendments that are being proposed.

This Bill sets out what Minister Shanmugam and I said in Parliament last month. It represents a balance between two imperatives. Singaporeans want the protection of TraceTogether. They know it saves lives. Singaporeans also understand and support the Police's continued access to such data for investigations or criminal proceedings in respect of serious offences, to bring perpetrators of crime to justice and to protect public safety and security.

We are moving this Bill on a Certificate of Urgency, so that it may come into effect as soon as possible.

Let me move on to the four key thrusts of this Bill.

Scope of legislation. First, the legislation will cover "personal contact tracing data" recorded in any "digital contact tracing system". Clause 7 of the Bill introduces section 80 to define "personal contact tracing data" to mean "entry or exit records, proximity information or other data collected using any digital contact tracing tool or combination of digital contact tracing tools, that is part of a digital contact tracing system, and which, by itself or with other information, identifies any individual". I apologise for that mouthful of words. Basically, it means, the key point is, data that is personally identifiable.

The "digital contact tracing systems" covered by the Bill are listed in the Sixth Schedule. This will include TraceTogether, SafeEntry and BluePass insofar as it is interoperable with TraceTogether.

SafeEntry, as Members are aware, is a digital equivalent of the visitor record logs. BluePass is a contact tracing system, developed by the private sector, that is capable of interoperating with TraceTogether in order to support the national programme.

We are concerned with protecting personal contact tracing data in the Government’s national digital contact tracing systems, and we will treat all data in the same way, however it enters the national system. Section 84 specifies that the Minister may add to the list of "digital contact tracing systems" if new systems or additional systems are created. However, any removal from the Sixth Schedule will require Parliamentary approval. We will come back here. This means that the Government cannot unilaterally remove any digital contact tracing system from the restrictions imposed by this Bill.

Second, on authorised use and disclosure. The Government's use of the data will be ring-fenced to contact tracing, with the exception for investigations or criminal proceedings in respect of serious offences. Clause 7 of the Bill introduces subsection 82(1), which specifies that the data may only be used to "carry out or facilitate contact tracing". Subsection 82(2) states that the Police and other law enforcement agencies "in the exercise of any power under the Criminal Procedure Code (Chapter 68) or other written law", may not obtain personal contact tracing data, except for "an investigation or criminal proceeding in respect of a serious offence".

There are seven categories of serious offences, set out, quite coincidentally, in the Seventh Schedule. These are offences of a significant severity and/or pose an immediate threat to life or public safety, such as the use of firearms, dangerous weapons, terrorism, murder, drug offences that attract the death penalty, kidnapping and rape. The Government cannot amend this list of offences in the Seventh Schedule without coming back to Parliament for approval.

Third, the Government may not use the data for any purpose other than those mentioned, regardless of any other written law requiring or allowing the disclosure of the data. Just in case "I don't know what I don't know." This is added assurance. This trumps any other written law. This will give added reassurance that there are no further scenarios where public agencies may use the data apart from the purposes stated explicitly in this Bill.

Fourth, on safeguards and data deletion. Clause 7 of the Bill introduces subsection 82(8) which provides for the Minister to specify a date after which a digital contact tracing system is no longer required to prevent or control the spread of COVID-19. The data administrator must then delete any personal contact tracing data which is no longer required.

We have also built other safeguards into our digital contact tracing systems. Today, TraceTogether devices and SafeEntry servers are purged automatically after 25 days, unless that data has been extracted for contact tracing purposes or for the investigations or criminal proceedings in respect of serious offences. This 25-day timeline is set based on the advice of our medical professionals, to account for the incubation period of the virus, which we currently estimate to be 14 days, and the time taken from the onset of symptoms and for the patient to visit a doctor and get tested and, if positive, to notify MOH. This data retention period could change on the advice of medical experts, if the virus continues to evolve and we have a better understanding of the disease, the virus and its incubation period. But the point here is that we will stand guided on the basis of science and medicine.

Before I conclude my speech, I need to remind you that there are two other sections related to the Ministry of Health and Ministry of Law.

Clause 2 of the Bill extends Part 7 of the current Act, for another year, until April 2022. Part 7 provides the legal basis for the Minister for Health to make regulations to prevent or control the spread of COVID-19. These regulations underpin the safe management measures adopted since the circuit breaker last year. As this pandemic will not go away soon, it is imperative that we remain vigilant and continue with safe management measures in our daily lives.

Clause 4 of the Bill amends Part 2A of the Act to set out the Singapore Land Authority's (SLA's) role in the administration of the Rental Relief Framework. The SLA is working to operationalise the Rental Relief Framework.

Mr Speaker, this Bill will give legal force to the statements made by the Minister for Home Affairs and me in this Chamber. You will notice that it has been tightly scoped. It is a specific amendment made in the context of the COVID-19 pandemic – that the Government will limit its use of personal contact tracing data for the purposes of contact tracing, except where there is a need to do so for investigations or criminal proceedings in respect of serious offences.

These are extraordinary times, exceptional circumstances. We are introducing this Bill urgently, to remove any doubt among Singaporeans and to assure everyone that data will be properly safeguarded and used only for the appropriate purposes, so that we may continue to focus our attention towards battling this clear and present threat, the COVID-19 global pandemic.

This is crucial because the virus is a clear, present and, in fact, on a global scale, a growing threat. And it will remain so for some time. So, we cannot afford to be distracted from our fight against COVID-19. We need to rally together, look out for one another, protect public health and safety even as we try carefully to re-open our economy. Mr Speaker, Sir, I beg to move.

Question proposed.

1.53 pm

Mr Pritam Singh (Aljunied): Mr Speaker, Sir, my speech is divided into three topics. First, I will talk about the Government's error in not realising that section 20 of the Criminal Procedure Code applies to TraceTogether data. Second, I will speak on the carving out of the seven categories of offences in the Bill that permits the use of TraceTogether data and I will thereafter set out the Workers' Party's position on the Bill. Third, I will look to the longer term and reflect on the balance between the privacy rights of citizens and the growing power of the state and private companies in collecting and using data and personal information.

I believe there is scope to learn important lessons from the fall-out that has ensued from the Government's admission that TraceTogether data could be used for investigatory purposes, a departure from earlier assurances that TraceTogether would only be used for contact tracing.

First, the Government's error. Sir, Singaporeans are willing to take the actions necessary to combat COVID-19 when called upon by the Government if they believe these actions will help our country and all of us who live and work here.

A few Singaporeans have told me that if the Government had stated upfront that TraceTogether data would be used for the seven categories of serious crimes only, they would have been prepared to prioritise the use of TraceTogether because of the imperative of fighting an epidemic, even those who could have had residual privacy concerns could have been assuaged had the Government detailed the processes and accountability regime for using TraceTogether information in investigations.

Why was there disquiet, unhappiness and even cynicism in some quarters at the Government's belated acknowledgement that TraceTogether can be used for criminal investigations as originally explained by Minister of State Desmond Tan in Parliament last month?

It comes down to a question of trust, the perceived lack of empathy over the public's privacy concerns and discomfort with sharing mobile phone data with the authorities without sufficient assurances.

In fact, from a very early stage the Government clearly contemplated that there would be privacy concerns with the use of TraceTogether for contact tracing.

In his broadcast of 21 April 2020, the Prime Minister said that Singapore intended to make full use of IT, including TraceTogether, which would require everyone's cooperation. He added and, I quote, "There will be some privacy concerns, but we will have to weigh these against the benefits of being able to exit from the circuit breaker and stay open safely."

In the months that followed, the public were told that the number of sign-ups to TraceTogether was not satisfactory.

As late as November, the multi-Ministerial Taskforce linked transiting to phase 3 in our fight against COVID-19 with requiring at least 70% of the population signing up for TraceTogether. Since then and along with the issuance of TraceTogether tokens, this minimum 70% threshold was reportedly reached on 21 November 2020, even as it had been hovering around the 50% mark around two weeks earlier.

When Minister Vivian Balakrishnan admitted in Parliament that he did not consider section 20 of the Criminal Procedure Code at the next sitting of Parliament on 5 January this year, there are Singaporeans who opined that this was not fathomable or even believable for a largely efficient Government machinery that has consistently approached COVID-19 as a whole-of-Government endeavour. They further contend that if not Ministers, at least the officials in the Ministry of Home Affairs, the Ministry of Health and GovTech who conceived of TraceTogether would have known of the privacy considerations surrounding TraceTogether.

Some go a step further in suspecting the Government of willful blindness on function creep, or worse, that the information surrounding the use of TraceTogether for criminal investigations may have been suppressed until the threshold of 70% of the population had downloaded the app or collected the TraceTogether token.

A separate group of Singaporeans queried whether there will be consequences for those who made this mistake in promising wrongly that TraceTogether would be used only for contact tracing. They believe the Government did not do its homework. While there was no dishonesty or malice, there was a lack of care or diligence in accurately communicating the potential use of data collected by TraceTogether.

I am sure Members have come across a range of opinions from residents in the course of their house visits or interactions with family and friends over the last few weeks on this matter. Whatever the view, it is apparent that the Government's handling of this matter has eroded trust from some members of the public.

To this end, I would like to ask two questions of the Government and, specifically, the Minister. First, what was the exact date on which Minister-in-charge of Smart Nation knew that section 20 of the Criminal Procedure code would apply to TraceTogether? Secondly and, in connection with this, was Mr Christopher de Souza's Parliamentary Question submitted before or after the Minister became aware of section 20 of the Criminal Procedure Code?

These questions are important for the House to understand at what point the Government determined that its original representations on the use of TraceTogether were misleading and whether it could have corrected the position and updated the public on its own initiative.

Let me now move on to my second topic, the carving out of the seven categories of crimes and the Workers' Party's position on the Bill.

The Workers' Party's starting point on this matter is that Singapore is as close to a wartime scenario as most Singaporeans have seen in our lifetimes.

This pandemic has exceeded in the living memory of older Singaporeans only by the far greater oppression of World War II. In terms of its effects on the national consciousness, COVID-19 is perhaps on par with other upheavals such as the 1964 riots and Singapore's ejection from Malaysia in 1965. Its scale and complexity have surpassed the SARS crisis of 2003.

In such a wartime scenario, the core question for this House is whether the change in the Government's position on TraceTogether data to allow for its use for serious crimes could compromise the fight against COVID-19 and jeopardise contact tracing. I will make two points in this regard.

First, while we know that TraceTogether data is critical for contact tracing, we need to ask whether TraceTogether data is vital for solving these seven categories of crimes.

As it stands, the Police have an abundance of investigative tools. They have other technological tools like CCTVs. They can forensically examine mobile phones and laptops that contain massive amounts of data other than TraceTogether. They also have old-fashioned police work such as finding and interviewing witnesses using confidential informants, scrutinising the crime scene and collecting physical evidence for forensic analysis.

There is a legitimate view that these tools should be more than sufficient in detecting crime and securing convictions. To know whether these other tools are enough, I would like to ask the Minister two questions about the use of TraceTogether data for actual cases:

(a) For the one known case where TraceTogether was used, was the case solved, in that a suspect has been identified or charged, and how critical was TraceTogether data to solving the case?

(b) How many other times has TraceTogether been used for the seven categories of serious crimes so far?

There is little or no doubt that TraceTogether would make things convenient for the Police. But it is my view that convenience for the Police may not be a good enough reason to compromise the trust necessary to win the COVID-19 fight.

There is an equally legitimate view that with the existing tools at their disposal, the Police are likely to have little, if any additional benefit from using TraceTogether data.

I look forward to hearing the Minister's answers to my questions so that we can know for sure. The answers will allow members of the public to appreciate the balance that is being struck between privacy and policing.

On to my second point: would allowing these exceptions compromise the use of TraceTogether in fighting the pandemic?

Against the possible benefits of using TraceTogether for fighting crime, we need to compare the likely cost to our fight against COVID-19.

There was a public outcry after Minister of State Desmond Tan's reply on 4 January 2020 when Singaporeans found out that section 20 of the Criminal Procedure Code (CPC) applied to TraceTogether and that the Government had backtracked on earlier assurances. Some Singaporeans seemed placated when the Government announced a day later that the use of TraceTogether data would be restricted to the seven categories of crime. Others, less so.

However, this House's knowledge of both support as well as resistance of Singaporeans is only anecdotal. In the middle of last week, it was confirmed that the TraceTogether signups had reached 80% from 78% some weeks earlier. However, these numbers too can give a false sense of security insofar as our contact tracing efforts are concerned.

In an Institute of Policy Studies (IPS) report released on 24 May 2020, out of a broadly representative sample size of the Singaporean population, 87% of respondents were agreeable to imposing strict surveillance on those who needed to be quarantined. But when the questioning moved to the employment of CCTVs and cellphones to prevent the spread of COVID-19, only 49% were agreeable to have their cellphone data tracked without their consent.

Separately, more than a few people have anecdotally shared online that they will use the TraceTogether app to gain entry to a place, only to turn off Bluetooth immediately after entering. This clearly shows that a high level of downloads of the TraceTogether app does not necessarily translate to a high degree of continuous usage.

Those who choose to switch off their Bluetooth function could do so for various reasons, a common one being that people do not want to drain their phone battery and not necessarily because of privacy concerns. We do not know for sure either way, but if the IPS report is indicative, privacy is more than likely to matter.

It is therefore open to question whether the efficacy of TraceTogether for contact tracing could be compromised because of the Government's belated explanation on the use of TraceTogether data for investigative purposes.

To that end, I would like to inquire if the Government is able to track the number of users of the TraceTogether app who turn off their Bluetooth function after downloading the app and, separately, who turn it off after gaining entry to a building or premise. The answer to this question will determine whether TraceTogether is working as intended or whether the Government needs to comprehensively review the public buy-in and effectiveness of the TraceTogether app and token.

I now move on to the Workers' Party's position on the Bill. The Workers' Party is of the view that Singapore's number one priority should be to tackle the pandemic's public health and economic effects. Anything that compromises this priority has to give way, unless there are overwhelming good reasons.

Other jurisdictions have taken a cleaner approach on contact tracing apps in line with the Government's original public statements that TraceTogether would be limited to contact tracing, period.

Personally and subject to the Minister's response on the centrality of TraceTogether data for policing, I, personally, would prefer aligning the use of TraceTogether with the Government's original emphatic assurances that TraceTogether would be used for contact tracing only. This is because of some Singaporeans' residual concerns over privacy and the established discomfort about sharing cellphone data.

I am of the view that such an approach would also engender greater confidence given that a public conversation on privacy has hitherto not been ventilated in a significant way in Singapore. I will return to that subject very shortly.

Even so, the Workers' Party is prepared to support the Bill to allow for the use of TraceTogether data for Police investigations in the exceptional cases identified in the Bill. The main reason is because the exceptions constitute a significant reduction of the wide ambit of section 20 of the Criminal Procedure Code.

In other words, a Singaporean's right to privacy is better protected with this Bill than without it. Ms Sylvia Lim will speak further on the seven exceptions.

Sir, let me move on to my last topic, which is about the longer term. The discomfort and distrust in some quarters generated by the belated disclosure on the applicability of section 20 of the Criminal Procedure Code to TraceTogether is somewhat or to some extent unsurprising. A 2016 KPMG report shared that 32% of Singaporeans were extremely concerned about the handling and use of their personal data and that Singaporean consumers felt the most defenceless among Asian respondents over the way organisations handle and use their personal information.

I would contend that across the population, there is a general lack of awareness about not just the Government's powers of data collection, investigation and privacy, but the rapid advance of predictive technologies for public use. As a society, many are relatively uninformed about legal or constitutional rights and responsibilities, to say nothing about the right to privacy.

If we are already talking about a societal COVID-19 reset when this crisis passes, the Government should also review the lessons learnt from the roll-out of TraceTogether and, specifically, whether Singapore should actively appraise the balance between policing and citizen privacy.

The mobile phone application WhatsApp recently found out the hard way what happens when people suddenly become suspicious about technology and privacy. When the company published new terms of service with a short deadline for acceptance, there was a huge backlash against WhatsApp and its corporate owner, Facebook.

WhatsApp's experience shows that Singapore's experience with the TraceTogether issue is not unique. Confidence in technological tools and the institutions that control them can be lost overnight. This loss of trust engenders cynicism and push back from the public, and in an age where information travels instantaneously and fake news spreads at light speed, cynicism has to be taken very seriously and addressed squarely from a governance standpoint.

In the first major debate of this parliamentary term, the Prime Minister addressed the House on Disease X, a possible outbreak even deadlier than COVID-19. In this regard, a new national research programme for epidemic preparedness and response called Prepare was announced in December 2020. The programme is meant to accelerate the production of diagnostic tools, therapies and vaccines once a major disease strikes.

However, medical preparedness is only part of the fight. The other part is the battle for the trust and cooperation of the people. If Disease X strikes and another TraceTogether-type situation occurs, our fight against Disease X may be rendered ineffective and tragically thwarted.

I call on the Government to initiate an immediate conversation on the balance between the state's collection and use of data against the individual's right of privacy because many of the new technologies with public repercussions have already been rolled out. According to the latest Government Financial Statements, or GFS, MHA has invested in PolCam 3.0 and 4.0 whereas only PolCam 1.0 and 2.0 have entered the mainstream media lexicon.

Intrusive technology has already extended to other areas of governance. The Government Financial Statements confirm that the Ministry of Social and Family Development has implemented video analytics, facial recognition and behavioural analytics technology at a voluntary children's home. Let that sink in for a moment – behavioural analytics technology at a children's home.

What impact could befall a child if such data is hacked in a cybersecurity breach many years later? How is the problem of bias, both from a technology perspective and a human interface angle, dealt with? Who checks whether such information is secure or securely wiped? And who has a right to review this information and for how long?

To counter skepticism and its resultant behaviours and to replace it with trust and cooperation, Singaporeans also need to better understand the necessity and ambit of data collection. This is especially so for a new generation who are more likely to be concerned about privacy and individual rights.

The public must also be assured that the data collected and used for investigative purposes have safeguards that are robust enough with independent and external checks and balances, if necessary. And it would be critical for the public to understand that in Singapore at least, regulation is marching in step with the evolution of newer and more intrusive policing and data collection technologies. This is currently not the case in many parts of the world and there is an opportunity for Singapore to be a leader in this regard.

To this end, I would advance that there are important actions that the Government can undertake to better dispel doubts.

First, the Government should be forthcoming, without prompting, in informing the public about what data it collects and how it ensures the robustness and integrity of its processes.

Second, the Government should ensure that our laws reassure Singaporean citizens and residents that investigatory powers and data collection are used for legitimate purposes and are subject to rigorous checks that protect us from the abuse of our personal data.

Moving forward, a review of our existing laws may be required to achieve this. Let me discuss each of these actions in turn.

The first thing the Government could do to counter cynicism and create trust is to be forthcoming about what data it collects and the safeguards to prevent misuse of information in its possession.

The Government regularly asks information of tech giants like Facebook. For example, the Straits Times reported in 2018 that Facebook's semi-annual transparency report revealed that the Singapore Government had made 244 request for information concerning 310 Facebook accounts in the latter half of 2017.

It would reassure the public, in my view, if the Government could tell us what it has asked the tech companies for and for what purposes. This could be done on a regular basis through the Police's annual report, for example.

If the Government is forthcoming with such information, it will engender confidence that the Government has nothing to hide, is performing its role as a state should, and that its requests are for legitimate purposes in the interest of Singaporeans. Singaporeans will also better appreciate the nature of the behind-the-scenes work that is done to keep Singapore safe and secure. And I will make this point again: this awareness and confidence will aid us in our fight against future threats.

The second thing the Government could do is to conduct a broad review of the state's powers to collect data for the purposes of investigations in light of new technologies and consider how privacy concerns could be better balanced or accommodated within the legislation.

Section 39 of the Criminal Procedure Code, for example, gives the Police wide leeway when investigating arrestable offences to access computers and computer data, even for computers outside of Singapore. Section 40 of the CPC allows the public prosecutor to authorise the accessing of decryption information. Statutes like the Broadcasting Act and the Telecommunications Act and others give the Police powers akin to those in the Criminal Procedure Code, although specifically scoped for those Acts.

Even so, like the Criminal Procedure Code, the investigative powers of the relevant authorities are drafted broadly and do not include separate laws on how the exercise of these investigatory powers come with safeguards. Such safeguards would reassure the public that the state is acting legitimately and with sufficient regard for the individual's right to privacy.

To build confidence between the citizen and the state in an era where the call for privacy will only get louder, other verification mechanisms can be considered. I would offer three suggestions in this regard.

One possibility for checking against abuse and engendering confidence can be the appointment of a neutral commissioner or an ombudsman to monitor the use of such powers by the Government and, in particular, law enforcement agencies.

Another possibility is an omnibus legislation like the UK's Investigatory Powers Act. This piece of legislation covers the acquisition and retention of data, including bulk personal datasets, and provides for how such material is dealt with, including oversight arrangements, amongst others.

Thirdly, the Government could include a key performance indicator in the Budget Book for each relevant Ministry that measures the public's confidence in the collection and use of data collected on the one hand, and the public's right to privacy on the other.

To conclude, Mr Speaker, it is important for me to restate that privacy concerns are not the domain of a small segment of Singaporeans. The international conversation has moved significantly over the past few years with recent revelations of how security agencies of democratic countries, such as the US, collect vast amounts of information about their citizens. Arising from such revelations, other democratic jurisdictions have sought to update their laws to focus on and better calibrate the balance between the state's investigatory powers and the individual's right to privacy. At the heart of this discussion is a desire for checks and balances that are fit for purpose for today's day and age.

Understandably, the conversation with electorates in these countries has not been easy. Many people perceive the world to be in an Orwellian age, complete with fake news and the prospect of privacy intrusions by even private corporations. However, the absence of such a conversation in Singapore, combined with an erroneous assumption that continuing down tried and tested routes will suffice, would engender a worse outcome, even presaging a disunited population. We will all lose if that happens. COVID-19 is a crisis like no other. But insofar as finding a better balance between policing and privacy, the lessons that have been taught by this TraceTogether episode inform us that they are lessons the Government would be wise not to dismiss.

To recap, Sir, the Workers' Party is prepared to support the Bill even as we look forward to the Minister's answers on the specific queries with regard to the Police's use of TraceTogether data. But, separately, and arising from this episode, I urge the Government to open a national conversation on privacy forthwith, with a view to not just prevent the weakening of trust between citizens and the state today, but to strengthen it for the Singapore of tomorrow. Thank you.

Mr Speaker: Ms Tin Pei Ling.

2.18 pm

Ms Tin Pei Ling (MacPherson): Mr Speaker, Sir, in Mandarin, please.

(In Mandarin): [Please refer to Vernacular Speech.] Mr Speaker, Sir, today's debate on the COVID-19 (Temporary Measures) (Amendment) Bill is very meaningful. This amendment, essentially, restricts the use of information collected by TraceTogether and SafeEntry to seven serious crimes. In fact, this Bill also aims to enhance public trust and encourage Singaporeans to continue fighting against COVID-19 with peace of mind for the greater good.

Since the outbreak of COVID-19, more than 2.2 million people worldwide have died and over 100 million confirmed cases have been diagnosed. In Singapore, the number of confirmed cases exceeded 59,000 and the death toll is 29.

In the face of this global pandemic, the Singapore Government has given top priority to the safety of our people. All this while, our Ministries have worked together, mobilised national resources and capabilities, investing nearly $100 billion last year to support Singapore companies and workers, and established a relatively comprehensive system of testing and treatment. At present, efforts to control the pandemic have also achieved firm results. As such, Singapore is widely praised for its COVID-19 fight.

Despite that COVID-19 has dealt a severe blow to the global economy and livelihoods around the world, local employment in Singapore has finally returned to pre-COVID-19 levels, even attracting $17.2 billion in fixed investments last year, which is 13% higher than in 2019.

Singaporeans' lives as well as their jobs are now protected. How many people have had to give their all to achieve this?

Outside of Singapore, we can see how COVID-19 is developing around the world. What is worrying is that, even in China where the control is watertight, they have also seen a rebound of cases. This is a reminder of how fluid the situation really is. In Singapore, vaccination is now in full swing. But with the start of the Phase 3, more people can gather in public places and hold large-scale gatherings. We cannot rule out the possibility of another wave and must be vigilant. Recently, there were community cases now and then. But, fortunately, they have been controlled. At the same time, there are news that not only has the virus not been exterminated, it has also mutated into more infectious strains.

Fortunately, we are living in an age of technology. Viruses cannot be touched or seen, but we can use the Internet and big data to track them down and isolate those who are infected. This would be unimaginable in the last century. Because of the advent of technology, our generation is able to better and more effectively deal with major infectious diseases globally. Technology has given us a ray of hope so that the disasters that befell human civilisations, such as smallpox, the Plague and cholera, will not recur.

As we laud the advancements of technology, there is anxiety, too, both worldwide and in Singapore. Among some communities, there are worries that big data will threaten privacy. Today's amendment Bill on TraceTogether is one clear example. TraceTogether is critical in contact tracing within the shortest time possible to limit the spread once an infected person is identified. The success of TraceTogether depends on all our cooperation. It was not easy to get everyone on board initially. Apart from helping the less tech-savvy to use it, we have to consider privacy issues. Making the coding open source and, therefore, verifiable by third parties, helped build trust in TraceTogether among the public.

However, when Singaporeans later discovered that the Police could access the data for serious crime investigations, which was different from the original picture painted, it triggered a debate. I, therefore, appreciate the Minister's clarifications. Such being the case, this amendment is perhaps the most decisive move. The Bill defines the seven serious crimes where TraceTogether data can be used outside of contact tracing purposes. This is very clear. I am confident that this will fortify the public's trust in the system. Nevertheless, I have three clarifications to seek from the Ministers.

First, after this Bill is passed, if there were other type of cases outside of the seven categories, such as a missing person case, the Police will be under immense pressure to solve it, will the Police be able to use the data from TraceTogether?

Second, if this data were collected for a major crime investigation, what is the process involved and what are the controls involved during this process?

Third, as we move towards a digital future, more technologies and our lives will be intertwined, we cannot deny that there will be a possibility that there will be another major crisis that will affect all. How will this Bill affect the large-scale deployment of such future technology solutions that will enhance our collective well-being? Will it also be just limited to the investigation of these seven major crimes?

Around the world, the success or failure of the COVID-19 fight depends not so much on medical resources and technology, but on public awareness. In countries like Europe and the US where there are strong calls for human rights, the situation seems to be more severe. In contrast, Asian cultures that emphasise the need to abide by social rules for the sake of collective interests have made the fight against COVID-19 more effective.

As the pandemic continues to worsen in most countries, entering Phase 3 means that we will enter a long-drawn war against the diseases. The Government's introduction of legislation at this stage to improve contact tracing efficiency is after much consideration. We cannot afford to let our guard down. We have to tread on thin ice and not let the efforts of the Government and society as a whole to be wasted just because of one careless moment.

In the fight against COVID-19, a wrong move may mean a lost war. Singapore is still plagued by the epidemic. Think of the number of hospital wards where healthcare workers have worked overtime and the loneliness and anxiety of isolated patients and their families, the pain of being separated from those you miss. How many students have to take part in graduation ceremonies online? Also, how many have to bear uncertainties in their career as a result of economic changes?

With the situation so fluid, some people may feel uneasy. Perhaps, even after this Bill is passed, some people would still hesitate to use TraceTogether. Yet, every life is precious and we have to use technology to fight this disease.

In Chinese mythology, Goddess Nuwa transformed her body into all that physically make up the world after she mended the sky. Shennong died after trying out hundreds of herbs himself. Da Yu passed by his home three times, but did not enter while managing the flood. All these characters in the stories shared the same spirit and that is the spirit of the greater good.

Sun Yat Sen, a great man of modern history also said that the difference between the individual and society is like the difference between the individual good and greater good.

Master Xing Yun once wrote in a Buddhist textbook that we need to elevate our love for the individual to a great compassion for all people. If we interpret this from another angle, it means that mankind can and should strive to achieve the greater good and greater compassion for the world.

Looking back at our own history, Singapore faced great difficulties in the early days of nation building. The prosperity and progress we have today depend to a large extent on the sacrifices and contributions of our early founders and pioneers. Some of them were political leaders, some representatives of Chinese businessmen, some philanthropists, some artists, some education promoters. Their names are still familiar to us today and praised by future generations. These include Sir Stamford Raffles, founder of Singapore; Mr Lee Kuan Yew, the founding Prime Minister who fought hard for Singapore throughout his life; Mr Yusof Ishak, the first President who contributed greatly to Singapore's racial harmony; Mr Tan Kah Kee, a philanthropist; Dr Tan Tock Seng who gave medical aid to the needy; Mr Lee Kong Chian, a great educator; and also many pioneers whose names cannot be listed here. Since the founding of Singapore, they have given their all and devoted their entire lives and wealth to promoting the political, social and economic and educational progress of Singapore. These great men have one thing in common, which is a spirit of placing the greater good over their individual good – be selfless. Bit by bit, through their convictions, they built this dream home called Singapore.

Today, I am convinced that making contributions should not be the prerogative of any segment of society. In the past year, we have seen that not only have Singaporeans not been defeated by the virus, they have also shown courage and kindness. Every frontline healthcare worker who faces the unknown with courage is also someone else's child or parent. There are also food and beverage operators who are willing to give hearting-warming meals to healthcare workers despite their own financial difficulties, and volunteers who visit foreign worker dormitories despite the risk of infection to themselves. They have shown us what the Singapore spirit is. They give us confidence that no matter how severe the storm is, we can overcome it.

Therefore, we must not give up our fight against COVID-19 at this juncture. We must continue to work together. Everyone is necessary in this fight. Every man is like a drop of water. Only when he is integrated into the sea can he see the vast expanse of the ocean. He is like a sand integrated into the desert to form a vast desert.

Given that the Bill has restricted the use of TraceTogether information, sacrificing a bit of privacy in exchange for public safety and health can be seen as a good deed. I hope that everyone will support this Bill.

When this pandemic is finally over, what will remain? Physically tired we may be, but we will leave behind a strong sense of home and nation. In the face of unpredictable challenges in the future, we, as Singaporeans should consciously integrate our individual good into the greater good and uphold the spirit of "Singapore for me, me for Singapore". Together, we will overcome this crisis. I support this Bill.

Mr Speaker: Mr Christopher de Souza.

2.31 pm

Mr Christopher de Souza (Holland-Bukit Timah): Mr Speaker, Sir, thank you for allowing me to join this debate. I think the legislation is timely, speaks of transparency and is needed. Following my question to MHA in January, it was announced that data collected through the TraceTogether app could be used for criminal investigations. That was on a Monday. The day after, which was a Tuesday, Dr Vivian Balakrishnan provided a clarification that he had not considered the CPC when he spoke in June 2020 about the ambit of the usage of TraceTogether. I want to say that I listened to every word that he had said and I believe him; and I want to have that stated on Hansard.

I also remember Mr Pritam Singh saying in that debate that he accepts that the CPC was not in the Minister's contemplation at that time and that the remarks were made in good faith. Again, today, presumably consistent with that position of Mr Pritam Singh in January – the consistent position being the consistent position in January – that there is no imputation of dishonesty or malice on the Minister. I think he had quoted several groups that he had spoken to. But, in his view, there is no imputation of malice or dishonesty. And I think that is something very important to clear up because it is consistent with his initial position in January that he accepts the remark was made in good faith.

As a result of my clarification, which is really clarification, which is really an answer to my question from the day earlier – I am talking about the January sitting – we are in double quick time, debating this Bill under a Certificate of Urgency.

What this Bill does is ensure that only under these seven categories of offences can the Police use the TraceTogether data. I support this because in limiting to these seven categories, it allows the raison d'etre continues to be contact tracing. So, the fact is that we only have seven categories out of a vast number of offences in Singapore. And if you can go through the Penal Code, the Prevention of Corruption Act and the Misuse of Drugs Act, you will realise that there are many other offences outside the scope of these seven categories, including offences such as theft, battery and assault, and possession of a controlled drug which TraceTogether data cannot be used for.

Here we are only carving out seven and I think this indicates that it is most certainly geared towards contact tracing.

It is essentially a balancing exercise. We are in the midst of a pandemic and TraceTogether saves lives but we must also balance that with its ability to trace suspects for serious crimes. I have been the Government Parliamentary Committee (GPC) Chairman for Home Affairs and Law all of last term – and I know the threats we face. They are real, especially terrorism, especially drugs. I know how important it is to have the Police be given the tools to fight serious crime and I do know that the Police Force is a professional and judicious one and therefore notwithstanding the sacrifice of privacy the Bill envisions, I think on the grand scale of things, it should be supported so as to achieve the greater aim of containing a pandemic and the ancillary consequence of fighting crime.

I also listened intently to Mr Pritam Singh's position just now saying that, after speaking about privacy, the Workers' Party, notwithstanding, still supports the carve-out of seven offences. So, supporting seven categories, it must follow that the Workers' Party accepts the sacrifice to privacy is justifiable, at least, insofar as this Bill is concerned. Because the sacrifice to privacy is a basic ingredient to the Bill. To support the ancillary purpose of fighting serious crime, it is an ingredient.

Now, what is the basis of that ingredient? Mr Pritam Singh calls it privacy and I would say an element of sacrifice of privacy is needed. And let me make a case for that.

I do want to say something in favour of Home Affairs and MinLaw and AGC and the Police, when they were looking at the seven categories of offences. I do think that they were judiciously exercising self-restraint in not broadening the categories further, that is, they were trying to make the sacrifice of privacy as least painful as possible.

Let me give you a reason why I say this. If you look under the fourth offence, which is the drug-related offence, the TraceTogether data can only be used if the offence attracts a death sentence. Personally, I think this is overly restrictive. I know I am pushing the envelope here, but because of my strong stance against drug trafficking, the heinous nature of the offence and the multi-generational effects it causes on families, if it were up to me, I would not have restricted it to only crimes which attract a death sentence. I would have extended it to all types of drug trafficking, whether or not the offence attracted the death sentence.

And allow me to explain why. The ability to intervene or apprehend a suspect has, in part, to do with pre-arrest intelligence work. CNB may know that a known drug trafficker is going to do another drug delivery but until he is apprehended, they will not know the exact weight of the drug on him. So, it is really only when he has been apprehended with the drugs and the drugs have been weighed and found to have attracted a potential death sentence, for example, an arrest involving more than 15mg of diamorphine, that the CNB can retrospectively use the TraceTogether data of the suspect. This, in my view, restricts CNB far too much.

What I am getting at is that I would have thought that the more efficient method in which the TraceTogether data could be used by CNB would be before the apprehension so that the source of the drug could be ascertained upstream, that is, further up the chain of trafficking.

In effect, the Bill may have the unintended effect of only allowing retrospective tracing and not real time tracing of known drug trafficking whereas, in my view, real time tracing could create more leads thereby making CNB operations more efficient and productive. That is my own view.

My guess is that CNB was consulted in this along with the stakeholders – AGC, MHA, MCI and SNDGO, and the collective decision was to restrict it to only to death sentence for drug-related offences. If my guess is correct, this signals to me a judicious exercise of self-restraint, that is, the lesser the sacrifice to privacy, the better, out of respect to Singaporeans – and I dare say a sacrifice to privacy, to some extent, that the Workers' Party, is willing to accept.

So, I go back to this theme of balance. The overarching raison d’etre of this app is contact tracing; a lesser, ancillary consequence, is the ability to fight serious crime.

And why not allow for that positive ancillary consequence if indeed it can solve crime and alleviate much distress suffered by the victims of crimes, and their families? On balance, I think it is worth it. Why? Because for the reasons I have presented, the Bill still preserves contact tracing as the greater purpose.

Containing a pandemic through contact tracing and solving serious crimes are both – are both – virtuous exercises. The seven categories listed in the Bill strike the right balance. And for these reasons, I support the Bill.

Mr Speaker: Ms Sylvia Lim.

2.42 pm

Ms Sylvia Lim (Aljunied): Mr Speaker, I have some queries and concerns on the Bill as regards Part 3 on personal contact tracing data.

First, it seems to me that the furore about the use of TraceTogether data could have been avoided if the Government had been clear from the start that the Police would be using its powers to access the data. Instead, blanket assurances were given by several Ministers that the TraceTogether (TT) data would only be used for contact tracing in COVID-19 cases. These blanket assurances were given from at least the middle of 2020.

Minister Vivian Balakrishnan told the House last month that he had forgotten about the Criminal Procedure Code when he gave his assurances and had sleepless nights thereafter. But the bigger question is: for all these months, why did no one in the Government step forward to correct the misrepresentation that TraceTogether was fully ringfenced for COVID-19 tracing?

Second, on why Police would need TraceTogether data for criminal investigations, I have some scepticism.

First, the TraceTogether data is likely to be incomplete and patchy. As pointed out by the Leader of the Opposition, people can and do turn off the Bluetooth functions on their phones. Those using TraceTogether tokens may also not carry them around all the time. The TraceTogether system's proximity data may also have some technical limitations as to distance and time which may make records incomplete.

Second, it should be pointed out that some countries, like Australia, have chosen not to allow their law enforcement agencies to access information from COVID-19 contact tracing schemes for other investigations. Even speaking as someone who is generally supportive of law enforcement, I believe it is important for the Government to make a convincing case for TraceTogether data use by elaborating on possible scenarios so that we can understand why TraceTogether may be pivotal to solving certain crimes. Earlier in his speech, Minister Vivian Balakrishnan gave one scenario of a child being kidnapped. I wonder if he has other scenarios to share.

Third, the Bill limits Police's use of TraceTogether data to seven categories of serious crimes. When the seven categories were announced last month, it was clear to me, at least, that the Government was making serious efforts to scope down its powers. On the face of offence categories, most can agree that they are grave offences which the public would want the Police to solve.

The seven categories of offences are now listed in the Seventh Schedule of the Bill. The Bill makes clear that the Seventh Schedule cannot be amended by Subsidiary Legislation but only through amending the main Act in Parliament. This will ensure that Members of Parliament and the public can scrutinise any change before it is law.

However, how water-tight are the seven categories? I was expecting to see in the Seventh Schedule a listing of the exact Penal provisions being contemplated such as precisely which sections of which laws are included. However, the Seventh Schedule describes the offence categories in less precise terms. This may lead to some ambiguity and uncertainty in application.

For instance, Category 7 is listed as, and I quote, "Any offence involving serious sexual assault such as rape or sexual assault by penetration". The use of the phrase "such as" means that rape and sexual assault by penetration are mere examples and not exhaustive of the category of serious sexual assault. Would this category include scenarios where the sexual assault did not involve penetration but involved, say, sexual assault of a mentally disabled victim? Many would regard sexual assault of a mentally disabled victim as serious and, in fact, TraceTogether data might be pivotal in such cases due to the victim's reduced ability to assist in Police investigations.

Another example of potential ambiguity is the offence of rioting. Rioting is defined under the Penal Code as a situation where there is an unlawful assembly of five or more persons and one member uses force or violence to pursue a common object of the assembly. If one looks at Seventh Schedule, Category 3, it seems to me that some cases of rioting may be included but not others, as it all depends on whether the injuries to the victim are of a life-threatening nature or not. Given the importance of proper classification, who will be the gatekeeper to certify whether or not a crime incident falls within the Seventh Schedule? It should not be left to the investigator alone.

My fourth point relates to from whom the Police will extract the TraceTogether data. The Bill makes clear that the Police will order the production of the data, so there is no need to seek consent from the person having the data. Referring to the parliamentary answer given by MHA to Member of Parliament Christopher de Souza on 4 January, Minister of State Desmond Tan had said that TraceTogether data would not be extracted from suspects but only from witnesses. Could the Minister clarify the precise basis for distinguishing the two? As for suspects, Minister of State Tan had said that TraceTogether data would not be extracted from suspects for the purpose of security. What are these security concerns?

Finally, in the light of the revelation that Police will use TraceTogether data, several defence counsel have asked me whether suspects too will be able to access TraceTogether data in any given case as it could be exculpatory, that is, it would delink the suspect from the crime. If the Police will be able to use TraceTogether data to incriminate the suspect, then in all fairness, the TraceTogether data should be available to the defence as well.

To this end, we understand that TraceTogether data on devices is transient as it is encrypted and stored for only 25 days, after which it is automatically deleted. Defence counsel often come onto the case some weeks after the arrest. How does the Government intend to handle this issue of justice and fairness?

Sir, as mentioned by the Leader of the Opposition earlier, the Workers' Party is prepared to support the Bill. However, we need answers to the questions we have posed.

Mr Speaker: Mr Murali Pillai.

2.49 pm

Mr Murali Pillai (Bukit Batok): Mr Speaker, Sir, today’s debate is about accountability to Parliament. As leaders, it is important to communicate clearly as well as in a principled manner. If we had stated in this House that TraceTogether data is to be used only for contact tracing, then it should be so. Even if there is great benefit to be gained by using it for other purposes, even if there is fine print that allows us to do so, we should forebear. If we want to take a different approach from what was earlier represented in this House, then we should raise the matter here for debate and convince hon Members in this House that it is necessary to change tack.

This is responsible politics. It is for this reason that I welcome the introduction of this Bill.

The hon Leader of Opposition in his speech mentioned that there are quarters outside this House which ascribe a sinister motive in relation to the point as to whether the hon Minister knew from the outset that the data was to be used for other matters, apart from contact tracing, in particular, in dealing with investigation of offences.

What is noteworthy, as the hon Leader of Opposition mentioned, was that in the hon Prime Minister's speech on the 21 April 2020, he had already stated that in relation to the digital contact tracing efforts, there could be privacy concerns.

I filed a Parliamentary Question for the sitting in June 2020. On 4 June 2020, the Government's answer was that the data from TraceTogether would be used for contact tracing only. So, just looking at two points, April and June, you could already see there is a bit of a disjunct and there was an error that arose arising from the fact that while on one hand, the Prime Minister said there could be some privacy concerns, on the other, the Minister had pointed out that the data would only be used for contact tracing.

I, like the hon Member Mr Christopher de Souza, looked at the chronology of the entire saga and I am convinced that this error, just like the hon Leader of Opposition said, is not an error that was intentionally made. It was an error, in the words of Minister Vivian Balakrishnan, a mea culpa that arose because it was not drawn to his attention that the Criminal Procedure Code (CPC) was applicable.

This Bill asks for permission to make TraceTogether and SafeEntry data, which was meant to be used for contact tracing to be available to the Police when there is a clear and pressing need to use that data for criminal investigations into seven categories of serious offences. In this regard, both the hon Leader of Opposition, Mr Pritam Singh, and the hon Member Ms Sylvia Lim, asked questions in relation to exactly when this would arise in practice. One point that was made was that the Police has already an abundance of tools.

But, to me, I find it useful that in this Bill, there is the operative words "clear and pressing need", and that, to me, limits the ability to use the data. And in relation to the seven categories – these are serious crimes that we are talking about – anyone looking at it would know that – and I am, in a sense, sharing what I am going to say a bit later – in balancing privacy concerns with really the concern for meting out justice in relation to the commission of serious offences, the Police should be provided access.

The question is a simple one. If these harms fall on your parent, your sibling, your child, and if the data from your TraceTogether token can make a difference between solving the case and leaving it unsolved, or if it means catching the criminal in days rather than in months or even years, would we not say yes?

I do say yes, and this is why I support this Bill. I do so for one main reason – it is in line with the current legislative policy to allow the Police access to any relevant data, no matter how personal, in their investigations.

As it stands, there is no blanket privacy protection that applies across the board. Our private phone logs, our banking records, are all subject to these provisions. The need for privacy must be weighed against the demands of justice, and the need to protect the safety and security of all Singaporeans. We are by no means unique in taking this stance. I made mention last month in this House that there is parity between the positions taken in Singapore and the European Union through its General Data Protection Regulations.

[Deputy Speaker (Mr Christopher de Souza) in the Chair]

An easy way out of this decision, it would be to say that TraceTogether and SafeEntry, taken together, is an aberration – if it had not existed, what would the Police do? The Police have solved crimes before TraceTogether and SafeEntry, and will do so after the programme has been stood down. So, why do we feel it needs this? Why not do without?

It would indeed be the easier route – just keep to the original promise, forget about the data and pretend we never had it.

But the fact remains that this is not a hypothetical armchair philosophy question. We have real crimes, real lives at stake. It is morally indefensible to shut our eyes to the answer when knowing it would make a difference in cracking a serious crime case and bringing the culprit to face justice and, possibly, save other lives from being victims of serious crime. This is not a crude utilitarian trampling of principles for a greater good. It is, in fact, the principle from which all Police powers come – the demand for justice, the right to be protected from evil and harm.

To those people who are troubled because they received this raft of conspiracy messages, saying that, "Oh, the Police has no system to protect data and they use it for all kinds of issues"; let me just say it for myself as a criminal lawyer for the past 25 years and a former police officer before that, that I know personally how seriously the Police deals with issues of misuse of data. I know of cases, some of them were cases where I represented the ex-officer, where there was misuse of data, and the Police officers concerned were prosecuted.

[Mr Speaker in the Chair]

So, there is a system and I would want to share my own experience with those who are troubled by these conspiracy messages.

A more difficult question – and that was posed by the hon Member Mr Christopher de Souza – is why then limit this access to serious crimes as defined under the Bill, given the state of law at this point? He spoke about the need to extend it to cover other classes of drug offences. With respect, this question ignores the facts and circumstances that have led us to this point. As hon Members are already familiar with the background, I will desist from recounting it again in my speech.

The crucial point to note is that this Bill represents a compromise to ensure that we do not take the risk of losing the ability to conduct contact tracing quickly and aggressively via TraceTogether and SafeEntry when we are in the midst of a pandemic.

It seems to me that there is broad agreement for data to be used to investigate the seven categories of serious crime proposed under the Bill. I do appreciate the hon Member Ms Sylvia Lim's point about the fact that they are not defined in terms of cross-reference to provisions but there is already description of the serious crimes. To me, that is sufficient. Using the general principles of interpretation, one would get to know what is parliamentary intention.

Extending the categories will require hon Members of this House to take a gamble on whether or not a group of Singaporeans and residents will still be prepared to adopt TraceTogether and SafeEntry – and that is a point that the hon Leader of Opposition made – or, instead, be put off in light of the extended use of the data. This is not a gamble that we should take, given the state of COVID-19 pandemic today. It is far worse than a year ago – the mutating virus has variants which are more infectious and lethal, more than 2 million dead across the world, a reporter in tears on "live" TV as she visited hospitals where patients are dying from lack of proper healthcare, students in a university ringfenced by metal fences to regulate visitor movements and keep them safe. This quick escalation can happen in Singapore if we were to lose our cohesion resulting in our healthcare resources being overwhelmed.

Even the vaccine is not a magic bullet. There are no magic bullets. All we have is our very human responses – our responsibility to each other, our own recognition of our vulnerabilities, our hopes and our better selves.

TraceTogether and SafeEntry, collectively, is a tool to help us in this pandemic and we need it in this new and present threat. It is also a tool to help us against the old evils of human depravity, greed and lust. There is no reason why it cannot do both. Even if one contact were traced through which one serious crime is solved or one serious crime is prevented, it would be worthwhile. And we just need one reason to support this Bill.

In closing, I would like to refer to the hon Leader of Opposition's point about the future and how we should regulate data in the future.

I would suggest, especially, in the context of the present crisis and the efforts being expended to contain the threat of COVID-19, we should also be looking at the future when we have to contain another crisis.

In that kind of scenario, what would we want to be as Members in this House? Should we just be ambassadors of our people, just conveying what this group of people have expressed, or that group of people have expressed? Would that be sufficient? Or would it be necessary that we bear the responsibility as leaders to move our people, to say, "This is a crisis. Yes, errors will be made. But look at the conduct. Look at the outcome."

We must have the courage to move our people in one direction to overcome the crisis together. And that to me would be a big lesson for the future. I support this Bill. [Applause.]

Mr Speaker: Mr Gerald Giam. Mr Pritam Singh.

3.03 pm

Mr Pritam Singh: I thank the hon Member Mr Murali for his comments. I would just like to pick up on a point the hon Member made about the easy way out being to just proceed as originally assured by the Government. I would suggest, very respectfully, to the hon Member that we have to take a step back and look at what is this easy way out of. And, in my humble view, the bigger issue is to ensure the safety of the population at hand and to ensure that contact tracing is successful.

So, the Government obviously had to weigh the implications of going ahead, proceeding as assured by the Minister and the Government or introducing the exemptions for serious crimes at this point.

In those circumstances, the critical issue in my mind is to determine which way do you go, where do you fall. And I would suggest that it is not a question of armchair philosophy or trying to defend something that is morally indefensible. Because, as a society, we have rules in very different situations. The hon Member is a criminal lawyer of some repute. Outside this Chamber, I think people like me would be going to him for advice on criminal matters.

But a useful example is attorney-client privilege. I could be representing a criminal who could have admitted to me that he committed an offence but my instructions is to plead not guilty for him in Court. And that puts a lot of pressure on criminal lawyers, as the Member would know. There are two options. You do not take up the case; you drop the brief. Or you make sure you follow those instructions to a hilt because if you do not, you have committed some offences vis-a-vis the Legal Profession Act and you have breached client confidentiality.

I am not suggesting an equivalence to TraceTogether. I am not suggesting that. But, effectively, that lawyer is a walking TraceTogether token. He knows something about the matter.

As far as society is concerned, that is a trade-off. What do we want? In this context, Government has put out a position and I would accept, as I have, that serious crimes are something that we have to look at carefully. Hence, the Workers' Party support.

But it is important, I think, for the Government to explain how critical TraceTogether information actually is. Because the public does not know. And insofar as how a conviction or a decision to prosecute turns on TraceTogether data, it is not exactly hypothetical.

The hon Member Mr Christoper de Souza has talked about expanding actually the scope of Misuse of Drugs Act, for example. But if one thinks about it, we have to bring ourselves back down to the purpose of this Bill which is TraceTogether. And the simple answer to that is I do not think drug lords or criminals will be carrying TraceTogether tokens and TraceTogether applications around.

But that is my position. I just wanted to verbalise my views on the points that hon Member Mr Murali made about, suggesting that this is an easy way out. I do not think that is the nub of the issue. I think it is far deeper than that.

Mr Speaker: Mr Gerald Giam. Ms Sylvia Lim.

Ms Sylvia Lim: I think, Sir, I just have one clarification for Member Mr Murali. If I heard him correctly, during his speech, he said he is comforted by the fact that the Bill states that the TraceTogether data would only be accessed when there is clear and pressing need. I would like to ask him whether he means that it is stated explicitly in the provisions or that it is implied by the provisions.

Mr Murali Pillai: Mr Speaker, Sir, so as not to hold up the proceedings, I am checking my notes and I will come back to my learned friend, Ms Sylvia Lim, shortly.

Mr Speaker: Mr Gerald Giam.

3.08 pm

Mr Gerald Giam Yean Song (Aljunied): Mr Speaker, when I first read the 4 January Parliamentary Question by the Member for Holland-Bukit Timah Mr Christopher de Souza, I anticipated that the Government would answer it in one of two ways.

One, that TraceTogether or TT data is not and will never be used for anything other than contact tracing, as per their earlier assurances. Or two, that the TT data may be used for criminal investigations in some circumstances.

I thought the second scenario would be less likely. I shared with a colleague ahead of that day's Sitting that I did not think the Government would use TT data for non-contact tracing purposes. It will cause a public outcry as it would inviolate TT's privacy policy and what the Government had been saying about TT's privacy protection so far. More damagingly, it could lead to a lower adoption rate of TT, which would in turn hinder our battle against the COVID-19 pandemic.

As it turned out, option two was closer to reality. Minister of State Desmond Tan said that, "The Singapore Police Force is empowered under the Criminal Procedure Code or CPC to obtain any data, including TraceTogether or TT data for criminal investigations", and went on to assure the House that the data was secure and only authorised officers are allowed to access it.

In response to my supplementary question that day, the Minister of State clarified that other than for the purpose of criminal investigations and protecting public safety and security, TT data is to be used only for contact tracing.

The next day, on 5 January, the Minister for Foreign Affairs made a clarification, following a lot of unease expressed by Singaporeans about the previous day's revelations, where he stated that the use of TT data would be restricted to serious crimes.

Three days later, on 8 January, the Smart Nation Digital Government Office announced upcoming legislative provisions for the usage of data from TT and SafeEntry, which are in the Bill we are debating today.

Why did the Government choose the make this revelation only on 4 January, more than nine months after TT was launched? All that time the TT's privacy statement contained a more absolute assurance and, I quote, "Any data shared with MOH will only be used solely for contact tracing of persons possibly exposed to COVID-19."

This privacy statement changed only sometime after 12.25 pm on 4 January, the afternoon that the PQ was answered, with the new clarification that it can also be used for criminal investigations.

On 8 June 2020, the Minister for Foreign Affairs had stated in a press conference that TT data is "only used for contact tracing".

While the Minister has since admitted that he had not thought of the CPC at that time – and I appreciate his explanation – why did anyone in Government not come out sooner to correct this statement?

Many Singaporeans downloaded the TT app and collected the TT token in large numbers, in part, because they trusted the Government's assurances of privacy and limitation of use.

This unfortunate sequence of events may make many Singaporeans more wary of taking Government's statements at face value. Some may now adopt Ronald Reagan's adage, "Trust, but verify".

We may now have an 80% adoption rate for TT but we should not rest on our laurels and become complacent.

First, the more people use TT, the more effective contact tracing will be. We should always aim for maximum adoption and usage and minimise any obstacles to adoption. For example, privacy fears or poor app performance.

Secondly, just because 80% of residents have downloaded the app or collected the token, does not mean that they are actually using it, a point that the Leader of the Opposition also made earlier.

There are many ways that TT can be disabled. There is even a pause function within the TT app itself. Suffice to say, one does not need to be a rocket scientist to figure out how to legally disable the TT app or token.

With the 4 January revelation, many people who anticipate engaging and even minor misdemeanours may choose to disable TT just to avoid detection. Some might even do so to avoid being called as a witness in a Court case. Others may do so as matter of principle or because of their lack of trust in the Government.

All these might add up to a not-so-insignificant proportion of our population.

We may think that these people are holding out on TT for unjustifiable reasons, especially since the seven serious crimes have already been scoped in. However, we cannot control every action that individuals make with their electronic devices.

Ultimately, TT relies on user consent. Perceptions will drive behaviour. The net result may be a lower than desired usage of TT which will hamper our contact tracing efforts.

The Government does not want to constrain itself by committing to "never use TT data for crime fighting". However, is the potential cost of slower containment of the community's spread of COVID-19 worth it? Put another way, if the COVID-19 situation were to take a turn for the worse, overwhelming our healthcare system, will the Police still use TraceTogether data if it inevitably suppresses the adoption rate and hinders contact tracing efforts?

Mr Murali has said that it is worth using contact tracing data even if one serious crime is solved. On the flip side, is it worth it if even one COVID-19 cluster goes undetected because a few people deactivated the TT app out of privacy concerns?

Sir, I will, with some reluctance, be prepared to support this Bill. However, I hope the Government and the Police will now consider this question carefully in deciding how often and to what extent it uses the broad powers conferred on it by section 20 of the CPC and this Bill.

Mr Speaker, I have some further clarifications for the Minister on this Bill.

First, we now know that SafeEntry data is also accessible to the Police. Since its launch, how many times have the Police used SafeEntry data for investigations and how many of these investigations were outside the scope of the seven serious crimes in the Seventh Schedule?

Second, the sunset clause proposed under section 82(8) gives a lot of power to the Minister to determine if we still need digital contact tracing and when the contact tracing data will be deleted.

The pandemic may last another four to five years, as Minister Lawrence Wong has recently alluded to. In an even more pessimistic scenario, COVID-19 may never be fully eradicated but will become endemic in our population.

If this happens, will these digital contact tracing systems ever be stood down? What are the criteria that will be used to determine this?

Third, do the safeguards in section 82 of the Bill cover data that has been uploaded to MOH databases for the purposes of contact tracing? If so, will the Police still be allowed to access this data even after the pandemic is over?

I asked a similar question on 5 January and the Minister answered then, "I believe that once the pandemic has passed, that data – certainly the specific personalised data – those fields should be eliminated." Can I confirm that this remains the intent of this Bill?

Mr Speaker: Mr Murali Pillai.

3.17 pm

Mr Murali Pillai: Mr Speaker, Sir, I am grateful for your indulgence. I would like to thank the hon Member Ms Sylvia Lim for her clarification question. In relation to how I got the impression that the powers would only be used when there is a clear and pressing need, I would like to direct her attention to the Government statement issued on 8 January 2021, entitled "Upcoming Legislative Provisions for Usage of Data from Digital Contact Tracing Solutions", where in paragraph three, it is stated that the legislation will specify the personal data collected through digital contact tracing solutions which comprise the TraceTogether programme and SafeEntry programme can only be used for the specific purpose of contact tracing except where there is a clear and pressing need to use that data for criminal investigations of serious offences.

So, that is how I formed the impression and I would invite the hon Minister to confirm if my impression is correct, in his response to us.

Mr Speaker: Ms Sylvia Lim.

Ms Sylvia Lim: Thank you, Speaker. I would like to thank Mr Murali also for clarifying in effect that it is not the Bill itself that states so. He said that he obtained the information from a Government statement.

Mr Speaker: Ms Jessica Tan.

3.18 pm

Ms Jessica Tan Soon Neo (East Coast): Mr Speaker, thank you for allowing me to speak on this Bill.

Many Singaporeans recognise the importance of contact tracing in our quest to keep Singaporeans and Singapore safe during this COVID-19 pandemic. With the clarification that TraceTogether data can be accessed by the Police under the Criminal Procedure Code, I, like many, have received feedback from residents expressing disappointment and concerns. This change from the earlier assurances given that TraceTogether data would only be used for COVID-19 contact tracing purposes is something that has caused some disquiet. I can understand that many are upset because many had collected the token or downloaded the app on this assurance.

But I do want to make this point about looking at the TraceTogether solution and what the Minister has shared earlier with regards to the design decisions on TraceTogether.

I think that it is clear that TraceTogether is purpose-built with the singular purpose for COVID-19 contact tracing to prevent a situation of the spread of COVID-19 and with privacy protection central to that design. Why do I say that?

First, TraceTogether utilises, as many have said, Bluetooth exchanges to capture proximity of who has been close to you. This token or app does not use GPS capabilities and hence does not capture location information. This data is also captured and stored on the token or the app and not on the server.

The Minister had also shared that there are safeguards and what these safeguards include – that the data is kept on the token and is also deleted after 25 days. The scope of the TraceTogether solution has been very singular in that purpose of design. The fact is that data is deleted after 25 days – based on what the Minister had shared – based on medical advice of the time required for contact tracing data, if required, and that it is deleted after that time.

The Minister in his speech also shared that when the pandemic is over, the TraceTogether solution will be stood down and all personal digital contact tracing data used for COVID-19 contact tracing will be deleted from the systems as soon as practicable.

If you think about it from a design purpose, it is clear. But I think the important question now for all of us, in front of us now, is: do we restrict the use of that contact tracing data?

This Bill seeks to limit the use of personal data collected for COVID-19 through digital contact tracing solutions. If this Bill is passed, it will mean that personal contact data from TraceTogether and SafeEntry as set out in the Sixth Schedule of the Bill can only be used for COVID-19 contact tracing purpose when there is an infection and the only exception will be when the data is needed for criminal investigation proceedings for the serious offences as specified in the Seventh Schedule of the Bill.

Despite the intent of the Bill to limit the use of personal contact tracing data for the specified seven categories of serious crimes, some have asked if we should even allow access – and this discussion has been happening outside of this Chamber as well – and use of data for any other purpose as there was assurance given earlier that the information was for the sole purpose of COVID-19 contact tracing in the event that there is an infection.

Many have also pointed out that there is no need for the data from TraceTogether to be used as there are other sources of more intelligent data and information available from other smarter devices. These include close-circuit TVs installed in buildings, elevators, along our streets, in-vehicle cameras, and GPS devices including smartphones, just to name a few. With data from these devices, is there really a need for the data from TraceTogether?

Given the earlier assurance and the mistake made – I think the Leader of the Opposition and Mr Murali have also pointed this out, and I think we have had a discussion – I actually ask this question of myself: would be be an easier decision not to allow the use of the TraceTogether data for any other purpose? Easier in the sense that because of what people are feeling and the angst that some are feeling.

But then I ask myself again: is it the right decision?

If we take the position not to allow access to TraceTogether data for the purpose of police investigation when a serious crime is committed, what it would mean is that even if the data from the TraceTogether token or app could help in the investigation, even if there is a remote possibility, the Police cannot access the data.

The Minister gave the example of someone being kidnapped. I actually wrote that down for my speech too. In the event that someone was kidnapped – I had this discussion with a resident – if that happened, and if TraceTogether data, in the remotest possibility, was the only available data that could provide a lead in expediting investigations in that situation, what it would mean is that the data cannot be accessed if we did not have this discussion and we did not agree on this Bill.

In situations involving serious crimes – and the list, I think, we have all talked about that, in terms of the seriousness of those crimes – like murder, terrorism or kidnapping, timely access to data could make the difference between life and death. Knowing the implications of this, I ask myself again: would it be the right decision for us to agree that the data cannot be used even if it could save a life?

I come to this point that – I think there is some talk about whether it is convenient or easy for the Police. Are we making it easier for the Police to investigate rather than using other data? I think we all agree this is not about convenience. It is really about aiding and helping in investigations of serious crimes – matters that involve, in some cases, life and death.

As the Bill seeks to allow for personal contact tracing data to be accessed by the Police to assist in the investigation of serious crimes, what will happen if someone loses his/her token and it is used by another person for criminal purposes? I know this is somewhat a practical question but can the Minister share what will be done to prevent such misuse? Now that it could be used for criminal investigations of serious crimes, I think there are some voters who may be worried that their token or their app might be misused by someone else. How do we prevent that?

Mr Speaker, as we continue our fight against COVID-19, contact tracing remains the most important measure in keeping transmissions low together with all the other measures. While we protect data privacy – and I think the reason for this Bill is that we recognise that privacy is important – we must make the right decision to protect and keep Singapore and Singaporeans safe and secure. The measures proposed in this Bill are important as they seek to make clear the use and the limitations of personal contact tracing data for COVID-19 contact tracing purposes and criminal investigations.

The Bill is a compromise. It is a balance between public health and keeping everyone in Singapore safe and secure while respecting personal privacy.

Before I end, I do want to touch on this point because I think there were some discussions about whether this Bill will cause lower take up rates of TraceTogether. I think that is the purpose of why we are having this conversation in Parliament. It is to help Singaporeans understand why this balance needs to be made. I think to some extent I trust that Singaporeans, with the right information and understanding, will move in the right direction and support the use of digital solutions to help with contact tracing.

We have seen that of Singaporeans since COVID-19 started till now. We have seen how Singaporeans have stepped up. There have been so many restrictions made on everybody's lives but everyone has played their part. I think it is important we have this conversation so that Singaporeans can make the right decision to continue to move forward together, to keep everyone safe.

For these reasons, Mr Speaker, and for the implications that I have shared on public safety, I support the Bill.

Mr Speaker: Mr Leong Mun Wai.

3.29 pm

Mr Leong Mun Wai (Non-Constituency Member): Mr Speaker, Sir, we all know by now that the merit of this Bill rests on tradeoff between public trust and public health on one side and public safety on the other.

Public trust in the Government is the cornerstone of Singapore's political system. Our people's trust in the Government enabled the first-generation leaders to transform Singapore from a third-world country to a first-world country. This very same trust enabled the Government to combat and curtail the SARS crisis in 2003 and the H1N1 crisis in 2009.

Sir, I would like to state that the Progress Singapore Party, or PSP, fully supports the Government's efforts to combat the COVID-19 pandemic and we were among the first to urge the Government to make mask-wearing mandatory in the early stages of the pandemic.

However, it would be remiss of me not to state that our contact tracing programmes intrude extensively upon our people's privacy.

SafeEntry collects an individual's NRIC, contact number, their location, whenever they enter a building and even how long an individual stays in a location, while TraceTogether collects who that individual was in close proximity to and for how long. The two programmes together allow the Government to easily create a map where an individual goes and who he associates with.

Singaporeans have long accepted some erosion over their civil rights and by extension their privacy, in order to ensure public safety. However, when the Government announced the TraceTogether token in June 2020, there was a public backlash against TraceTogether. Over concerns that TraceTogether will invade their privacy and the collected data will be used for non-contact tracing purposes.

But in the end, our people trusted both Minister Balakrishnan's and Senior Minister Teo's promises that the collected data would only be used for contact tracing, which was why TraceTogether adoption finally surpassed 70% in December 2020. This trust was broken during the January parliamentary session, when not only did the Government admitted that TraceTogether data was accessible to the Singapore Police Force for the purposes of criminal investigations, it was already actually assessed by the Police to investigate a murder.

Sir, trust takes years to build, seconds to break and forever to repair. This broken promise has broken the public's trust in the Government. It is because of this broken trust that we are gathered here today debating a Bill that has to be passed under a Certificate of Urgency, which means that all the three Readings of the Bill would have to be done in this Parliament Sitting and there will be little time to consider its implications carefully.

Actually, to start repairing the broken trust, the Government must first answer questions about the follow-up process around this episode. Like when did the Police first access the TT data? When the TT data was accessed, did the Police consider that they will be breaking the promise that the Government gave to not use the TT data for anything other than for the purposes of fighting the pandemic?

Has the TT data been accessed only once as Minister Balakrishnan has stated in the previous sitting, or more than once? If more than once, how many cases exactly has the Police actually accessed? When was Cabinet first informed that TT data was accessed in a direct breach of the promise they gave? Did Cabinet then gave instructions to the Police not to access TT data in light of their repeated and public promises?

These five questions apply with equal force to the data collector under the SafeEntry programme, which has so far attracted less attention. To proceed with this Bill, without answering these questions will leave serious doubts in the public's mind over whether this Bill is truly to rebuild public trust in a Government or to rubber stamp the Police actions after the fact. It is therefore in the spirit of rebuilding public trust that the Progress Singapore Party rises in opposition to this Bill. Allow me to elaborate.

As the PSP Secretary-General, Dr Tan Cheng Bock has stated, backtracking is not good politics and it erodes the confidence and social compact of our citizens in our political institutions. At this point in the pandemic, the last thing we need is for our citizens to lose faith in the Government and start second-guessing the Government's motives whenever in announces new measures to control the COVID-19 virus, especially when other countries around the world are experiencing new outbreaks.

The Government is compromising public health and public trust for some benefit in public safety by passing this Bill. Public trust in TraceTogether has been eroded by this broken promise. What I found when speaking to residents is that they are now leaving their TraceTogether tokens at home when they go out. And some are now refusing to use TraceTogether altogether.

This will compromise the effectiveness of contact tracing efforts, and this is exceptionally dangerous in light of the uptick in community cases since Singapore's move into Phase Three.

The SPF has already broad powers to assess documents, things, data, computers and even decryption data under the Criminal Procedure Code for the purposes of investigating crimes. How much is the incremental benefit, from a set of data that exists only for 25 days? Besides I find it quite unbelievable that such criminals would carry their TraceTogether tokens when committing such crimes, especially now that the Government has announced the TT data is accessible by the Police.

Sir, the challenge of a democratic Government is to use innovative technology for public safety, but at the same time, not intruding into the privacy of its citizens too much, not in using any technology that is available. The Government's biggest priority now should be to fight the COVID-19 pandemic and persuade as many people as possible to use TraceTogether. This must be the call and primary purpose. Any other purpose that compromises on this primary purpose and cause people to reconsider using TraceTogether must be set aside.

Sir, the PSP is not objecting to this Bill for the sake of objecting. We have thought of supporting it with some changes, but to trade off public trust in public health measures, which must be of utmost priority in a pandemic crisis, for public safety, is too much to give for us, after much consideration.

And the complete ring-fencing of contact tracing data, keeping it solely for public health objective, is not unprecedented. The Australian government has publicly committed that the data collected by the contact tracing application cannot be accessed by the Police and is to be used only for contact tracing purposes, and has already passed legislation to that effect.

We must also keep in mind that the COVID-19 pandemic will neither be the first nor the last pandemic that our country will have to deal with. Any action the Government takes to deal with this pandemic be it to prioritise public health and trust or public safety will significantly impact our people's trust and confidence in the Government's action in future pandemics and other unforeseen calamities.

Therefore, when all the various issues are considered, passing this Bill may actually run against the Government's objective of rallying everybody together to fight the pandemic which should be our top priority at this moment in time.

In conclusion, Sir, this Bill does not go far enough to assure our citizens that the Government will keep its promises and is insufficient to restore public trust in the Government during this pandemic. The Progress Singapore Party therefore stands opposed against this Bill and calls upon the Government to keep to his original promise by fully exempting contact tracing data from the CPC.

Mr Speaker: Leader.

3.40 pm

The Minister, Prime Minister's Office and Second Minister for Finance and National Development and Leader of the House (Ms Indranee Rajah): Mr Speaker, I just have a clarification for Mr Leong because I just wanted to understand his position. So, would I be correct then in understanding that, in the example given by Minister Vivian, that if there was a child kidnapped and let us say, there is no other sign of any evidence, the only thing that you have is TraceTogether data, Mr Leong's position would be, "No, let it be, we will not access that data." Is it that the position?

Mr Leong Mun Wai: I thank the Minister for the question. Yes. Our position will be that.

But of course, in any of the decisions we make, there is a trade-off. So, when you take the position of the Bill what you are saying public trust plus the needs of public health – both of these benefits would be less than the benefits that you draw or you expect to draw from public safety. So, we have the weigh the trade-off and after weighing the trade-off, we hold the stand that we are going against this Bill.

Ms Indranee Rajah: I thank the Member for his clarification. He is right. There is a trade-off, but we would not trade a child's life for something like that.

Mr Speaker: Mr Vikram Nair.

3.42 pm

Mr Vikram Nair (Sembawang): Mr Speaker, while I understand the context for this Bill, and the reservations many of the earlier Members have mentioned about privacy, I wish to state that I have a somewhat different view. I, too, have my reservations on this Bill, but it largely has to do with the limits its placing on the powers of the Police to obtain information under the CPC. And I think one of the points that we cannot trivialise, is how difficult Police investigations are and how difficult the process of finding the truth can be as well, even if matters were to go to Court.

In Singapore, we have a low crime rate and most Singaporeans go about their daily lives without fear of crime. An important reason for this is that we have effective law enforcement by the Police. Singapore's Police Force is small, relative to the population. We have just under 9,700 regular police officers in Singapore, which is around 170 per 100,000 people. This is one of the smallest in the developed world and even amongst our neighbours. For example, the US has around 238, Hong Kong has 487 and Malaysia has around 320.

Yet, despite the small Police Force, they have been effective at keeping the crime rates low. This is in part because it has strong support from the population. And people make reports whenever they see anything amiss. For Members of Parliament, you know this, almost every other thing ends up in a Police report; whether it is a neighbour dispute, complaint about noise. People share information freely with the Police, trust the Police and expect them to be able to solve crimes. This expectation is reflected in section 20 of the Criminal Procedure Code which allows a Police officer above the rank of sergeant to order a person to "produce any document or thing" to assist in investigations.

This power is understandable. When a crime happens, Police have to piece together what happened. The crime scene is not going to the tell the Police the story. If they are lucky, they will have eyewitnesses who can identify the accused, get confessions and close the case. But what if they do not have ready eyewitnesses? What if they have people who were there but who did not see things but who may be able to give information or device? These are all different situations you may find yourself in after a crime has happened.

The Police have a wide variety of investigated methods, that is, old-fashioned style investigations, maybe like Sherlock Holmes – you look for clues, you piece together, you draw inferences. But while those make good stories, they do not help you solve a large number of crimes that take place regularly. So, Police use data, they use technology, they find corroborating evidence from as many sources as possible to try and understand what happened.

Even after Police work is done and the suspect is found, a trial may be necessary if the suspect does not plead guilty and where evidence gathered by the Police and investigators are put to rigorous testing.

As a lawyer, I take part in trials and I can tell you, the truth is not always straightforward. There will be competing versions of narratives and the Judge sitting there has to decide who is telling the truth. The more information and data you have, the better you will be able to piece the story together. And the standard for proving guilt is beyond reasonable doubt. So, it is a very high threshold you have to take before you can establish someone has done something wrong.

The general rules of evidence, certainly in civil proceedings is, you have a duty to disclose all evidence that is not privileged, even if it goes against your client's case. This is because your primary obligation is with the Court, to help the Court find the truth. Even in criminal proceedings, there are obligations on prosecutors to disclose evidence that may go towards showing the person is not guilty. All this is there because we want the Courts to have the best available information to arrive at the truth.

So, generally, the rules and the society that we live in has this presumption that the Court has to have access to all available information. And, of course, for the information to get to the Court, it must first be gathered, in this case, by the Police.

I understand that this limitation is only to the powers of the Police and not to the powers of the Court. But in practical terms, where you only have 25 days to gather this evidence, if the decision is not made upfront to gather this evidence, it is unlikely to be gathered or used in Court.

So, against this backdrop of the manpower crunch, Police have regularly kept up with the latest policing methods, using technology wherever possible. One obvious example is the use of CCTVs, which are now there at the ground floor lift lobbies and staircases to HDB flats. There is obviously a trade-off in privacy, but I think Singaporeans have generally been comfortable with this. They trust the Police; they cooperate with the Police.

I always find more requests for more CCTVs, not less. In fact, with most of my residents, the kinds of things they ask surveillance for usually gets rejected but this includes dealing loanshark harassment, littering, inconsiderate neighbourly behaviours, noise nuisance, speeding, traffic offences and parking offences.

The Police have done a very good job of dealing with serious crime. Minor crime is obviously not prioritised but this is what causes the most nuisance amongst many of our residents. And even in these situations, people are always ready to trade off privacy for a fast resolution to issues.

People understand that Police have limited resources and they are generally supportive unmanned surveillance methods.

Where would TraceTogether and SafeEntry come in? What does TraceTogether do? TraceTogether does not track individual locations. It is not this autonomous pilot scene where everyone goes, what you are doing or is it going to retrace your story. The only information TraceTogether has is who is near you at that point in time. This is obviously very useful in contact tracing because you may not know all the people you are in close contact with over a two-week period.

But for this very reason, it can also be helpful if you are trying to solve "who done it", a mystery of what happened here. Let us say, obviously, in a case of murder, it is very clear cut. The victim is there. The victim cannot speak; the victim is dead. The victim has a device. You may be able to infer from that device who was in close proximity at the time of the event.

How about other cases? What about cases where you cannot see the victim. Maybe you are sitting in a coffeeshop. A fight took place behind you. Your token is here but you did not see what happened but you were at the location. By the time the Police come, the people involved in the fight had disappeared. If that fight is not serious, then, that is going to be one of those potential unsolved crimes – people disappeared, not serious enough to investigate. But if they could use TraceTogether data to find out who did it, then that may be another solved crime. Would you want your TraceTogether data to assist in Police investigations with that situation? I would have no objections to it.

Likewise, if someone was hauled up, being interrogated for a crime. And if he were to say, "Oh, yeah, I was in the coffeeshop and I think the Member of Parliament was there, maybe Member of Parliament so and so". Then, if he was not close proximity, he maybe blindsided, cannot remember, you can check the TraceTogether data as well.

The key point about TraceTogether is that it is useful to place you together with a stranger and placing a person is an important part of the solving the mystery of the crime – who done it? where was he at the time it happened? I do not see any principled reason why this data should not be relied on by Police.

The second point is SafeEntry. Currently, TraceTogether data can be used for serious crime. But I also have reservations on things that are excluded. For example, if sexual assault is not serious, it cannot be used; violence not amounting to grievous bodily harm non-capital drug offences. These acts are not serious under the current legislation but would you want the Police to use all data available to solve these crimes? My answer would be yes.

If you were a victim, if one of your family members was a victim, would you want Police to use all available data? Pretty sure the answer is yes. If you were wrongly accused, would you want the Police to use this data to show you were somewhere else the time it happened? Probably yes. But that cannot be done now, unless it is a serious crime.

Police are also being prevented from using SafeEntry data now for anything apart from serious matters. SafeEntry would show what time you entered a place and maybe what time you left if you had checked out. I know that at many places, they monitor you checking in but they do not monitor you checking out. Admittedly, again, it is not perfect. It is just one more clue to help put the whole picture together.

If used in conjunction with TraceTogether, it may show when you went and it may show when you left, if you can remember where you went to and the Police can find someone else who was there at that point in time. You could be corroborated by a stranger.

To me, what SafeEntry does, is similar to what visitor logs at condominiums and so on, may have done. Generally, we accept that people who maintain properties can keep entrances of visitors when they come and go. And this is often used in, both in civil cases as well as in criminal cases to find out whether a person was at a particular location, at a particular point in time. To me, SafeEntry is a far more sophisticated visitor log far, more accurate, and the fact that its use is being limited is actually a concern because, again what you are saying is, no, no, you cannot see the whole picture, you just have to work with this limit of information.

To me, in identifying how a crime happened, who was there, these are not straightforward processes. And for those who do trials, there is plenty of uncertainty involved in all these things. The more information you have, the better you can test the truth or falsity of a person's story. And I think this is important.

Ultimately, if we want to keep COVID-19 in control, we need to use TraceTogether. Why? Because TraceTogether makes contact tracing significantly easier. A person does not have to remember where they were the last 14 days. They do not have to remember exactly how much time they spent at each place nor do you have to do individual interviews for each and every person. So, to me, it goes without saying that TraceTogether is necessary for this fight.

Is TraceTogether something to be feared? Is it a huge invasion of your privacy? In my view, it is not. In my view, the fact that TraceTogether can be used to solve crimes, it may help exonerate innocent people. To, me, that is one more reason to use it, rather than to be afraid of using it.

Ultimately, it is our duty as Members of this House to be role models as well. So I think it is important for us not just to reiterate or echo fears that are outside but explain to people whether there is a proper basis for their fears or whether these fears may be overblown and the important considerations, the benefits of using this outweigh, whatever fears we may have. Because ultimately, when we use TraceTogether, the more of us that use it, the better we can solve the community spread of COVID-19. I also hope the better we can solve crime.

But I do acknowledge that there are people who have concerns about privacy and therefore its use in crime fighting is going to be limited. So, yes, I do have my reservations on these restrictions, but as this Bill is a compromise, I support it.

Mr Speaker: Ms Nadia Samdin.

3.54 pm

Ms Nadia Ahmad Samdin (Ang Mo Kio): Mr Speaker, Sir, it has been slightly over a year since COVID-19 forced its first city into lockdown. The following months saw governments across the world pushed into doing the same, changing our lives and livelihoods in substantial ways for the safety of our citizens.

In Singapore, the situation is largely under control. Thanks to the sacrifices of our frontline workers, work by our Government and Civil Service, and the civic mindedness of our citizens in complying with regulations. We have put society before self. But the community cases remind us that the COVID-19 curve has only been flattened, and not quashed. With every report of a new case, what swiftly follows are assurances that the close contacts are being identified and quarantined, the capabilities of our contact tracing team on full display.

The positive impact of TraceTogether, or TT for short, in increasing the efficiency of our contact tracing efforts is undeniable but given the developments since we last sat in this House last month, we must also understand the sentiments of some Singaporeans about the expanded use of TT data in connection with the investigation powers under the CPC beyond what was originally promised to be used solely for contact tracing purposes.

This is the first time that a database of Bluetooth data that can tell who we are with, and for approximately how long, is recorded and accessible by the Government under specified conditions. While we note the strict conditions in which the data can be accessed, the very collection and storage of such information does involve an ideological leap in some quarters.

However, many believed in the purpose for which the data would be used and on that basis more than 4.2 million people have enrolled in the programme today. We cannot take their concerns lightly.

My worry is that despite the utility and practicality of TT, the cost of going beyond the initial promise of what the TT data can be used for may drive away those who are skeptical of the assurances which this Bill is actually seeking to provide.

To move forward together, I hope for a focus on building trust and gaining confidence for the programme. And, in this respect I have some clarifications to raise, and assurances I hope to seek. These fall into three broad categories: first, transparency in the technology; second, transparency in the projected life cycle and use; and third, transparency in the process of using TT data in investigations.

When the TT programme first started, the Government gave public access to the technology behind it. The programme's base code, Opentrace, is open source. I received an email from a young resident of mine seeking clarification on the continued commitment in making Opentrace, open source. There were two points in particular.

As of 10 January, the Opentrace Github repository for Android was updated close to 10 months prior. However, the app on Play Store was updated on 7 December. This suggests that the version listed on the Github repository, is not the same version as that which was on the application. There are also no opensource licences listed and the terms of use and distribution should be outlined in the repository itself.

Some suggestions for consideration are: to ensure that the Github repository is updated within a reasonable time when there are application updates that have been rolled out; to update the Opentrace repository with opensource licences; to publish brief transparency reports on perhaps a bi-annual basis that will help the public understand how the data is being used, provided that the release of such data will not disrupt any investigations; and to reaffirm the commitment that TT data will always be stored on the user's device, only shared with the Government when the user takes action to upload the data and can be deleted at the request of the user.

On my second point, there are several stages in the investigation and criminal prosecution process. Generally, when the Police have been informed of a possible offence, an investigation is initiated. Evidence is obtained. The investigation officers or IOs meet with the prosecutors in the Attorney-General's Chambers (AGC). The DPPs will decide on the actual charge to proceed with, subject to their own internal procedures and approval structures, as well as whether sufficient evidence has been collected. The person under investigation or arrest will then appear in Court to be formally charged.

But some investigations do not conclude with the person investigated being charged for a variety of reasons. For cases that proceed to prosecution, at the stage of criminal investigations, our IOs would likely have an idea of the range of offences which could apply. But the final charge may not be set out until much later. Even then, during trial, charges may be amended or dropped.

How will we deal with cases where TT data is used in investigations where the actual charge, in the end, does not fall within the categories of these serious offences? Will the use of TT data during investigations put pressure on prosecutors to proceed with a holding charge for a more serious offence in order to legitimise the use of TT data?

While I note section 82(7), I would also like to seek confirmation whether an individual will be able to meaningfully offer both his TT and SafeEntry data as evidence. In the event one is being investigated for a serious offence but claims innocence, can such individual volunteer and access personal contact tracing data, noting the possible privacy concerns of others, as that individual's personal contact tracing data may involve the data of others who were around the individual at a particular time.

And, finally, for example, in a case of sexual assault, it can be a very traumatic experience for victims. Cases do go unreported and some take a very long time before they come to light. Given that TT data is automatically deleted in 25 days and very little actual information is collected and stored, how useful is this data for investigations? I would appreciate if the Government could please share some of its considerations in this regard.

My third point. Mr Speaker, over the course of my engagements regarding the inclusion of TT data, people have also shared their concerns with me over the likelihood of TraceTogether one day becoming compulsory, along with a slew of other privacy concerns. There is speculation circulating, and the only way to combat this speculation is with clarity.

Specifically, I would like to request for clarity on the life cycle of the programme. People want to have an understanding and assurance on how long the programme will last, that it will continue to remain opt-in, under what conditions that may change and when it would be laid to rest. Of course, it is impossible for us to give a fixed date for when the TT programme can be terminated as it is still unclear how long COVID-19 will last and even more uncertain what its impact may be on society at large.

However, it is possible for us to take a condition-based approach in detailing the life cycle of the TT programme, a way of specifying the conditions that will prompt a significant change in our present use of the TT app and device. This is so Singaporeans are prepared in advance for any changes in the TT programme as the conditions and parameters for this would have already been specified. As an example, one of the "conditions" could be, should there be no new infections, both community and imported, for a period of x number of months, the TT programme will then be laid to rest. While we are dealing with unprecedented challenges and we recognise that things change very quickly, such an open approach will help engender trust.

In closing, Mr Speaker, Sir, at the heart of it, I, along with many Singaporeans, believe in the importance of contact tracing and the utility of the TT programme. I have read a number of concerns and confusion over the past month and I do feel bad for the engineers and teams behind the programme because I genuinely believe they were doing the best they can, all the while working in the heat of a crisis under immense pressure. I also appreciate the difficult position that we are debating today and the Minister's candour.

It is evident to me that the various protocols around the TT data, for example, encryption, storage on local device and the automatic destruction after 25 days, were in place solely for contact tracing purposes at the time.

However, as a lawyer, I also understand the potential utility for which the TT data could bring as evidence, in particular, for grave offences, and the potential to charge an accused who committed a wrongdoing, exonerate someone who is innocent, and give peace to victims and their families.

Based on several conversations I have had on the ground, many Singaporeans understand and are willing for TT data to be used in investigations although some do wish that they had been consulted first. I hope that some of the above clarifications can be addressed.

Notwithstanding the above, Mr Speaker, Sir, I believe that the Bill reflects a practical position and compromise, and express my support.

Mr Speaker: Mr Xie Yao Quan.

4.05 pm

Mr Xie Yao Quan (Jurong): Mr Speaker, Sir, Singapore may be doing well now, but COVID-19 could be with us for quite a while more. Indeed, many countries around the world are currently dealing with major outbreaks.

In Singapore, we have a multi-layered strategy to keep ourselves safe, for as long as possible. But, crucially, every single layer in this strategy rests on trust between the Government and its people. Safe distancing, wearing of masks, complying with group size limits, keeping at all the Safe Management Measures and resisting fatigue and complacency – we can only do this if there is trust between the Government and its people.

Getting as much of our population vaccinated as possible, allaying concerns, countering misinformation. These too require trust between the Government and its people. And participating voluntarily in a national contact tracing scheme like TraceTogether certainly requires that same trust.

In short, trust is the lynchpin in every layer of our multi-layered strategy to stay safe in a COVID-19 world. And therefore, the Government must do all it can to continue keeping trust with our people in this fight.

This is why personally, I would much prefer – much prefer – that the Government maintains what it had communicated at the start, at the outset, and completely exempts TraceTogether data from Criminal Procedure Code provisions.

In my view, this is the surest way – not the only way but the surest way – to maintain the trust between Government and people that is so crucial in this fight, and the surest way to help Singaporeans understand what Minister Balakrishnan himself had referred to in his clarifications in this House last month, and I quote "not only the measures that we are implementing, but why we are implementing it, the spirit behind it."

A complete exemption of TraceTogether data from Criminal Procedure Code provisions, in line with the Government's original communications on this matter would, in my view, be the surest way to achieve this.

Some have pointed out that other technological applications that are so prevalent in our lives today have far broader terms of use regarding our personal data. But that is really not the point, and in any case, the trust between Government and its people is a completely different matter. It is sacrosanct. It is strategic.

I was, therefore, very concerned about how Singaporeans would take to the Government's clarifications on this matter last month, and to the proposed amendments before us today.

In this respect, I was relieved to observe that, in general, in fact, the level of participation and the desire to participate in TraceTogether had actually remained high. In fact, many of my residents have been anxious to collect their tokens and were asking me when stock at the Community Club would be replenished – happy to know that stock has arrived. Other residents pointed out to me that the amendments actually limit Police access to a much narrower scope than what the Criminal Procedure Code provides for. So, they understand the Government’s thinking on this matter and recognise the Government’s practical and calibrated approach on this matter.

And I note that TraceTogether data, as it was originally designed, will ultimately continue to be automatically purged after 25 days and cease to exist altogether once this pandemic is behind us, the proposed legislation notwithstanding.

So, ultimately, it was really a dilemma for me. On the one hand, the need to jealously safeguard trust in the interest of public health. On the other, having a calibrated way to also enhance public security and safety. I thought long and hard about this matter and, ultimately, after considering the Minister's clarifications, my personal views and by listening to the whole range of views amongst my residents, I am prepared to support this Bill.

Mr Speaker: Order. I propose to take a break now. I suspend the Sitting and will take the Chair at 4.30 pm.

Sitting accordingly suspended

at 4.11 pm until 4.30 pm.

Sitting resumed at 4.30 pm.

[Mdm Deputy Speaker in the Chair]

COVID-19 (TEMPORARY MEASURES) (AMENDMENT) BILL

Debate resumed.

Mr Alex Yam (Marsiling-Yew Tee): Mdm Deputy Speaker, I think I can speak on behalf of many Singaporeans and all Members of this House will agree when I say that I take pride in our Police Force.

We are proud of the work that they do in keeping all of us safe. They are efficient, reliable and responsible. They are not known to abuse their authority and they have always used their investigative powers diligently. They are the reason they walk our streets safely and our children play freely. I trust them with my life, I trust them to keep us safe, and I trust that they take their responsibility and duty diligently.

I must admit that I was a little surprised at the furore over the revelation that TraceTogether data may be used in Police investigations under the Criminal Procedure Code. After all, public safety and public health are of equal importance. However, I can empathise with the reasons for the unhappiness. The abrupt change in the terms concerning personal data usage is upsetting for many.

In this pandemic, the people have entrusted their personal data for an important purpose. To be then told it will also be used for something beyond the original intention feels like trust has been broken.

This breakdown in communication could have been avoided. If more time was spent engaging various stakeholders and examining the communication strategy for loopholes, we could have avoided the current situation that we are in.

But with the urgency due to the raging pandemic last year, I can fully understand that things developed quickly and this unfortunately led to incomplete and inaccurate information being disseminated to the public.

The communication process could indeed have been better managed. People rightfully expect better from their government.

What the Government must do now is to rectify this mistake, apologise for the miscommunication, acknowledge the concerns that have been raised, understand the reasons for the discontentment, and reassure the public on what will be done to prevent similar occurrences for future policies.

Coming back to the use of TraceTogether for Police investigations, I think it bears repeating that Singapore is ranked top for personal safety. This is according to the most recently available 2019 Safe Cities Index published by the Economist Intelligence Unit.

We have our Police and security agencies to thank for this. But it is easy to get complacent. Just as it is with combating COVID-19, we must not take our safety and security for granted.

Singapore may be safe, but it is not crime-free. Violent crimes do occur, though rarely.

In 2019 alone, 155 serious crimes were recorded, including some violent ones, and in recent months, resurfacing of cold cases, a small number of which were horrific crimes involving suspected murder and rape that remain unsolved till today due to the lack of sufficient evidence.

Indeed, therefore, access to information is key to the resolution of any crime. Police need evidence and the sooner the better, the more complete the better.

To leave no stone unturned is perhaps the unspoken operational motto that guides exemplary police forces around the world. This helps them to protect civilians' safety and security. Therefore, it strikes me as counterintuitive to deliberately place restrictions on the Police on their access to information that could be helpful in the course of the investigation.

It would be akin to walking past a bloody knife and ignoring it completely.

While it may be rare that TraceTogether data could produce conclusive evidence for every single investigation that it is used for, sometimes you just need one small jigsaw piece to complete the puzzle.

As with the hon Member Mr Vikram Nair, I have reservations on this legislation that we are placing a restraint on the Police's investigative powers and limiting the type of crimes that the data can be used for.

There are crimes that might not at the current moment be classified as serious crimes but have the potential to escalate. An example is stalking. We have seen in various cases, not just locally but internationally, that stalking can give rise to more serious crimes such as sexual assault or even murder and kidnapping.

Some have also scoffed at the idea. If you have to commit a crime, do not bring along your TraceTogether token then. Do not turn on your app. But not all crimes are planned. Most are opportunistic: molest, pickpocketing, even assaults are sometimes committed on impulse and are not so much pre-planned. These situations will benefit from the use of TT data in investigations as well.

Many also tend to look at the use of TT data, in the most recent conversations, solely for the Police to establish guilt or to trace where you have been. Let us not forget that in the entire process of investigation – all the way from Police until it makes its way to Court – it is also equally important that evidence is available to prove innocence, not just guilt.

Whatever the gravity of the crime, any miscarriage of justice, whether for a minor crime or a serious crime, weighs equally on the person.

Some may of course argue that it is the Police's responsibility to seek out evidence via other channels that have always been available – a plethora of sources of information – and therefore the Police need not use TraceTogether.

That might be true to a certain extent but if it makes it more efficient, if it solves a crime, it saves a life and it safeguards security in our society, it upholds justice, I fail to comprehend why they should be denied access to any tool that would allow them to do so.

Time is of the essence in any investigation. Over the years, new technology has been consistently introduced and existing ones also enhanced to aid our Police, to improve the quality and speed of investigations. The Police are therefore able to review many cases with conclusive results.

I therefore fear that if we start introducing restrictions to Police investigative prerogatives, this will set a precedence for future technology where then, there is an expectation that applicable scenarios must be spelt out in full. This will then seriously impact the capability of not only the Police but other security agencies and the Government because they would have to overcome a huge amount of red tape just to get evidence.

On a wider scale, it is also imperative that we get our priorities right. Data privacy is important, I think it is universally acknowledged – but so is safety, security, life, preservation of life, both in health as well as in safety.

In other countries, the limitation of capability and access to information seriously impacted the management of many governments on the pandemic itself. Some governments have had to seek approval to declare a state of emergency or to introduce measures just to control COVID-19. Even when powers are accorded, they are inadequate. There have been mention of other jurisdictions where contact tracing have been limited. But why?

It is not because of some noble ideal but because no one is taking it seriously. They do not download it. They do not participate in contact tracing. These measures are not so much a noble ideal in protecting the privacy but to encourage them to protect their lives.

Singaporeans amidst this pandemic have been responsible, cooperative and with a mind on the greater social good. This has helped us tremendously in combating the pandemic.

I note from feedback and conversations with residents who are volunteers and many others that the unhappiness does not stem from the Police access to the data but from a broken trust – from the sense that trust has been broken, that a promise was not kept.

Had all the cards been laid on the table from the very beginning, perhaps we would not even be having this debate today. The problem really lies with the omission of information and a perceived lack of transparency to the public on communication regarding the use of TraceTogether. Certainly, the Government should have been more open, more prepared and more diligent about communicating this aspect to the public.

But I come back to the point I made three times in this speech – that I am uncomfortable with Police access to any information that will be helpful to keep our society safe. Because even if the Police is allowed to use the data, it does not mean that they use it callously. They use it with great responsibility. The hon Member Mr Murali, from his experience, has also indicated that the Police take the use of evidence and personal data very seriously. It is not something that they throw about willy-nilly.

If there is an infraction, there is a misuse of the data, it is punished, action is taken.

We are in the midst of a pandemic. These are extraordinary times and TraceTogether is an extraordinary measure. It is a temporary tool and that bears repeating. It is a temporary tool.

We use to build our resilience against COVID-19. It helps to keep all of us healthy and safe, and it is crucial in reducing community cases.

As the past months have demonstrated, we are far from being immune to COVID-19 resurgence. We have seen that in many other countries. Therefore, the usage of TraceTogether remains crucial.

Any refusal to participate in contract tracing will impede our efforts and turn us back from the gains we have made in the last year. Therefore we must stay rational in this process.

Mdm Deputy Speaker, as the Government has already introduced the amendments before this House and has communicated to the public more than once its intention to do so – to ringfence the data for only the stipulated seven categories of serious crimes – I therefore reluctantly support the intent of this Bill to formalise those assurances about the use of contact tracing data to maintain trust.

But I emphasise again that I am uncomfortable with the limits upon our Police capability to solve crime and to keep us safe and also to prove innocence.

This must therefore not set the precedence for future data access for new technology when it comes to issues of public safety. Stability, safety, security and human lives are at stake, pandemic or otherwise.

Mdm Deputy Speaker: Mr Sharael Taha.

4.45 pm

Mr Sharael Taha (Pasir Ris-Punggol): Thank you, Mdm Deputy Speaker. Singapore has dealt with this pandemic decisively. My visit to our recently set up swab centres in Pasir Ris gives me every confidence that we have and will continue to take appropriate measures to respond quickly and effectively to curtail the spread of this virus.

The pandemic has also expedited our use of digital tools such as the contact tracing app. This has enabled us to perform contact tracing more efficiently and reducing the need for laborious manual process. Personally, I have had two meetings that were cancelled because members were placed on SHN based on TT information that they were in contact with a suspected case. And I am glad that this information was made available and has protected me and my family from potential exposure to the virus, especially when I have elderly parents.

It is fantastic to see how, as a community, we have managed to leverage on technology to combat this pandemic. It is not far-fetched to state that every single one of us is responsible for the effectiveness of TraceTogether, and we must continue to do so. With it, we can quickly trace anyone who has been exposed to the virus, and take the necessary steps to quarantine and prevent them from infecting others.

Time is of the essence for contact tracing to be effective. Only through the concerted and responsible use of TT will we be able to do contact tracing quickly, and slow down the spread of virus. In true digital "gotong-royong" fashion, all of us helping each other out, serving the greater good of society.

Safety, security and justice are societal values that we all agree are important. Collectively, we work hard to ensure that we are able to uphold these qualities within our society. Many of us would even say that these qualities should never be compromised. The Singapore Police Force plays a fundamental role in ensuring that we continue to enjoy a safe, secure and just Singapore. We must continue to support our Police Force in its efforts to prevent, deter and detect crime. And our men in blue must be suitably equipped to do their duties effectively. We all believe and trust the Police Force to leave no stones unturned when it comes to the safety and security of Singapore. And that they would bring about swift justice to those who have broken our laws.

The Criminal Procedure Code or CPC has allowed our Police Force powers to obtain information as part of their investigations. This is how police investigations have operated over the years and contribute to making our Police Force effective. Now that the Ministry has clarified the reach of CPC, do we treat TT data as another source of information that can be used by our Police Force in the course of their investigations? Or are we trying to say that certain sets of data and sources of information should be excluded from CPC, and hence cannot be used by the Police Force to help them in the course of their investigations? Should we be setting a precedent of precluding certain sets of information to be used by law enforcement agencies in their pursuit of justice?

What this potentially means is that information that may assist in investigations cannot be used by the Police. And conversely, it may mean that an innocent man is not able to use information from TT as an alibi to prove his innocence. From a data use point of view, the preclusion of certain sources of data seems to only make the jobs of our men in blue much more difficult. And yet we fundamentally agree that their work to preserve our safety and security, and facilitate the enactment of justice are important features of our society which we must uphold. The recent case of the 16-year-old radical detained under ISA reiterates the fact that we can never take our safety and security for granted and, hence, should we not allow our Police Force every information to help them achieve their mission?

Moreover, when we start to preclude sets of information from being used by our Police Force, we set a dangerous precedent for future preclusions of access to data. As we undergo further digitalisation of our nation, we will create even more technologies and sets of data or information that we are only beginning to discover its benefits and applications. Are we really ready to say that we will not allow some of these future technological benefits and applications to be used by our law enforcement agencies in our pursuit for a safe, secure and more just Singapore?

It must be reiterated that CPC only allows for such information to be used for criminal investigations. It is not in the public’s interest to deny our law enforcement agencies access to such data if it can be used to serve the public good. Beyond the arguments of protection of personal privacy, should not safety, security and pursuit of justice for our society take precedence and be prioritised? Mdm Deputy Speaker, in Malay, please.

(In Malay): [Please refer to Vernacular Speech.] When we allow TT data to be used only for these seven categories of criminal offences, we should do so with an awareness of its implications. This essentially means that, after excluding these seven crimes, TT data cannot be easily used as evidence to prosecute or to defend those suspected of crimes that are not included in these seven categories.

For example, when a person is wrongfully accused of molestation, would the individual not be able to use location data to provide an alibi as evidence that he is innocent? Or in the search for a criminal witness, would the victim not be able to ask for help from strangers in the vicinity?

For child molestation cases, from the perspective of parents, like many of us here, TT data may be able to assist investigations in such cases. Is it not our social responsibility towards the victim's families to enable police to use data and any possible resources that can help the victims and families find justice?

In conclusion, after the Ministry has explained the CPC's jurisdiction, the basic question that we need to ask ourselves is whether certain sources of information should be excluded from the jurisdiction. As a society, we still uphold societal values such as security, prosperity and justice which should never be compromised.

In the pursuit of justice, we are confident in that the law enforcement agencies will conduct thorough investigations and our Police Force will remain as a pillar of safety and peace that we have enjoyed all this time.

We have just embarked on a digitalisation journey and there are many more new things that we need to know to ensure that the law enforcement agencies can continue to move ahead.

At the moment, once we have become aware of how TT data can assist police investigations, we cannot deliberately disregard, obstruct or halt the use of TT data in criminal investigations. This is an injustice to the victims and those who are innocent who have placed their trust and confidence in our Police Force and our legal system.

(In English): Mdm Deputy Speaker, while I understand the concerns of personal privacy, the challenge that we are facing is that we have to balance between privacy, public health and safety, security and justice – a point also mentioned by fellow Members Mr de Souza, Mr Murali, Ms Tan and Minister Vivian.

I would like to highlight that this amendment sits in the COVID-19 (Temporary Measures) Bill which is temporary and tabled to be in force till 8 April 2022 or when this pandemic is over. We must also not lose sight of the designed principles of TT and the fact that TraceTogether data is stored only up to 25 days.

These facts surely point to the original intent of TraceTogether, which is a technological/digitalisation measure that was put in place primarily for contact tracing in order to help our community contain the spread of the current pandemic. The law enforcement benefits that may arise from this is only a useful byproduct and the CPC ensures that it will be used judiciously to serve societal needs for safety, security and pursuit of justice.

In this case, the Bill limits the use of such data to these seven categories of serious criminal offences. However, this should not set the precedence and impact our safety and security by tying the hands of our Police as we move into the digital future. Information that may assist in investigation, even if it is remotely helpful, should be made available to the Police. And let this be the only time where we limit access to information for our Police Force in the pursuit of justice. Notwithstanding the arguments above, Mdm Deputy Speaker, I support this Bill.

Mdm Deputy Speaker: Mr Louis Ng.

4.55 pm

Mr Louis Ng Kok Kwang (Nee Soon): Madam, the use of TraceTogether data has generated much public debate. One month after this issue first arose in Parliament, we are now debating a piece of legislation introduced on a Certificate of Urgency to put in safeguards on the use of data.

In the past few months, the Bills, which have been fast-tracked all relate to COVID-19 measures.

I thank the Minister for acting just as quickly to address the public’s privacy concerns and data protection concerns. But this is not simply an issue of privacy and data protection, it is also a public health concern.

Restoring the public’s trust in our national contact tracing infrastructure is important especially in these times. We read in the papers news of second and third waves in other countries. We need to be ready on all fronts to suppress any outbreaks as quickly as humanly possible. We cannot now handicap ourselves by weakening the public’s trust in our contract tracing system.

I should also say that I understand the public safety and security needs to access TraceTogether data for certain serious crimes. As a parent, if my daughters’ safety was at risk because of a kidnapping for example, I know I would want access to all data possible to keep them safe.

The question is not whether the data should be used, but what safeguards should be in place. I have two points to raise.

First, can Minister explain what operational protocols are in place to ensure TraceTogether data used for serious crimes do not become used for investigations of less serious crimes? For example, the SPF may access TraceTogether data for a suspect involved in a murder investigation. In the course of investigations, the TraceTogether data links the suspect to a separate petty theft committed. Given that police investigations are fluid, how does the SPF ensure that use of the TraceTogether data is strictly confined to the seven categories of serious crimes?

Second, the debate over the past month may have impacted actual use of the TraceTogether app. We already know from newspaper reports that some people are now choosing to turn off their TraceTogether app when meeting friends or when going out; we must measure the precise effect of such changes. Can the Minister share what specific data points does the TraceTogether team use to measure the impact of the Government's announcement on TraceTogether app’s actual usage?

Let me take an example. If we look at daily active users or weekly active users, we might well notice no change in usage.

But we might find, for example, that more people are actually turning on the TraceTogether application only once a day and turning it off for the rest of the day. We may also find that mobile devices with TraceTogether apps are, on average, pinging with fewer devices than before, suggesting that the app or Bluetooth functionality may have been turned off. Even if we mandate that the app is flashed at point of entry to a location, a user can subsequently turn off the app.

As I have said, I agree with the Government that TraceTogether data should be used for very serious crimes. But we have to deal with the reality that some people may find ways around use of the TraceTogether app, compromising our public health efforts.

For public health reasons, can the Minister share what specific data analysis is used to trace whether actual compliance rate with TraceTogether app requirements does not go down? Madam, notwithstanding my clarifications I stand in support of the Bill.

Mdm Deputy Speaker: Mr Zhulkarnain Abdul Rahim.

5.00 pm

Mr Zhulkarnain Abdul Rahim (Chua Chu Kang): Mdm Deputy Speaker, let me begin with two unshakeable truths that we are faced with.

The first truth: it is trite that comprehensive case investigation and contact tracing are crucial to prevent community spread of the COVID-19 pandemic. In addition to vaccine, contact tracing and social distancing are our defences and instruments to fighting contagious diseases.

We are facing a global pandemic and an unprecedented economic crisis, the like of which our nation has never seen before. This is a matter of public health. This is a matter of life and death.

Conventional contact tracing and investigation is a complex and laborious process. There are also significant challenges like language barriers and distrust of unknown callers, coming in the wake of a year when online scams are increasing. Contact tracers are, in fact, in a race against time to prevent the next spread of infection.

In the UK, by mid-July last year, the conventional contact tracing system was inundated and rendered less effective. In London, only 47% of at-risk people were contacted. The UK government had stated that in order for the tracing and curb to be effective, at least 80% of the infected people's contacts must be contacted and told to self-isolate within 48 to 72 hours.

Singapore's TraceTogether, which uses Bluetooth technology, is one of the least invasive of all the contact tracing tools out there. In fact, TraceTogether has been modelled by researchers in Germany who are working on an app which is compliant with the EU's General Data Protection Regulations (GDPR). TraceTogether has assisted our agencies to quickly identify and curb local cluster transmissions in the community, as seen in the recent Police Para-Vet and Kallang industrial clusters. There is no doubt that contact tracing is vital in our fight against this pandemic and with more people using the app, the more effective our contact tracing will be.

The second unshakeable truth is that our law enforcement agencies have been effective in solving and deterring crimes, and as a result, we have built a reputation of being a safe and law-abiding country. We must give credit to the dedication and meticulous hard work of our Police officers over the years, aided by our robust legislation and criminal justice system.

Our law enforcement agencies have been effective in thwarting threats to our public safety and security. Just a week ago, we have been rocked by news of a foiled attempt to attack mosques in Singapore by a 16-year-old. For future threats and serious crimes, it behoves the Police to utilise all the tools at its disposal to detect and prevent such crimes and it is incumbent upon us, as Members of this House to facilitate this.

This Bill specifies that the contact tracing data cannot be accessed by any public officer. The only exception is for Police investigations and this is further restricted to the seven serious offences specified in the Bill.

I am confident that all Members of this House would agree on two things. First, that the offences specified are so egregious in nature and extremely time-sensitive that it is important to allow the Police to have all the tools at its disposal; and second, that there is no reason to doubt that the Police would use those tools judiciously and within the ambits of the law in order to fight such crimes quickly for the public interest. In fact, as part of our criminal law, the Police already has existing powers to compel production of any document or thing, including seizing computers or mobile devices.

The fact that the TraceTogether did not consider the application of the Criminal Procedure Code (CPC) shows that the contact tracing tool was never designed for criminal investigations purposes in the first place. Why not have a blanket exclusion of such data from criminal investigations? I do not think we should go down this path because these are serious offences – the stakes are just too high. Mdm Deputy Speaker, in Malay, please.

(In Malay): [Please refer to Vernacular Speech.] The success of TraceTogether is dependent on public trust and confidence. This debate has clarified how Police investigative powers, when using TraceTogether and SafeEntry data, are limited to only serious offences.

For someone who is under investigation for serious offences, the Police would have to firstly seize his or her mobile device, or TraceTogether token, before accessing the data, since the data is stored on his or her device.

It is thus not a hidden attempt or something that is unknown to the individual. Nevertheless, to further protect the rights of privacy of the individual, perhaps the Ministry can consider a dedicated channel within the PDPC to investigate any complaints of TraceTogether data access breaches made by any party.

Another suggestion is in regards to the category of serious offences. While I agree that these seven categories are egregious offences, I would like to ask the Ministry to consider that crimes or offences against children under the age 14 or vulnerable persons, to be considered as offences that are serious enough to be included in this Bill. This includes those who by reason of their mental or physical incapacity, are unable to protect himself or herself.

I have previously spoke about how we should, as a society, stand together to end violence and crimes committed against children and vulnerable groups.

Perhaps we should leave the door slightly open for the Police or the law enforcement agencies to seek a specific Court order to allow the use of data in exceptional cases, especially when it will help to investigate offences committed against children or specific groups.

I also believe that this will act as a deterrent to offenders who take advantage by hiding under the proverbial cloak of data privacy.

Ultimately, this debate is not about fighting crimes. It is about fighting the COVID-19 pandemic together as a nation. However, the two objectives are not mutually exclusive.

I believe that there is still great public confidence in TraceTogether and SafeEntry, because it has helped us to contain the spread of the pandemic in our country effectively.

Let us not let this issue of data privacy distract us from what is at stake here. We still have a long way to go in our fight against this pandemic, with the vaccination program being rolled out.

We have to fight together as one and not allow any seeds of doubt to fester in our communities that will erode trust in our nation’s efforts to combat this pandemic and fight crimes at the same time. As the saying goes, "united we stand, divided we fall".

(In English): Mdm Deputy Speaker, this debate will shape how we treat other issues surrounding privacy of data in the future. This legislation, however, is a temporary compromise, at least until the pandemic is over and it makes clear what can or cannot be used by the Police in its investigations.

I am glad that we have that line drawn clearly in the sand, before we cross too far and get lost in the desert. I would not wedge the safety of my daughters or anyone's daughters – you can bet your bottom dollar on that. With that, Mdm Deputy Speaker, I support this Bill.

Mdm Deputy Speaker: Ms Hany Soh.

5.08 pm

Ms Hany Soh (Marsiling-Yew Tee): In Mandarin, please, Mdm Deputy Speaker.

(In Mandarin): [Please refer to Vernacular Speech.] Mdm Deputy Speaker, thank you for the opportunity to speak on this Amendment Bill. I would like to declare that I am a lawyer.

I agree that the Government respects Singaporeans' desire for personal data privacy, and make it clear that unless it is for the investigation of seven categories of serious offenses set out in the Bill, the authorities will not use or share any records in TraceTogether.

The primary purpose of TraceTogether (TT), in the form of either a token or app, is to enhance contact tracing for COVID-19 cases and quickly locate the source of the infection.

However, because it also records when and whom you have been in close contact with, that information might be useful to the Police when investigating certain cases, such as rape, kidnapping and murder, and allow them to apprehend the culprit in the shortest time possible.

Last month, the Straits Times reported a few sensational cases in Singapore in the past; these cases remain unresolved today. Some victims were raped before they were murdered. As technology was not very advanced back then, even though the Police did a thorough investigation, they were still not able to apprehend the murderer.

As one can imagine, this has caused immense grief and anguish to the victims' family. We can imagine that to-date, they are still grieving and continue to hope that the Police can one day apprehend the murderer and bring closure to the case.

As technology becomes more advanced, we often see on Channel 8's Crime Watch how Police use certain technologies, such as CCTV footage and even leads provided on the media and social media platforms to solve crimes.

However, the investigation officers (IOs) in the Serious Crimes Division may also encounter tricky cases, for example, the culprits may have wiped clean their fingerprints in the crime scene and have not left any leads behind. In the crime scene, there were also no CCTV footages, so the Police were not able to locate the murderer. After the victim has died, family members may also turn to social media platforms and give out flyers to seek leads, but without any success.

When investigating such serious crimes, I think that the Police should do everything to fight against the clock, because as long as the murderer remains at large, it may cause others to panic and worry about their own safety.

In order to avoid another unsolved case, I agree that the authorities should reveal to the IOs information recorded by the TT. This may bring a ray of hope in apprehending the culprits.

However, the TT may also have recorded other people’s personal privacy. Therefore, I urge the authorities to be extra cautious and ensure that when using the information, other people’s personal data and privacy will not be leaked.

(In English): In summary, Mdm Deputy Speaker, while I speak in support of using any available digital contact tracing technology, including TraceTogether tokens and SafeEntry records to assist in criminal investigations, I also recognise the fact that its primary intention and objective was to serve the purpose of preventing COVID-19 clusters from manifesting in our community.

I therefore agree that we should reserve the right to use contract tracing data only in the most dire of circumstances, like the seven categories of serious offences as set out in the Bill.

If and when it is necessary to utilise under such circumstances, I urge the relevant authorities, while handling such data, to adhere to a strict and transparent protocol throughout the entire process, from its retrieval for usage to its eventual disposal.

Mdm Deputy Speaker: Mr Yip Hon Weng.

5.13 pm

Mr Yip Hon Weng (Yio Chu Kang): Mdm Deputy Speaker, as many Members have mentioned, this willingness to use the TraceTogether data is related to the central issue of people's trust in what the Government has said about the collection, storage and use of the TraceTogether data.

This public trust in the Government is especially important during a crisis. In line with what Prof David Chan explained in his book, "Combating a Crisis", public trust is directly affected by previous related events. How agencies coordinate and work together as well as communicate with the public will also affect public trust.

We recall that last year, there were several incidents of data lapses or information leakage by public officers. This pertains to the number of COVID-19 cases and announcement of control measures. We also learnt about leaks involving personal data committed by public officers in violation of the Official Secrets Act in 2019. And this was just months after the largest data breach in Singapore where personal data was stolen from SingHealth in 2018. With these headline grabbing incidents, we can understand why the public may be concerned about their data collected through the TraceTogether platform.

On agencies working together, we should note that the TraceTogether initiative cuts across the portfolios of many Ministries. The gadget is developed as part of the Smart Nation initiative. The data is channelled to MOH for contact tracing. And from the Government's response to a Member's Parliamentary Question last month, the public now knows that MHA, specifically the Police, has access to this data.

Mdm Deputy Speaker, it took six months before this issue of accessibility of the TraceTogether data by the Police was made known to the public. During my engagements with residents, I have encountered many instances where they asked me why it took so long for the Government to reveal this fact. I am glad that the Government has acknowledged that the issue should have been flagged earlier.

Contact tracing is not new. In the West, technologies involving the mobile tracking of infectious diseases have been around for at least a decade. However, issues relating to privacy and civil liberty have contributed to such technologies’ low penetration rate in these countries.

So, it should not be surprising that Singaporeans, too, have concerns about individual’s data privacy even from the onset of the gadget roll-out. I believe we can recall there were glowing news reports of hundreds who have enthusiastically queued at the various centres to collect their gadgets. Everyone then understood that the TraceTogether data would be automatically erased once it is older than 25 days and it would only be used by MOH. You can imagine the let-down when it was disclosed that the Police also have powers to access the data via the Criminal Procedure Code.

Singaporeans understand and support the need to fight crime. It is, therefore, reassuring that we are now moving this Bill to provide a “white-list”, limiting the use of TraceTogether data to seven categories of serious crimes and nothing else. To provide further reassurance, can the Minister elaborate if the Police are still able to access the TraceTogether data after it has been collected for 25 days? In a criminal investigation, the Police may want to trace back a suspect’s movements well longer than 25 days ago. In this instance, would they be able to recover, retrieve and access the data even after deletion? Is the data totally deleted and disappear after 25 days or is it still stored somewhere?

In order for Singapore to ride out this pandemic, we need all residents to be onboard the Government’s various measures. Apart from the ability to do effective contact tracing, we also need to vaccinate our population. This, again, requires the people to trust the various types of information that the Government shares with the public, especially those related to vaccine safety. Only with trust would people step forward and take the vaccination.

Mdm Deputy Speaker, in conclusion, I hope that with the passage of this Bill today we can maintain the public trust in the Government. To do this, we must be clear when explaining or sharing information with the public. If there is any misinformation, we must act at the earliest opportunity to set the record right. Ultimately, it is about the public’s belief that the Government is able to solve problems, be transparent, and says what it means and means what it says. Mdm Deputy Speaker, I support the Bill.

Mdm Deputy Speaker: Mr Don Wee.

5.18 pm

Mr Don Wee (Chua Chu Kang): Mdm Deputy Speaker, I will be speaking in Mandarin.

(In Mandarin): [Please refer to Vernacular Speech.] Mdm Deputy Speaker, it is up to the doer to undo the knot. Indeed, considering how everything started, I am glad to hear the clarification made by the Minister just now and he had also assumed the responsibility. He also acknowledged that because of the seriousness of the situation at that time, it was imperative to gather information to quickly identify, isolate and treat patients. It is expected that he and the departments involved had very limited time to think about any other ramifications. Although we are surprised and disappointed by this oversight, it is somewhat understandable, taking into account the unprecedented situation of the pandemic.

Now that the Minister has clarified it, I think the matter should be rested. The reason is very simple: the Government obtains information through TraceTogether and the Criminal Procedure Code in order to protect its citizens.

The Government is unlike private companies, such as Google and Facebook which collect data to make a profit. We do not seem to be as concerned about Google and Facebook collecting and monitoring our personal data and we often use these platforms. So, why are we so worried about the data the Government collects to protect us? In addition, what the Government collects, in comparison, is very limited and much less. What is more, we are a country governed by the rule of law, and there are rules governing data processing in all Government departments. In the course of implementation, institutional or personal lapses may occur occasionally, but once they are discovered, we acknowledge and rectify them. This is how we improve and strengthen the system. Those who insist that it is too late for the Minister to take back his words, advocating personal privacy, and demand that the Government limit the TraceTogether data to COVID-19 tracing only, are missing the wood for the trees. I would ask, if not for our country bringing the pandemic here under control, and ensuring law and order, would we even be able to discuss privacy issues?

Today, we are gathered here to debate whether legislation should be passed to limit the use of TraceTogether data by police and courts to only the investigation of seven types of serious crimes. Frankly, I am not in favour of this "special treatment" for TraceTogether data.

In my view, even if a crime is not under the seven categories of serious crimes, the use of the data should be authorised for police investigations or court proceedings. Solving cases are not easy! With hands and feet tied, how can the police solve cases and arrest suspects?

I believe that all Members here, including those in the opposition, will do their utmost to protect their families, protect their children, pursue all leads in order to identify the pervert, put him in jail and prevent him from endangering other innocent children. We should not become like some western developed countries where certain cases cannot be solved due to privacy protection.

We are an Asian society where the interest of the community is more important than that of the individual. It is this value that has enabled us to fight the pandemic more effectively.

I hope that the Minister will consider my views and suggestions. Thank you.

Mdm Deputy Speaker: Minister of State Desmond Tan.

5.22 pm

The Minister of State for Home Affairs (Mr Desmond Tan): Mdm Deputy Speaker, I will take the opportunity to address some of the questions that were raised by Members of the House pertaining to contact tracing data used by Police investigations.

First, Ms Nadia Ahmad Samdin and Mr Louis Ng asked about using contact tracing data for cases where the initial charge for a serious offence is subsequently reduced or amended to a less or non-serious offence, or if the serious offence reveals a separate non-serious offence. The Police and Prosecution will not be able to use the contact tracing data for prosecution of a non-serious offence. This is what we are trying to say in this Bill. There could be a situation where the suspect is investigated for both serious and non-serious offences committed at the same time. In criminal proceedings for such cases, which may be dealt with in a joint trial conference covering both the serious and non-serious offences, it would not be feasible to separate the data used for investigations of these offences. But should the offences be dealt with separately in separate trials, then the prosecution will not be able to use the data in prosecution for the related non-serious offence.

Mr Pritam Singh asked about Police’s use of TraceTogether data and Mr Leong Mun Wai also asked when Police first accessed the TT data. The Police have only requested for TT data once, for a murder that occurred in May 2020, in line with their powers under the CPC. As the TT app was not installed in the suspect’s phone, there was no useful data obtained.

Mr Pritam Singh and Ms Nadia Ahmad Samdin also asked about the usefulness of the contact tracing data for criminal investigations. It is understandable that in any investigation, every piece of information is potentially useful and helpful. Our current framework under the CPC has enabled the Police to do their job efficiently and effectively, and Singapore has thus been kept safe and secure.

Let me give a hypothetical example, where we assume a terrorist attack has occurred and Police are trying to prevent more attacks. In such a situation, contact tracing data could be critical information that we could use to identify any other persons involved in the planned attacks and uncover any terrorist ring as quickly as possible. As you can see, when it comes to investigations, time is of the essence. If Police had intelligence and access to contact tracing data that could help stop attacks from taking place, I believe Members in this House would not say no.

Ms Sylvia Lim asked if we can give more than one example that Minister Vivian Balakrishnan had given in his opening speech. With your permission, Mdm Deputy Speaker, may I ask the Clerks to distribute an Annex that I have prepared, containing examples for each of the seven categories of serious offences. Members can go through these scenarios and examples, and ask ourselves: would we really say that the information should not be used by the Police in such situations?

Mdm Deputy Speaker: Yes, please proceed. [A handout was distributed to hon Members. Please refer to Annex 1.]

Mr Desmond Tan: I will let Members of the House read at your own time.

Ms Tin Pei Ling asked about the safeguards in Police’s access to the data. First, while the Criminal Procedure Code, or CPC, specifies that production orders can only be made by officers with the rank of sergeant and above, we, in fact, intend to require the rank of requesting officer for contact tracing data to be higher. All requests for contact tracing data will have to be made by an officer of Inspector rank and above. This is the same level of approving authority for bank data that we request from financial institutions.

Second, within the Police, all requests for contact tracing data must be approved by the Criminal Investigation Department of the Singapore Police Force (SPF), which is the staff authority for all investigation-related matters within the SPF.

Third, the receiving party will only be required to comply with the order to disclose the data to the Police, if it is in relation to a serious offence. Any public sector officer, including Police, who uses or discloses the data for a non-serious offence would have committed an offence.

Lastly, all extracted data will be encrypted and kept in strict confidence. Only authorised officers will have access to the encrypted data. Mechanisms will be put in place to ensure restricted access and to maintain logs on the officers who have accessed the data. And, of course, if the data is used in Court, it will be seen whether the offence does or does not fall within the seven specified categories.

Ms Jessica Tan cited a situation where an individual’s lost token was used to commit a serious crime. As part of an investigation, Police will holistically assess the leads and evidence, including TT data, in cases where this may be obtained. If a person assisting in investigation claims that he had lost his TT token, this will also be looked into by the Police. My advice is that upon the discovery of the loss of the TT token, one should quickly get a replacement at any Community Club, so as not to compromise contact tracing efforts.

My Sylvia Lim asked about my statement in Parliament last month about accessing suspect’s and witness’ contact tracing data. Under the CPC, Police are entitled to access data from anyone. What was meant was that, operationally, in order not to compromise investigations, Police are more likely to approach witnesses first for data, in order not to tip off suspects. In this Bill, Police are empowered to access data from all persons for investigating the serious crimes that are set out in the Bill.

Ms Sylvia Lim also asked why the exact list of offences is not specified. Describing the categories of scheduled offences, rather than the specified offences themselves, is an approach that we have employed in other Acts. For example, the Extradition Act takes a similar approach. The seven categories of offences relating to serious offences that will be obvious prima facie.

On Ms Sylvia Lim's question regarding what is included under the category of serious sexual crimes, only rape and sexual assault with penetration will be covered. It will not cover other sexual assault involving mentally challenged victims. The Police cannot use contact tracing data that fall outside of the seven categories. Should a Police officer make a request, the Smart Nation and Digital Government Office (SNDGO) and MOH would not be permitted to provide the data.

Various Members asked to expand the Police's use of contact tracing data to other offences that are not covered or not included in the seven categories, such as outrage of modesty or offences against vulnerable persons. Indeed, the data would be useful and would assist the Police to solve these crimes. However, we had to make a judgement call on the balance between the two imperatives of public health and public safety that Minister Vivian Balakrishnan talked about.

Outrage of modesty and offences against vulnerable persons are of grave concern to the Police and public but rank below the seven categories in seriousness. This was a very tough balancing act for MHA. Nonetheless, I would like to assure Members that the Police will continue to investigate all offences even though they are not in the seven categories of serious offences.

Ms Sylvia Lim and others spoke about Australia's model. Every country is different. Singapore had to decide what model and what we value. We score exceptionally well on safety and security because of the approach that we have taken and that we have decided on.

I have a graphic here and I will distribute to Members via email at the end of today to illustrate this point – that we are here today, our security situation and safety is a result of the model and decision we have taken in terms of our law enforcement policy.

I am heartened that many Members expressed their support and trust in the Police. This trust and support is very precious to us, which we will guard zealously. I would like to assure Members that the Police will continue to do whatever they can to ensure public safety and to pursue all leads in our investigations.

Mdm Deputy Speaker: Minister Vivian Balakrishnan.

5.32 pm

Dr Vivian Balakrishnan: Mdm Deputy Speaker, Members of this House, let me first express my appreciation for, first, our points of agreement. I believe all of us are agreed – I am looking at the Leader of the Opposition – that we are facing a global life-and-death crisis which requires extraordinary measures. I believe all of us are agreed that contact tracing – effective, rapid contact tracing – is essential as part of our response to dealing with COVID-19.

I also venture that all of us in this Parliament are agreed that TraceTogether and SafeEntry, representing our digital contact tracing tools, have made a real difference to the effectiveness of our COVID-19 response. In particular, I would reiterate that it has enabled us to shorten the period from four days to one and a half days.

Members will know that I am by training and instinct a doctor. I am not a lawyer. I am a doctor. Perhaps one of the defects of being a doctor is that we focus very, very much on the individual – on the health and on the outcomes of the individual. I want to say that so that you understand in context because what I want to do now is to share my personal timeline, through this journey. Let me begin.

We first stated that the Government would use TraceTogether data only for contact tracing simply because this was how and why we designed TraceTogether. I can tell you all categorically, again, as a doctor and perhaps a techno-optimist, that the potential use of the data by the Police did not cross my mind or the mind of my engineers at all. I state that categorically.

In fact, if you think about the features that we built in – encrypted, decentralised data, auto-purging after 25 days, encrypted identities, no GPS, no cellular connectivity – I think any fair-minded person with some appreciation of technology will know that what we had in mind was digital contact tracing. We were not at all trying to create a surveillance tool. I say this so that you understand my state of mind when I said what I said in June.

But what I said in June was wrong because in a sense, my own enthusiasm for the technology blindsided me and I did not read section 20 of the CPC. Because the law of the land, is that the CPC – specifically section 20 – does authorise the Police to access many databases, including contact tracing data.

The next point is – when did I become aware that what I said was wrong? Basically, what happened was at the end of October, I was asked: are you sure that the CPC does not apply, even for a murder case? A member of the public asked me.

When I received that query, I asked my staff – please go and double check. I am not a lawyer but please go and double check what the legal provisions are. At that point, I was informed that the CPC applied and that in fact, the Police had requested TraceTogether data on one previous occasion.

Your next question should be: well, what did you do after that? I will tell you very frankly. In fact, I have shared that in the last month, I had many sleepless nights and I engaged in several rounds of discussion with some of my senior Cabinet colleagues on whether we should carve out and, if we did, how should we carve out the contact tracing data from the application of the CPC.

You will know that my own strongly held view at that point in time was that even if the CPC applied and even if we were going to make data available, we should exercise this with utmost restraint.

I was also aware that I had first made this assurance in this Chamber. I think it was in June in this Chamber. I told my staff regardless of the outcome of this internal review, we will come back here and we will clarify. We did that last month.

Mr Christopher de Souza filed a question. I believe it was in early December – about a month after I commenced this process of internal discussion.

I am sharing this with you so that you understand that there is nothing to hide. The CPC is written law. But I should have been aware and I should have made it clear right from the onset. I have reflected that if in June, I had added four words – subject to prevailing legislation – perhaps we would not be here this afternoon. Nevertheless, it has occurred.

I want to, in the rest of this wrap-up speech, address the different queries, comments and suggestions under three categories: first, trust and participation in digital contact tracing; second, the technical features and safeguards of TraceTogether and SafeEntry; and third, to deal with the specific clarifications of clauses within the Bill.

First, trust and participation. In an ideal world, no mistake would have been made. No question would have arisen. But I am now in a scenario where a mistake has been made and the real question then is how do we maintain trust when a mistake has been made?

I will come back to my instinct as a doctor. The patient-doctor relationship is built on trust. Both the patient and the doctor hope that we will never make a mistake. But mistakes do occur sometimes, usually rarely. The most important ingredient in that trust relationship between a doctor and a patient is complete transparency – that if anything goes wrong, I will tell you and if anything needs to be fixed, I will do so, and I will go all out to remedy the problem if I can humanly do so.

My answer to this question today – how do you maintain trust when a mistake has been made – is actually quite straightforward. Acknowledge the error. Take full responsibility.

It is no different from a complication in surgery. Acknowledge the error. Take full responsibility. And I have done so.

Next, do the right thing rather than choosing the politically expedient option. You know I believe in transparency even if transparency is awkward and politically costly. But it is better to be transparent than to double down on a mistake. You see my point here? Better to be transparent, fix the error rather than to double down on your mistake.

One further principle from my medical practice is beware of false dichotomies. The false dichotomy I have heard today is that you have to choose between saving the life of a child and you have to choose between participation in digital contact tracing.

I believe by being completely open, transparent, answering every question, explaining and letting people see the purpose behind what we are doing and why we are doing it, I believe we can avoid this dichotomy. I believe it is possible for us to continue to have perhaps the world's most successful contact tracing programme; and at the same time, deal with people's expectations that Singapore will remain safe and secure. And that the Police are our guardians, our protectors. And that the Police have acted at all times strictly within the ambit of the law in order to fulfill their higher mission to protect us.

Today, I come before this House, moving legislation on a Certificate of Urgency to give legal force to the statements that the Minister for Home Affairs and I made in Parliament last month.

This Bill ensures that personal digital contact tracing data can only be used for contact tracing, with a narrow exception for investigations and criminal proceedings in respect of seven categories of serious offences.

I know there can be some debate. In fact, there has been some debate how specific are our definitions. Should we enlarge it? Should we constrict it? I think that is legitimate debate. But I believe that this Bill reflects the right balance between restricting the use of personal digital contact tracing data and, at the same time, enabling our Police to fulfil their duty to keep us safe – avoid false dichotomies.

I will just reiterate a few scenarios which you would have, in fact, in the annex in front of you. If the next of kin of a murder victim asks the Police, "Please decrypt the TraceTogether data on his phone", would any of you refuse? If the parents of a kidnapped child found the token and desperately asked the Police to unlock it, which one of you would refuse? If a terrorist act is imminent, would you tie the hands of our Police and security forces? I believe I know the answer to these questions, and, certainly, the majority of Singaporeans outside this House.

Singaporeans understand the need for Police to lawfully access information and I believe that public trust in our Police Force remains high, very high. And as Foreign Minister who has had to travel to many parts of the world, this confidence and trust is a huge competitive advantage that Singapore has.

On the question of public trust and public participation, let me, in a rather limited way, share some numbers with you. You know that for TraceTogether, we give people the option of writing in to say, "Please delete my data". In the last one month, we have had 350 individuals who have asked us to delete their data – 350. Every one of that 350 who has requested us to delete is a source of regret for me. At least 350 have, for a variety of reasons, decided to forgo the protection that TraceTogether offers them and their loved ones. But on the other hand, in this same period, in this same one month, over 390,000 have come onboard the TraceTogether programme.

I do not want to belabour this but my simple conclusion or inference is that Singaporeans know that I misspoke but they also trust the TraceTogether system is safe, it does what it is supposed to do, it protects public health, and they also trust the Police to always behave lawfully.

Members also had questions on the features and safeguards of TraceTogether and SafeEntry. Let me quickly try to run through as many of these clarifications as possible. Mr Louis Ng, and I think Mr Pritam Singh as well, asked whether it has affected our adoption. I have just given you some figures on people who have signed on in the last one month.

But I will also accept the point that Mr Louis Ng made, and I think Mr Gerald Giam made as well, that there may be individuals who are gaming the programme. You switch it on in order to do your SafeEntry and then you promptly switch it off. I think Mr Louis Ng also asked whether we have more granular data into how people are using the tokens and using the TraceTogether app.

Today, more than 80% of Singapore residents are onboard the programme. Based on broad proxies, and I say proxies, and I will explain why it is only a proxy, but based on broad proxies, we estimate about 58% of users use the app at least once a day. This proportion has remained the same before and after the parliamentary clarification in January.

Mr Ng also asked if we could provide more granular usage statistics, such as whether the mobile devices with the applications were on average pinging fewer devices than before. And, Mr Ng, I have to tell you, actually, the privacy-respecting nature of the system means we actually cannot collect that level of granular data to track active usage. The data is stored locally on your own device. The TraceTogether app only connects to the server periodically, only to download information. Some Members would be familiar – occasionally, when you have checked into the same place as someone else who has turned out to be COVID-19-positive, that message may light up to warn you that there may be a potential overlap in time and space between you and the COVID-19-positive patient.

The point I am making is that, again, it reveals the privacy by design that we focused on in rolling out this programme. I want to remind everyone that TraceTogether is meant to protect us and our loved ones. The effectiveness of TraceTogether depends heavily on the rate of user participation. For those who switch off your Bluetooth or your app or engage in other forms of technical wizardry, I would just ask you why deprive yourself and your loved ones of the protection?

Again, as Foreign Minister, I have looked round the world and one of the reasons why we are better off is that we have not politicised our response to COVID-19. I am grateful to Mr Singh and the Workers' Party that, unlike in other countries where wearing a mask or not wearing a mask is a badge of political identity, we have avoided that kind of political dichotomy.

So, for people who are angry or disappointed at my mistake, you are entitled to do that but do not deprive yourself and your loved ones of the protection from this system.

Ms Nadia Samdin asked a few suggestions regarding OpenTrace, and she asked if we would continue to make OpenTrace open-source such as by introducing open-source licences and regularly updating the GitHub repository. Actually, my engineers will know that I have been leaning on them repeatedly to keep updating the GitHub repository. But, again, those of you who are actual programmers will know it is a very big slog to tidy up your code and prepare it for public open-source perusal. But we believe in open-sourcing OpenTrace, it has served us well, it has been helpful, it has allowed experts to look at both OpenTrace and TraceTogether, and for them to conclude that the app does and continues to do what it is supposed to do, and to do so in a privacy protecting manner.

Other governments have looked at our code base including Australia, Alberta, Poland. We have had discussions at the technical level. They have modified it, used it, changed it; we are completely open about that.

To be clear to Ms Nadia Samdin, there is already an open-source licence. The OpenTrace repository is published under – sorry, to get technical here – a GNU General Public Licence Version 3.0. Those of you in the know will know that this is an open-source licence. The Standard General Public Licence 3.0 terms are also within the repository itself in a licence and markdown file, as is the standard practice, and maybe Ms Nadia Samdin can check on that after this. But I will convey your suggestions to the GovTech team and discuss what our next steps are for open-sourcing.

Ms Nadia Samdin also asked if we would commit that TraceTogether data will always be stored on the user's device and shared with MOH only when the user uploads the data, and to delete the data at the request of the user. By design, TraceTogether data will be stored in the user's device before it is shared with the authorities. Again, for those of you who have ever been in the circumstance where you need to share it, you know that your participation is needed. We send you a PIN, you have to enter the PIN before the data is uploaded.

This Bill limits the Government's use of TraceTogether data to the purposes of contact tracing with the exception, as I said earlier, for investigations and criminal proceedings in respect of serious offences, and it applies regardless of how the data is accessed or shared. The same applies for the suggestion on deleting the data upon request. Users can do so and we have done so, as I shared just now; we have deleted data for 350 persons in the last one month.

But in certain cases, for instance, where the data has already been uploaded because there was a positive COVID-19 case, then MOH will have to retain that data as long as that cluster is active and they need it in order to break the chains of transmission. I am sure Members of this House will understand the need for that.

Mr Gerald Giam asked about the Police's use of SafeEntry data. I believe the Member did ask just now. I am not privy to the operational details but I do understand that SafeEntry data has been used for investigations into offences in a number of instances. I must state for the record that my previous assurances were on TraceTogether in this House and not on SafeEntry. Nevertheless, we have decided in this Bill to envelope SafeEntry and BluePass insofar as it interoperates with TraceTogether within the same protective cocoon that this Bill provides.

It is also worth reminding Members of the House that, actually, SafeEntry is a digital visitor log. It is no different today. If it was not there, the Police would go to the security guard, say, of your condominium and say who has come in at what time, which car numbers were in here, look at your video surveillance. SafeEntry actually, in that sense, is not novel compared to TraceTogether. But it is different in the sense that it is a centralised database. Therefore, we decided we better take pre-emptive action to put the same cocoon of legislative protection around it.

Let me now move on to clarifications on the legislative amendments themselves, and I hope Members will bear with me if some of this is a bit technical.

Ms Nadia Samdin asked if an individual would be able to access their own personal contact tracing data including if one is being charged for a serious offence. The answer is yes. Members of the public can request for their own data for legitimate purposes as is the current practice today. The lawyers looking at the text of the Bill will realise we have been very careful not to circumscribe the rights of the individual to his data.

I believe Ms Sylvia Lim asked if suspects and the Defence Counsel could access the personal contact tracing data for their Court cases and whether the time period of 25 days is sufficient to retain the data for such users. The Bill circumscribes the use of personal contact tracing data by public sector agencies, but I will reiterate, does not prohibit individuals from using or requesting for their own personal contact tracing data provided they have a right to access such data. For serious offences, the individual can share his or her own data with anyone including the Police, the prosecution, the Defence Counsel and offer his or her data to the Court as evidence.

If the Prosecution is in possession of contact tracing data which strengthens the Defence's case or weakens the Prosecution's case, the Prosecution has to disclose such data to the Defence to comply with its common law disclosure obligations laid down by the Court of Appeal. I believe this is known as the "Kadar disclosure obligations". Again, the criminal lawyers here will understand what I am talking about. This is in the Bill – specifically, section 82(7) allows for individuals to continue to have access to personal contact tracing data if they have such a right of access under any "rule of law or otherwise". Mr Singh, you can confirm that clause.

The right of access under "any rule of law" here includes the Kadar disclosure obligations.

Ms Tin Pei Ling asked if TraceTogether data could be used in missing persons cases. A next of kin – father, mother, husband, wife – a next of kin may request the data of a missing person to the extent permissible today. This includes requesting for personal contact tracing data of the next of kin, if they have a right to do so.

Mr Gerald Giam also asked if personal contact tracing data uploaded to MOH servers would be covered by this Bill specifically by section 82. The answer is yes. The Bill restricts the Government's use of personal contact tracing data collected from digital contact tracing systems specified in the Sixth Schedule.

Mr Zhulkarnian Abdul Rahim suggested having a dedicated channel independent of the Police to investigate any complaints of TraceTogether data access breaches made by any party.

If you peruse the Bill in front of you, you will realise that disclosure or misuse of contact tracing data on contravention of the COVID-19 (Temporary Measures) Act will be investigated by authorised persons from the Government Data Office appointed under this Act. These authorised persons would be appointed by Senior Minister Teo Chee Hean as the Minister overseeing this part of the Act. So, there is a clear separation of roles and duties.

The Government Data Office will oversee the public sector data governance policy and requirements, similar to what the PDPC does for the private sector. And I can give this assurance that Police officers will not be appointed for this purpose.

There were also other questions pertaining to data governance for personal contact tracing data. It was Mr Yip who asked whether Police would still be able to request the data beyond the 25-day mark, and if the data will be stored for more than 25 days, should it be required by Police for investigations and proceedings into serious offences. I think it was also Mr Giam who asked if Police will be able to access the data when the pandemic has been declared over.

In general, the Police will not be able to obtain data if the request comes in after the 25th day mark and this is because the data would have been auto deleted, either deleted on your personal token or app or deleted from the main server. There are some exceptional scenarios. Nowadays, I am very careful with all my caveats. There are some exceptional scenarios where the data may be stored for more than 25 days.

One, when the data relates to a COVID-19 patient or an individual who is closely associated with the patient, and the data is used for active contact tracing purposes. And I think that, people will accept this is a legitimate use of data beyond the 25th day.

Two, when the data has been used for investigations or criminal proceedings in respect of serious offences; the data may be retained until the investigation or criminal proceedings are over, including Court proceedings, I must add, and will be deleted when the data is no longer needed.

The same applies to when the pandemic is being declared over. And then we can happily stand down our digital contact tracing programmes.

As I mentioned in my opening speech, subsection 82(8) provides for the Minister to specify a date after which digital contact tracing system is no longer required to prevent or to control the spread of COVID-19. The data administrator must then delete any personal contact tracing data which is no longer required.

Police will not be able to use any personal contact tracing data unless the data had previously been retained and used for investigations of criminal proceedings in respect of serious offences.

Ms Nadia Ahmad Samdin asked if the Government would consider publishing disclosure reports to help the public understand how the data is being used. We will accept Ms Nadia’s suggestion to have a report disclosing the use of the data beyond contact tracing. My team will work out the details on how often and the contents of these reports, but it should broadly encompass the types of data, how the data was used, as well as the number of occasions that the data has been used for purposes other than contact tracing from the day that this Act comes into force.

Ms Nadia Ahmad Samdin and Mr Gerald Giam asked if it was possible for us to specify the conditions for the life cycle of the TraceTogether programme, such as the conditions to decide when it should be deactivated.

Actually, this is a much wider question – what determines the changing points in the pandemic and what determines the end of the pandemic? Our approach has to be guided by science and public health. We will monitor the overall situation closely, consider all relevant factors before adjusting our measures, as we have indeed in the last one year with our three phases of re-opening since the circuit breaker.

In other words, there is no rule book. There is no standard play book that we can rely on. We will have to respond to the situation as it evolves.

And this approach has served us well, and we should continue to abide by this considered approach in determining the end of the pandemic. Even now, we know that the pandemic has been very unpredictable. Many places that previously contained their initial infections, are now dealing with second, third, fourth waves. New variants have emerged, some more transmissible, some even more lethal. Whether and when we can revert to normal will really depend on the global situation, not just the situation within Singapore and this is the nature of infectious disease epidemics.

Lastly, Members expressed a wide variety of views on the types of offences which Police ought to use personal contact tracing data for investigations or criminal proceedings. Some of you suggested expanding the list, some to include additional offences. Mr Vikram Nair, I believe, said that he preferred not to have any carve-outs. He said that this would be tantamount to saying that the Police should not look at all available information in pursuit of their investigations. Mr Sharael Taha, Ms Tin Pei Ling, Mr Alex Yam and Mr Christopher de Souza expressed concerns that the passage of this Bill may set a precedent for how the Government may use data collected by digital solutions in the future, and hamper the Government’s ability to function effectively. Mr Pritam Singh, in his considered speech, also referred to the future and what impact these decisions may have.

I want to say that our decision today to only include serious offences, to tightly scope the use of personal contact tracing data is a result of a delicate balance between the right to public health, the right to public security and respecting the sensitivity of personal data during this extraordinary time.

Mdm Deputy Speaker, this Bill is being tabled and read on a Certificate of Urgency in exceptional circumstances. It is intended to deal with the specific issue of the Government’s use of personal data collected via digital contact tracing systems in the midst of an emergency.

We have taken this exceptional step because we need to focus on encouraging public participation and maintaining confidence in our public health measures. This Bill is about ensuring maximum support from the public in our fight against COVID-19.

I want to stress this Bill is not a precedent. It is not in the public interest to deny the Police access to the data necessary to ensure public safety and the proper conduct of justice.

The nature of the legislation which this House is called upon to consider today is sui generis. It is a piece of legislation introduced during a public health crisis, being moved under a Certificate of Urgency, because of the situation that we are in. We are not trying to set a precedent here today.

Privacy and data governance, especially, in the face of accelerating technological revolution, these are broad and complex issues, which I think Mr Singh also recognises, that need careful contemplation, consultation and open debate. This should not be settled on a Certificate of Urgency in one day. There will be proper occasions in the future to do this.

Mdm Deputy Speaker, our response to COVID-19 has not been perfect, but it has been effective. This current state of affairs did not happen by chance. It is due to our concerted efforts on multiple fronts – our excellent healthcare system, our heroic frontline officers, our extensive testing capacity, our effective contact tracing regime that has enabled us to quickly identify, isolate close contacts, truncate transmission.

Most of all, it is because of our social capital, the sacrosanct trust of our citizens and the collective responsibility that we have for one another. Madam, I beg to move. [Applause.]

Mdm Deputy Speaker: Mr Pritam Singh.

6.12 pm

Mr Pritam Singh: Thank you, Mdm Deputy Speaker, just a few follow-up questions for the Minister.

The first being the Minister's revelation that he came to the knowledge that section 20 of the CPC would apply, from end October onwards. I am just reviewing the articles in our newspapers of record, The Straits Times, from end October right through early November. A number of representations made by various Ministers nothing suggested that the Government was going to make the revelation that the Minister shared in early January clear that section 20 of the CPC would apply. That actually came end October, a good two months later.

Can I ask the Minister what was the Cabinet deliberating, if that was an issue with regard to the Cabinet? Or what caused the delay in coming to a landing on the time and by when the Government will make things clear to Singaporeans?

The second question I have pertains to a figure that Minister gave in his speech – 58% – and correct me if I am wrong, Minister, because I may have misheard you and I apologise for that. Fifty-eight percent turned on their TraceTogether at least once a day. I believe that is what Minister said. The question actually that I asked and I think a few other Members asked was whether the Government or the Smart Nation Office or GovTech is able to track when people switched off their TraceTogether application. Because that really is the key because if for some reason people are not confident, then we have got a problem on our hands.

So, how is it that the Government is able to track when people switch on their phones at least once a day, but for some reason is not able to find out when people turn off their phones?

The third point I think is not specific to Minister's speech. It is the Parliamentary system of Government we have here. The Opposition asks questions of the Government. The Government makes its position known. And I know there are individual Singaporeans outside of this House who are concerned about the privacy issues and so forth. I would just like to advise everyone, well, not everyone but those who are not comfortable with the Government's replies – all of us in the WP, as I know, have downloaded TraceTogether.

As of now, they are 31 to 35 TraceTogether devices around me and 4,306 total exchanges today. So, I would like to share with Singaporeans to please download the app and use the token, because it is the safety of the entire community that is at stake, insofar, as COVID-19 is concerned. Whatever concerns that are there that you wish to raise, I am sure your parliamentarians will bring them up in Parliament and certainly the Opposition in Parliament will do so.

Dr Vivian Balakrishnan: I thank the Leader of the Opposition for his vote of confidence and his advertisement of his use of TraceTogether.

Let me deal with the first two questions. At the end of October, when I was asked, basically, what did I spend November doing? As I said, double checking the legislation and then having, among sleepless nights and conversations, asking: "Do we carve it out? How do we do it? What should we do?" So, that occupied us in November. Mr Christopher de Souza filed in December and I thought it was right that we should answer it in Parliament.

If I could replay, if I could rewind time, I would not even have made this mistake in June. And I would also say if I could replay, I would also have looked for an earlier occasion to explain all this. But the key point which I am trying to make, is that there was never any doubt in my mind that we would clarify, that we would explain and we would be held accountable and that I would take responsibility. That is the way we operate.

And for myself having been being in this Chamber now for almost 20 years, the older Members will know, I have always operated that way. Mistakes, warts, misunderstandings, misspeak – I have never shied away from clarifying it. So, I am grateful to you. I think it was last month when you said you accept in good faith my explanation. So, never any attempt, to shy away from transparency and from reflecting the mistake.

On the second question about why I said 58% switch it on at least once a day. Again, if you look at your app, and if you see somewhere about the upper third, it will probably say you are okay. What it does in order to tell you whether you are okay or not, is that it has to query a central server as to whether the SafeEntry check-ins that you have done, have overlapped in time and space with someone else. If you have, then some of you may receive a slightly more worrying message to say that this has happened. If you have symptoms, please see a doctor and please get tested.

Now, of course, if we have identified you as a close contact on the basis of Bluetooth proximity data from TraceTogether, you do not need to wait for that message, we will call you, and test you and isolate you, if necessary.

But anyway, to come back to that question of, "How come you know I am on but I do not know when you are off". So, I know you are on because you have actually queried the database to check whether your journeys overlapped with someone else who may have been positive. But I do not know when you switch it off or when you, as Mr Gerald Giam has mentioned, put it in a Faraday Cage. I do not know that, precisely because of the privacy respecting design of the system. This also relates, although you have not asked it, to the question about how useful is TraceTogether data for Police investigations.

And again, I would reiterate my explanation that, by its very design, you know I was not designing a surveillance system. So, you can make a reasonable argument that therefore most times, it is not going to be very useful. Because it was never designed for that purpose. But the reason why I am still coming to this House and still asking for this carve-out for the seven categories of serious offences, is really about a value statement – to say that for these types of situations, you do not believe in tying the hands of your Police Force unnecessarily.

And for those of you who have served in the Police Force – Ms Sylvia Lim has, I believe, been a Police officer, Mr Murali has been a Police officer and Deputy Prime Minister Heng has been a Police officer – you will know that when you are investigating any leads, indirect, circumstantial or otherwise, may be relevant. And even if you do not identify the suspect, it may help you identify a witness.

So, what we are saying, in moving this Bill, is that, at least for these seven categories of serious crimes, let us agree not to tie the hands of our Police Force. And I am grateful to you and to the Workers' Party for saying you support this Bill.

Mdm Deputy Speaker: Mr Leong Mun Wai.

6.21 pm

Mr Leong Mun Wai: Mdm Deputy Speaker, thank you for the opportunity to make some clarifications and also to explain the position of Progress Singapore Party. Please allow me some time to do that.

Mdm Deputy Speaker: This is for clarification, please.

Mr Leong Mun Wai: Do you mean I am not allowed to —

Mdm Deputy Speaker: You can clarify but please keep it succinct.

Mr Leong Mun Wai: Okay. Since PSP is not going to support the Bill, I think it is our responsibility to explain to this House and to Singaporeans, our position further. We thank the Government —

Mdm Deputy Speaker: Sorry, this is seriously for clarifications for the Minister. Not for you to make another speech.

Mr Leong Mun Wai: Okay, in that case, maybe I would like to ask the Minister that in deciding the trade-off, very often, he brought up the example of one victim of the seven serious crimes; maybe a victim of one of the seven serious crimes. But when we are making a trade-off as leaders of the country, do we not actually think of both sides? It is about one victim versus thousands of possible drop-outs from the TT programme.

Of course, I accept the explanation that he has done with regard to he does not think there is an effect on that. I would like him to clarify, what does he think about that approach to making the trade-off, which is the approach that PSP has taken.

Mdm Deputy Speaker: Minister.

Dr Vivian Balakrishnan: Mdm Deputy Speaker, that is why I referred to false dichotomies. In contrast to you, the Workers' Party – in my view and I hope you let me speak for you – has taken the more responsible position, that so long as you can envisage certain extreme, certain serious offences, for which you need to make an exception, then this Bill, with its current construction, is necessary.

In fact, if you vote against the Bill, then the status quo applies and the status quo is that the CPC has licence over this data as well.

So, I would still appeal to your good sense and your sense of responsibility to the nation to do the right thing. I believe it is possible. And give credit to Singaporeans. Singaporeans care, Singaporeans do look out for one another and Singaporeans will also accept that mistakes are made, but as long as you come clean and you explain why you did something, and you can convince them, and slowly step by step, win confidence, we can avoid these false dichotomies.

That is why I stand here completely confident that we are doing the right thing. It is not the politically expedient thing. It is not the convenient thing for me personally, politically, but it is the right thing.

I thank the Workers' Party for standing with us in doing the right thing in the midst of a crisis. I hope PSP can do likewise, but that is your decision.

Mdm Deputy Speaker: Mr Leong, I think you have made your point already. No more clarifications?

Question put, and agreed to.

Bill accordingly read a Second time and committed to a Committee of the whole House.

The House immediately resolved itself into a Committee on the Bill. – [Dr Vivian Balakrishnan].

Bill considered in Committee; reported without amendment; read a Third time and passed.