Tougher penalties than prevailing laws in Bill to restrict TraceTogether data use

PENALTIES for the unauthorised use or disclosure of personal contact tracing data will be more severe than in prevailing laws governing public sector data, under an amendment Bill introduced in Parliament on Monday.

The Bill amends the Covid-19 (Temporary Measures) Act, to formalise the government's earlier assurances that TraceTogether data may be accessed by the police only for specified serious offences.

It also adds the formal provision that after the pandemic ends, public agencies will have to delete all collected personal digital contact tracing data, as soon as reasonably practicable.

Currently, the Criminal Procedure Code empowers the police to obtain any data under Singapore's jurisdiction for criminal investigations. The amendment Bill, which supersedes other laws, will restrict this.

It states that personal data collected through digital contact tracing solutions can only be used for contact tracing, except when such data is needed for criminal investigation or proceedings related to "serious offences".

Seven such offences are specified, and this list of offences can only be amended with parliamentary approval.

Unauthorised use or disclosure of personal contact tracing data will be punishable with a fine of up to S$20,000, imprisonment of up to two years, or both.

This is higher than under the Public Sector (Governance) Act, where unauthorised disclosure and improper use is punishable with a fine of up to S$5,000, imprisonment of up to two years, or both.

The Bill also specifies the digital contact tracing systems to which it applies: TraceTogether; SafeEntry; and BluePass - a device developed by the private sector and used by workers in the construction, marine shipyard and process sectors - where interoperable with TraceTogether.

More systems can be added to this list with the law minister's approval, such that the use of data from such systems will be similarly restricted, but parliamentary approval will be needed to remove any system from the list.

The Bill was introduced under a certificate of urgency, allowing all three readings to take place in the same sitting. The second reading debate on the Bill will take place on Tuesday.