The TraceTogether mobile application to aid contact tracing has been in the news lately, due to its low takeup rate of 25 per cent. Some experts have suggested that the app could be packaged with commonly used digital systems such as SafeEntry or even the Grab app.

Others have suggested that the Government make downloading TraceTogether mandatory, especially since the circuit breaker will end on June 1.

A similar relaxation of lockdown measures in South Korea earlier this month saw the immediate emergence of a new cluster of more than 130 infections in Seoul, reportedly caused by a single individual.

This resulted in the Seoul municipal government closing entertainment venues again and postponing the reopening of schools by a week.

We cannot completely rule out a similar scenario in Singapore, and TraceTogether can play a vital part in supporting existing methods of manual contact tracing, allowing health authorities to more efficiently trace and alert potentially infected individuals.

However, a key factor in TraceTogether’s effectiveness is widespread adoption. A study done by Oxford University’s Nuffield School of Medicine found that contact tracing apps helped curb the spread of the coronavirus in a simulated city —  but only if 60 per cent of the city’s population use it.

Nearly 13 per cent of Singapore residents had installed TraceTogether in the three days following its release in March.

The overall rate of adoption has largely plateaued, but it stands to reason that for the app to function effectively, the rate of installations still needs to rise significantly. The question is how to convince more residents to do so.

The most compelling way to do this may not have anything to do with the app, but with how the Government signals its acknowledgment of its responsibilities as a custodian of public data.

This is not to say that there have not been complaints about TraceTogether itself. It has been widely reported that the app is battery-intensive and intrusive within both the iOS and Android user interfaces.

More commonly, however, concerns are often raised regarding what kinds of data the app collects, and for how long it is stored.

TraceTogether’s design team has stressed that only mobile number data is stored to facilitate contact tracing by the Ministry of Health, and that the app otherwise only communicates via Bluetooth with nearby phones which have the app installed.

Records of these interactions are stored on user devices and not in a central server.

Notably, the TraceTogether design team was called upon to respond to queries by a local privacy-minded hacktivist regarding the integration into TraceTogether of a government data collection platform, near the time of the app’s initial release.

The platform transmitted information such as user Internet Protocol addresses, device types and carriers.

Legitimate concerns were raised that this meant the TraceTogether app was transmitting information that could be used to identify and locate users without their consent.

TraceTogether’s design team removed the platform from TraceTogether’s code, purged data the platform had gathered and clarified that its inclusion had been a mistake — demonstrating a laudable responsiveness and transparency in the face of public scrutiny.

The TraceTogether team has also consulted with Apple and Google on their newly released Exposure Notification application programming interface, which can be integrated into the TraceTogether app to make identifying users more difficult — such as by encrypting all Bluetooth metadata transmitted by the app.

However, neither explanations of how the app works nor steps taken by the TraceTogether team to address privacy concerns have resulted in increased adoption of the app, or greater trust in the Government’s intentions.

The solution to this needs to go beyond the app itself.

The act of surrendering information has always been uncomfortable — even in a nation like Singapore where trust in the Government is high.

A KPMG survey on consumer data privacy undertaken in 2016 found that 70 per cent of Singaporean respondents worried about what happened to their personal data when they made online purchases.

It should also be recognised that there have been grounds in the past to doubt the integrity of public data security. The SingHealth data breach in 2018 notably resulted in personal data belonging to 1.5 million Singaporeans being stolen.

Other notable security breaches include the exposure of the personal information of 800,000 blood donors online and the leaking of the national HIV registry, both of which occurred just last year.

These hacking incidents continue to loom large in the memories of many privacy-minded individuals concerned not only about how much private data the Government has access to, but also if it can protect that data once it is in its care.

Neither of these factors is a sign that trust in the Government is irreversibly damaged, or that Singaporeans are unmovable on data issues.

Despite their feelings about online purchases, a survey conducted earlier this year by consulting firm Oliver Wyman found that 50 per cent of Singaporean respondents were willing to share individual mobile location data to help track the spread of illness —  the highest of any country.

This, along with the initial uptake on TraceTogether, should signal to the Government that Singaporeans are willing to cooperate on this issue.  

What this situation presents is an opportunity for the authorities to take action in addressing citizens’ concerns about privacy and security.

A key step would be introducing into law regulations like what Australia’s Senate passed last week with its Privacy Amendment (Public Health Contact Information) Bill, which directly addresses data collected through its CovidSafe app that is based on TraceTogether.

This bill, also known as the CovidSafe bill, proposes that any unauthorised collection, use or disclosure of data gathered with the CovidSafe app is punishable with five years of jail time.

It also restricts use of CovidSafe app data to health officials and data store administrators.

The CovidSafe bill signifies to the Australian people their government’s determination to protect data acquired from the use of the CovidSafe app, above and beyond the ordinary regulations set out in the country’s Privacy Act.

Installations of the CovidSafe app spiked the day the bill was announced.

Singapore could take a similar action and introduce legislation specifically governing the TraceTogether app. 

These could introduce specific stipulations governing data gathered using TraceTogether and instate penalties exceeding the three-year jail terms currently mandated for misuse of data by the private sector under Section 56 of the Personal Data Protection Act.

The Government could even take a step further and implement measures the Australian bill does not. It could legislate that any data collected using TraceTogether in the course of contact tracing must be deleted after a period of say, six weeks.

Regular purges of data would build confidence that the Government is dedicated to safeguarding privacy and reducing the risk of data breaches.

This duty of custodianship will continue to remain relevant as Singapore embarks on further whole-of-government initiatives to promote data-intensive industries such as Artificial Intelligence.

Now is precisely the time for it to demonstrate an awareness and empathy for the concerns of those whose data it will use to pave the way forward.

ABOUT THE AUTHOR:

Gareth Tan is a research analyst at TRPC, an information technology consulting and research firm. These are his own views.