Safeguarding of Personal Data Collected by Contact-tracing Apps

Mr Murali Pillai asked the Prime Minister what steps has the Government taken to ensure that personal data of persons collated through apps such as TraceTogether for the purposes of contact tracing to contain the spread of COVID-19 will be protected and not used for any other purpose.

The close contacts data gathered by TraceTogether will be stored only on the user’s phone in the first instance, and accessed by MOH only if the individual tests positive for COVID-19. It will only be used for contact tracing. Safeguards, including encryption, are in place on the user’s phone to protect this data from malicious hackers. Data older than 25 days will be automatically deleted from the phone. If the close contact data on the person’s phone is required for contact tracing, only a small group of authorised individuals in MOH would be able to see the patient’s personal data. All public sector data protection rules will also apply to the data transferred from the user’s phone to MOH, including abiding by the recommendations of the Public Sector Data Security Review Committee.