Singapore is the first in the world to roll out an app to reduce the tracking time of potentially infected individuals amid the Covid-19 pandemic.

However, TraceTogether, which was launched in March, has so far not been able to do what it was designed for.

One thing stands in the way: citizens' unwillingness to use it.

Even in tech-savvy Singapore where trust in government is high, only 1.1 million people, or less than one-fifth of the population, have downloaded the app.

It is 3.2 million shy of the minimum downloads required for the tool to be truly effective in digital contact tracing. National Development Minister Lawrence Wong, co-chair of the multi-ministry task force on Covid-19, previously put the minimum figure at at least three quarters of the population.

It is puzzling why Singapore has not taken advantage of the Government's exclusion from the Personal Data Protection Act (PDPA) to exercise the needed decisiveness in this virus outbreak.

Many have asked whether the concept of voluntary smartphone tracking still holds during a public health emergency. They wonder if more would be done to get the much needed personal data to break the chain of infection.

ACCURATE INTERACTION LOGS

TraceTogether is crucial in plugging a data gap in contact tracing.

Finding potentially infected individuals could take days as human contact tracers need to jolt the memory of Covid-19 patients to identify people who have been in close contact over the 14 days prior to the onset of symptoms, and make calls or go door to door to reach these people.

Although footage from the thousands of closed-circuit television (CCTV) cameras installed islandwide has been useful in mapping the infection path and finding those at risk, what is still lacking today is an accurate log of all interactions. People forget who they met and do not have contact details of strangers they spoke to.

Enter TraceTogether, which logs smartphone users' interactions by exchanging Bluetooth radio signals between nearby phones. The app also collects the mobile numbers of individuals and stores them centrally for contact tracing.

The app has the potential to collect more data, such as location details, to quickly identify where infected patients have gone and warn others to stay away.

COMPULSION NEEDED

If there is a lesson to be learnt from the inadequate response to TraceTogether, it is that people will not give up their data willingly even in a public health emergency. A degree of compulsion is needed.

South Korea learnt the lesson in 2015 during the Middle East respiratory syndrome outbreak, when it recorded 186 cases, the largest number outside the Middle East, and 38 deaths. After that, it created new laws to empower infectious diseases investigators to access personal data.

Even though South Korea's Personal Information Protection Act places strict requirements on all organisations when collecting and using citizens' personal data, an exemption is made for public interest purposes, such as in infectious diseases investigations.

The exemption helped the South Korean authorities access granular personal data such as credit card transactions and mobile phone location records from banks and telcos for data analysis.

Combining such intelligence with CCTV surveillance footage, it was able to swiftly identify and isolate potential cases early. It was also able to publicly share confirmed patients' travel history to help other citizens stay safe.

South Korea, once with the second-highest number of coronavirus infections, was able to flatten the infection curve in just two months.

Comparatively, Singapore is still registering hundreds of new infections daily, with the number of Covid-19 cases crossing the 16,000 mark yesterday.

SAFEGUARDS NEEDED TOO

Singapore's approach is puzzling in that its Infectious Diseases Act empowers contact tracers to get the TraceTogether data logs from users' phones. Yet the authorities have not made it compulsory to use the app.

Could it just be a matter of time?

The health authorities could work with local telcos to push TraceTogether into smartphones on an opt-out basis.

Access into supermarkets or buildings could also require people to flash the app on their phones. This would be similar to NRIC checks to control crowds at four popular wet markets here, in Geylang Serai, Yishun Ring Road, Marsiling Lane and Jurong West - a measure in place since April 22.

Government agencies' broad exemption from the requirements of the PDPA - which include obtaining consent to collect, use or disclose personal data - provides a clear pathway to more digital surveillance.

Said privacy and technology lawyer Bryan Tan of Pinsent Masons MPillay: "From a legal perspective, implementing digital tracking is easier here compared with in South Korea, which has some of the world's strictest privacy laws."

Moreover, Singapore is not a stranger to control measures.

All Ministry of Defence and Singapore Armed Forces personnel must download the SGSecure app, launched in September 2016 to allow citizens to receive emergency broadcasts and report suspicious incidents or objects left unattended in public places.

State surveillance is also not new here; CCTV cameras are ubiquitous and there are plans to turn lamp posts into smart fixtures that can analyse faces and match them against databases.

That said, more digital tracking must be accompanied by more transparency over how data is used, and better safeguards against leaks and misuse.

The spate of public sector data breaches over the last two years might not have inspired public confidence. Notable cases include leaks of the data of 800,000 blood donors last year and 1.5 million SingHealth patients in 2018.

"Trust is something to be earned and maintained," Mr Tan added.

Still, compulsory digital tracking may be inevitable if the number of Covid-19 cases remains high, or if people continue to disregard social restriction measures.

Indeed, the authorities have shown that new laws could be fast-tracked in one day to tackle the virus outbreak head-on.

Take the Bill for the Covid-19 (Temporary Measures) Act 2020, which prohibits any social gathering and restricts business operations during the circuit breaker that began on April 7.

The Bill was read and debated on April 7 before being passed on the same day, with rule breakers facing up to six months' jail or a $10,000 maximum fine, or both.

So far, more than 2,000 people have been fined for breaching safe distancing rules, including not wearing a mask when out.

Mandatory digital tracking on smartphones will provide the most effective tracking as people are so attached to the devices.

It is a drastic measure, but so are social distancing rules, NRIC checks and social gathering bans.

There may not be two ways about fighting Covid-19: Keep your privacy and the partial shutdown is prolonged, or lose it and you may see punishing bans on social gatherings and non-essential businesses be lifted sooner.