Installing TraceTogether-Only SafeEntry: Guide for Businesses

As Singapore moves towards its endemic phase of COVID-19, more citizens will be out and about – this makes contact tracing all the more important to control the spread of COVID-19 in Singapore.

If you are a business owner of a physical store, it is likely that you have to implement TraceTogether-only SafeEntry contact tracing measures for every customer and visitor to your premises.

This article will inform you of:

• What is TraceTogether-only SafeEntry
• How you can use TraceTogether-only SafeEntry to collect personal data for contact tracing purposes
• Whether you must ensure that all visitors check in to your venue with TraceTogether before allowing them entry
• What you can use the collected personal data for
• Whether you need to notify visitors that their personal data is being collected

What is TraceTogether-Only SafeEntry?

TraceTogether-only SafeEntry entails visitors using the TraceTogether App or token to check-in at business venues. Such SafeEntry check-ins require the collection of personal data of visitors for contact tracing purposes.

If you are unsure whether or not it is mandatory for your venue to implement SafeEntry, please refer to the SafeEntry website for more information.

How to Use TraceTogether-Only SafeEntry to Collect Personal Data for Contact Tracing Purposes in Singapore

With effect from 17 May 2021, businesses that must deploy SafeEntry must now implement TraceTogether-only SafeEntry at their venues through one of the following ways:

*This method of recording visitors’ data is only allowed for the following visitors at your discretion:

• A short-term visitor to Singapore who is unable to register for or use the TraceTogether app
• A TraceTogether app user who is unable to check in with your venue’s SafeEntry QR code, is using a mobile phone that is out of battery, or is causing significant inconvenience to rest of the patrons while attempting to check-in

To comply with the Personal Data Protection Act (PDPA), you should ensure that the personal data collected through the above methods is not used for purposes other than for contact tracing to curb the spread of COVID-19.

For example, after a visitor uses SafeEntry to check in to your venue, they will normally have to display a SafeEntry Check-in Pass to prove that they have checked in. You should view the SafeEntry Check-in Pass only to meet your obligations under the COVID-19 control laws, and should make sure that the personal data collected from visitors’ check-in details is not used for a purpose other than for contact tracing.

How do you obtain a SafeEntry QR Code?

You may visit the api.singpass.gov.sg website and use your Singpass account to request a SafeEntry QR code. For more information on the steps involved, please visit this guide.

How do you obtain the SafeEntry (Business) App?

Simply download the app from the Google Play Store or Apple App Store using an electronic device such as a mobile phone. For more information on the steps involved, please visit this guide.

Businesses using the SafeEntry (Business) App should take the following extra steps to safeguard the personal data collected from visitors:

• As far as possible, use the SafeEntry (Business) App on a device exclusively used for contact tracing. This device should not be used for any other purposes, such as accessing other websites, to minimise the likelihood of a data breach and any accidental disclosure of visitors’ personal data. If possible, do a factory reset on the device before using it to collect data
• Do not install unnecessary apps on the device. Ensure that there are no apps that can perform screen recording on the device
• Turn off the web browser’s autocomplete/autofill function so that users cannot see what others have typed into the form previously
• Regularly check the device to ensure that it is scanned for viruses and malware, and that it has not been jailbroken. Ensure that the device’s operating software (OS) is updated regularly
• Allow only authorised personnel to have access to the device. Ensure that a secure password is required to unlock the device

How do you obtain a SafeEntry Gateway Check-in Box?

Only businesses that are required to deploy a SafeEntry Gateway (either a SafeEntry Gateway Check-in Box or a SafeEntry (Business App)) may apply for a SafeEntry Gateway Check-in Box. Eligible businesses are listed in Section C of this SafeEntry webpage.

If your business is eligible to use a SafeEntry Gateway Check-in Box, you may apply for one through your SafeEntry business account and by following this SafeEntry guide.

Must You Ensure that All Visitors Check in to Your Venue with TraceTogether Before Allowing Them Entry?

Yes. If a visitor does not check in to your venue with either the TraceTogether app or TraceTogether token, or refuses to provide their personal data for contact tracing, you must refuse them entry into your venue.

However, do note that you cannot demand that visitors disclose other information, such as their check-in history from the TraceTogether app, as a condition for entry.

What Can You Use the Collected Personal Data for?

As mentioned above, you may view only the SafeEntry Check-in Pass in order to meet your obligations under the COVID-19 control order laws. You cannot use the collected personal data for purposes unrelated to contact tracing without consent. Doing so is not a reasonable and appropriate purpose for the collection of the data, and is prohibited by the PDPA.

Data collected by TraceTogether will be stored in the government’s servers, and will be used by the government only when required for contact tracing purposes. For example, if a person with COVID-19 has visited your venue, the government may disclose the collected personal data to your business to carry out contact tracing and other response measures.

You must ensure that the personal data disclosed to your business is not used improperly – for example, you must make sure that the personal data of the COVID-19 patient and their related contacts is not divulged to employees or the public.

Do You Need to Notify Visitors that Their Personal Data is being Collected?

The use of visitors’ contact tracing data might be necessary to respond to an emergency. In the event that a person infected with COVID-19 is found to have visited your organisation, you do not need consent from the infected person, or any other people who may have come into contact with him or her, to use their personal data for contact tracing purposes.

However, to ensure that you are properly collecting the personal data of all visitors when they are checking in to your venue, you should notify visitors that you are collecting their personal data for the purpose of contact tracing to curb the outbreak of COVID-19.

The Personal Data Protection Commission (PDPC) has created two different notices that businesses can use to inform visitors of the collection of their personal data for contact tracing purposes. You may download these notices here.

—

Contact tracing is crucial to slow the spread of COVID-19 in Singapore. To recap, businesses currently must implement TraceTogether-only SafeEntry at venues to facilitate check-ins through visitors’ TraceTogether app or TraceTogether token.

If you have any questions on implementing TraceTogether-only SafeEntry, you may submit a query to the SafeEntry website. If you would like to check whether you are fulfilling your data protection obligations when carrying out contact tracing, you may contact the Personal Data Protection Commission.

Alternatively, if you have any other queries on contact tracing, you may contact a data protection lawyer for personalised guidance on contact tracing and other personal data issues. The lawyer may also be able to advise you on the limits of your contact tracing obligations.