“Imperative criteria as to whom the data can be disclosed; whether there are sufficient safeguards to ensure that data remains confidential; how it is to be dealt with after processing/ analysis and its conditions, … (are) vitally important. The cornerstone of managing data confidentiality is, to a large extent, determined by the control over access to it and the modus and the manner in which it is dealt with.”

Resultantly, the Hon’ble Court, vide order dated 24.04.2020, passed a series of unprecedented directions to the State of Kerala and Sprinklr, including that (a) all data collected and to be collected shall be anonymised and only such data can be shared with Sprinklr in future, which has already been anonymised; (b) all citizens whose data is being collected must be informed that their personal data is going to be processed by Sprinklr or any third party and that specific consent from the citizens is to be taken for the same; (c) the data available with Sprinklr or to be made available in future shall not be used by Sprinklr in any manner which is contrary to the confidentiality obligations set out in the agreement and that such data shall be returned to the Government, once the use / processing of the data for COVID-19 purposes is over; and (d) all data that had been transferred to Sprinklr in the past shall be returned to the Government forthwith, if not already done.

The order clearly demonstrates the the absence of a personal data protection legislation shall not deter Courts in India from passing orders (i) protecting the confidentiality and integrity of personal data, specifically that which is categorised as sensitive personal data; (ii) relying upon and incorporating into Indian jurisprudence, generally acceptable principles of international law (“GDPR”) relating to data protection (lawfulness, fairness, transparency, consent, specific purpose, integrity and confidentiality as well as to resort to data anonymisation where needed); (iii) upholding the right of Privacy even in these times of pandemic “emergency”.

Less than 3 weeks before this order was passed, the Union Government released the Aarogya Setu App. The primary scope of this contact tracing app being collection and processing of data, though for the specific purpose of addressing the pandemic issue and trying to control the spread thereof. Thus, the underlying basis for collection and processing of data seems to mirror the situation or justification given by the Kerala Government in the Sprinklr case.

The debate around the application only gained ground, however, on 01.05.2020, when the Government passed orders making it mandatory, for (i) people residing in containment zones; (ii) all employers – public or private sector – who were opening up their places of work, to ensure that each of their employees downloaded the app and accordingly, captured their health data on the application.

With 90 million downloads by the first week of May 2020, and more getting added on a daily basis, privacy activists raised various fears, sent legal notices to the government and even filed a public interest litigation, again before the Kerala High Court. The app also attracted a hacker to hack the database to ostensibly demonstrate its fallibility.

The PIL alleged that mandating the use of Aarogya Setu, especially at the workplace and attaching penal sanctions to non-compliance by employers amounts to an arbitrary and unreasonable exercise of executive power which is in violation of Articles 14, 19 and 21, and specifically the right of privacy, which has been found to be guaranteed under Article 21 of the Constitution of India in the Puttaswamy case. The broad contentions included (i) lack of consent and actually forced consent to part with the Sensitive Personal Data – brought about by not only the absence of basic procedural safeguards on access and disclosure, but also because of the absence of an effective legislative framework that would allow a person whose data has been breached/misused, to get an effective remedy therefor; (ii) the statutory provision under which such an executive order has been passed, i.e., Section 10(1) of the Disaster Management Act, is an overarching interpretation, especially as privacy can only be breached by a specific law made for that purpose; (iii) while legitimate actions of the State in furtherance of Public Interest may be used to curtail the right of privacy, however, the absence of specific legislation covering the subject, and purpose restrictions not specified in the Privacy Policy, the action is no longer legitimate. This is evident from the fact that the Privacy Policy does not limit the use of the data for COVID-19 only – which is the real reasons of collecting the data – but specifically states that it can be used “for all purposes that are allowed by the law for the time being in force”.

Once the PIL was filed and notice issued on the same, the following steps that the Government has taken, demonstrates the strength of Privacy as a right. First, the Government clearly came out with a strong statement from no less than the Minister of Electronics and IT, Mr. Ravi Shankar Prasad, that the general data would be deleted within 30 days and the date related to infected persons, within 45-60 days. Also, currently, there do not seem to be any cases filed, in relation to alleged non-enforcement of the claimed 100% compliance as per the Government order. Thus, there seems to be a reasonable approach that is being followed in this regard as well.

The one sure indicator that emerges from the above discussion is that the Personal Data Protection Bill is long overdue to be enacted as a legislation. Absent that, the pandemic of confusion is unlikely to die down.