The Aarogya Setu, a government app designed to provide information to users about risks, best practices and advisories on Covid-19 is being used by around 9.28 crore Indians, according to information provided by the app.

Another important function of the app is to create a verifiable trail of potential Covid-19 patients through contact tracing and disseminate this information in real time to users to help them avoid contact transmission.

On 1 May 2020, the government issued guidelines and directives on the measures to be undertaken by the states for the containment of Covid-19 for a further period of two weeks with effect from 4 May.

The directives, among other things, mandated the downloading of the Arogya Setu app for all employees returning to the workplace, both private and public.

Considering the nature of data collected by the app — name, phone number, age, gender, location, profession and travel history and the mandatory direction of the government for using the app, privacy activists have raised certain concerns like tracking individual’s location at all times, potentially leading to a surveillance state, or data collected not being stored securely.

Let us examine whether the government can legally do this.

The government is required to justify any interference by it in its citizens’ privacy in the light of a test laid down in the landmark judgement of the Supreme Court in ‘Justice K S Puttaswamy (Retd) and Anr versus Union of India and Ors’ case in 2017.

The test here is that the government’s action must be sanctioned by law, must be necessary for the fulfillment of a legitimate aim or need, and constitute a suitable means of achieving that goal without having a disproportionate impact on the right holder.

The Epidemic Diseases Act of 1897 allows the government to take ‘necessary’ steps to curtail the spread of disease, which can provide the sanction under law required by the government in this case.

An argument can also be made that to break the chain of transmission it is necessary to sensitise people about dos and don’ts, give accurate information and enable contact tracing to assess and contain the risk of spread, justifying the ‘necessity’ for effective intervention through latest technology such as these apps.

Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages due to the limitation in exercise of the right. In simple terms, the limitation on the right must be justified by purpose and accompanying safeguards.

Recently, in response to claims by a French ethical hacker, who raised concerns of crores of citizens’ personal data being at risk owing to a loophole in the app’s programming, the government issued a formal response with reassurance that there were none. The government has encouraged users to identify any vulnerability to come forward and inform them.

Separately, questions have also been raised on the efficacy of the government guidelines considering not all Indians possess smartphones. All Indians may not have smartphones but that does not mean that measures cannot be optimised through technology for those who do have smartphones.

While there is no doubt that questions can be raised about the balance of privacy and public health in the context of Arogya Setu, an important question to ask ourselves is — what is the alternative?

If it is not having such an app at all, then are we fine with not having information of at-risk areas at our fingertips the next time we step out to buy groceries or vegetables?

Should the government refrain from using technology to optimise contact tracing and subsequent containment of spread and instead stick to publishing lists of containment zones and notices outside homes in quarantine?

If the alternative is having an app developed by a private entity, then are we fine with disclosing our personal data to a private entity that has limited accountability under the existing laws in India?

The Justice B N Srikrishna Committee Report had observed that the Information Technology Act and Rules thereunder that apply to private entities are limited in their scope of protecting various categories of personal data.

Additionally, the legal framework for private entities also suffers from problems of implementation due to delays in appointments to the adjudicatory mechanisms under the act. While the proposed Personal Data Protection Bill, 2019, lays down stricter rules for the collection, use and disclosure of personal information and gives an individual certain rights concerning their data like modification or deletion, it is still a bill and not an act and has, therefore, no legal effect.

An argument can thus be made that while there are downsides to using a state-owned application like Aarogya Setu, it is lesser than not using one at all or using an app by a private entity that has no real accountability.

The recent Sprinklr debacle has shown us that a government can and will be held accountable by the judiciary where the citizens’ fundamental right to privacy is at stake.

In this instance, the Kerala High Court issued several directions to the Kerala government for its controversial transfer of Covid-19 patient data to US-based firm Sprinklr to see that all safeguards regarding data privacy were maintained.

Amongst the directions issued, the most significant one includes the court asking the state government to collate all the data till date, anonymise it, and only then allow access to Sprinklr.

While we must continue to hold the government accountable to ensure it maintains adequate safeguards for the data we share, we must also be sensitive to the fact that our willingness to share information could go a long way in helping contain the pandemic.

Containing the epidemic is in turn crucial to restart our business, livelihood and the economy. In the end, it is a trade-off where we must ask ourselves the question the app asks us — are we willing to help in times of need?

Akshaya Suresh and Parvathy Nair

Get Swarajya in your inbox.