The Case of Anivar A Aravind Vs Ministry of Home Affair & Others

Introduction

Recently, the Karnataka High Court passed an interim order on 27th January 2021, by which it prohibited the Government of India and National Informatics Centre (NIC) from sharing the health data of citizens without their informed consent. The court observed that sharing the responses of the users of the Aarogya Setu app without their consent will be a violation of the right to privacy under Article 21 of the Constitution of India.

Brief Facts

In the present case, the writ petition was filed by the petitioner under Article 226 praying the court to direct the government of India, NIC, and other responsible parties to make the use of the Aarogya Setu app released by the NIC voluntary by the citizens and several other directions.

The issue raised by the petitioner is that the Aarogya Setu app was introduced by the Hon’ble Prime Minister on 24th March 2020 after the nationwide lockdown. More than one hundred million users have downloaded the app to date.

The petitioner raised several questions on the use of the response data submitted by the users on the Aarogya Setu app and whether the government of India has the right to transfer the personal data of the users saved in the server of the Aarogya Setu app without the consent of the users.

The petitioner in the petition has prayed for the following directions:

  • A writ of mandamus directing the authorities to make the use of app voluntary by citizens.
  • A declaration that the app is not required for availing the government service or facility.
  • A writ of mandamus directing the respondent no. 6 and 7 to release the complete and corresponding source code of all the versions (current and future) of the Aarogya Setu application.
  • A direction to the respondents to delete the data collected on the app at the time of registration after the declaration is made by the appropriate authority that the pandemic is over.
  • A direction to the respondents for not transferring the personal data of the citizens collected on the app to third parties except the cases where such transfer is required for the treatment of a patient. Moreover, the data shared with the third parties should also be deleted once the pandemic is over.
  • An order setting aside Clause 3(vii) of Annexure N issued by respondent no. 8. This clause makes the installation of the Aarogya Setu app compulsory to prevent the spread of the virus in the offices.
  • A direction to respondent no. 9 not to make the use of the Aarogya Setu app mandatory for the commuters traveling in Bangalore Metro.
  • An order of injunction to prevent the respondents from using the app and the data collected thereon.

Meanwhile, the petitioner made an interim prayer before the court in which the petitioner has prayed the court for the issuance of the following directions:

  • To put a stay on Clause 15 of National Directives for Covid-19 Management.
  • A direction should be made to the respondent not to make the use of the app compulsory for accessing any service, and the services should not be denied to any person on the same ground.
  • An order restraining the respondents from proceeding with the app and the data collected thereon till the disposal of the petition by the court.

This court vides its order dated 19th October 2020 declared that the Central and State Government cannot deny the benefit of any services to a citizen on the ground of non-installation of the app till the disposal of the petition. However, the Government of India, Bangalore Metro, and Airport Authority have taken a stand on various occasions before the court that as per the orders passed by the National Executive Committee under National Disaster Management Act, 2005, the use of the app for traveling is not mandatory and the usage of the app is completely voluntary. As per Clause 3(vii) of the Standard Operating Procedure dated 4th June 2020, the installation and use of the Aarogya Setu app shall be advised to all. It is merely an advisory clause.

Arguments Raised By the Parties

For supporting the arguments raised in the petition, the petitioner has relied on the landmark judgment passed by the Apex Court in the case of Justice K.S. Puttawamy (retired) vs Union of India, in which the Right to Privacy was declared as a fundamental right under Article 21 of the Constitution of India. Relying on the Puttaswamy judgment, the petitioner argued that the data controller is not entitled to disclose the personal data of the users of the app to third parties without taking the informed consent of the users. The petitioner also relied on the provisions of the Personal Data Protection Bill, 2019. Furthermore, the petitioner pointed out that the data collected on the app is shared with various government departments and Public Health Institutions of the Government by the NIC, and such transfer violates the right of privacy of the users as the consent of the user is not taken before making such transfer.

Contrasting to this, the counsel for the respondents submitted to the court that the use of the Aarogya Setu app is not mandatory and no services are denied to any citizen on the ground of non-installation of the app. Further, the counsel for the respondents submitted that all the personal information on the app is securely encrypted and stored on the server and the same is also mentioned in the 11th May 2020 order of the Chairperson of Empowered Group on Technology and Data Management. The Aarogya Setu app tracks the infected COVID-19 persons and it is an important tool in curbing the spread of the novel coronavirus.

 Observations Made By the Court

In the present case, the Karnataka High Court has considered only the interim prayer of the petitioner and the final disposition of the petition is still pending. Vide this interim order, the High Court has made it clear that no citizens can be denied the benefits of any government services or the services offered by the instrumentality of the government on the ground of non-installation of the app. Further, the Airport Authority of India and Bangalore Metro Rail Corporation Limited (hereinafter referred to as “BMRCL”) have not issued any such orders as a precondition to travel.

The question before this court was “whether the transfer of the personal data of the users collected on the app without seeking the consent of the users is violative of the right to privacy under Article 21 of the Constitution of India”? To answer this question, the reliance was placed by the High Court on the judgment passed by the Apex Court in the case of Justice K.S. Puttaswamy vs Union of India wherein the court has held that Privacy is the constitutional core of human dignity and it emerges from the guarantee of life and personal liberty in Article 21 of the Constitution of India.

In the case of Puttaswamy, the Apex Court has also discussed in detail the issue of informational privacy. The court observed that ours is the age of information. Data such as medical information would be a category to which a reasonable expectation of privacy attaches. Nine principles of privacy for the protection of privacy were laid down by the Apex Court in this case. The two principles which are relevant for deciding the question at hand are produced as follows:

Notice: A data controller shall give simple-to-understand notice of its information practices to all individuals in the clear and concise language before personal information is collected.

Choice and consent: A data controller shall give individuals choices (opt-in/opt-out) with regard to providing their personal information, and take individual consent only after providing notice of its information practices.”

The High Court referred to the terms and conditions of the Aarogya Setu app and observed that a person who downloads the app is put to notice about the terms of the service and Privacy Policy. The user is put to notice that the data of the user stored in the app will be used for specific purposes, the transfer of the data to the server, retention of the data, etc., as set out in the privacy policy. Thus, the High Court held that the informed consent of the user is taken at the time of installation of the app.

Lastly, the High Court referred to the Aarogya Setu Data Access & Knowledge Sharing Protocol, 2020 issued by the order dated 11th May 2020 of Chairperson, Empowered Group on Technology and Data Management.  The court referred to the above-mentioned protocols to find out the prospective use of the personal data of the app users by the government. As per Clause 6 of the protocol, the personal data of the users can be shared by NIC with the State Government, Public Health Institution, etc. Further, Clause 8 of the protocol permits NIC to share the response data with third parties for research purposes. However, there is no mention of such sharing and transfer in the Privacy Policy of the Aarogya Setu app.

The High court observed that the collection of data and sharing of response data as per various clauses of the protocol is not done with the informed consent of the user. Thus, such sharing of response data of the citizen by NIC without their consent is in violation of the right of privacy under Article 21 of the Constitution of India. To reach this conclusion, the High Court takes note of the fact that the users of the Aarogya Setu app were not informed about the above-mentioned protocol issued by the Chairperson of the Empowered Group, and the protocol was not made a part of the Privacy Policy available on the Aarogya Setu app.

Disposing of the application for interim relief, the High Court restrained the Government of India, National Informatics Centre, and the Respondents no. 7 and 8 from sharing the response data collected by applying the provisions of the protocol unless the informed consent of the users of the app is taken.

Author: Pratiksha Rawat, a Final Year student of Amity Law School (Delhi ), an intern at Khurana & Khurana, Advocated and IP Attorneys.  In case of any queries please contact/write back to us at aishani@khuranaandkhurana.com.

Leave a Reply

Archives

  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • April 2017
  • March 2017
  • February 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • May 2015
  • April 2015
  • March 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • April 2012
  • March 2012
  • February 2012
  • January 2012
  • December 2011
  • November 2011
  • October 2011
  • September 2011
  • August 2011
  • July 2011
  • June 2011
  • May 2011
  • April 2011
  • March 2011
  • February 2011
  • January 2011
  • December 2010
  • September 2010
  • July 2010
  • June 2010
  • May 2010
  • April 2010