Aarogya Setu : Karnataka High Court Reserves Order On Plea To Restrain Authorities From Denying Services For Not Installing App

A division bench of Chief Justice Abhay Oka and Justice S Vishwajith Shetty reserved the order after hearing the parties. Senior Advocate Colin Gonsalves appearing for the petitioner has argued that the application is not backed by law. He argued that as per judgment in the case of KS Puttaswamy v. Union of India, (2017) 10 SCC 1 (Aadhaar judgement), any privacy infringement (Aarogya Setu App) requires a legislation (eg Aadhaar Act) and mere executive orders (such as those issued for the App under Disaster Management Act) are not sufficient.

Gonsalves also submitted that "During the period of Covid-19 the government has enacted three labour laws, enacted three farm statutes. The Uttar Pradesh government has enacted an ordinance which it made overnight if you have CAA and NRC protest they can arrest you. Law could have been made immediately if you wanted to do a privacy act. Law is not made therefore, how does an emergency exempt you from the rigor of Puttaswamy".

Further it was submitted that the Aarogya setu application fails the test of proportionality. "It collects disproportionate data, there is no need to collect GPS location and there is no need for this data to be stored on the central servers." It was also said that the application fails purpose limitation tests, as it is being used for purposes other than alerting users of their chances of having contracted Covid (e-pass, telemedicine, etc.). Gonsalves, said that unless clear and informed consent is obtained from its users, a data controller cannot give data to third parties.

Gonsalves placed on record details of 129 notifications issued by various government agencies which either make it mandatory or advise use of the Aarogya Setu app. He said "You cannot now say that people are doing it with consent. People could not get into planes, train, offices, so can you say that millions of users downloaded the app innocently by clicking a button and that is free consent."

Gonsalves also mentioned that there have been various instances reported of data breaches. He also submitted that there is no sunset clause in the application. He referred to the Personal Data Protection Bill, 2019 and said "With the new feature of API employers will now have access to the health status/condition, location, etc. of their employees."

On the aspect of harm being caused Gonsalves said "if the government knows you are Covid-19 positive and are in Khan market, the government knows exactly your location and they can come to Khan market and say sir you are covid-19 positive, your app is red and my directions are to take you quarantine centre. This is possible because of location data which is not possible in other apps."

He added "This is a surveillance app and the state is operating as super policemen, this is an app for repression of the public. Without a law this cannot be done. Their justification is superficial and no study is carried out."

Referring to the terms and conditions of the app, Gonsalves pointed out that certain data is obtained and stored on a server run by the Government of India when one registers on the app. He submitted that data is kept in the server for 60 days after such persons declare of being cured of covid-19, will the data go. "In 60 days the data will go to universities, commercially this data is very viable; people will pay 100's or 1000's of rupees for this data."

Additional Solicitor General appearing for the Central government said the implementation of Aarogya Setu application is supported by law and it is one of the measures adopted for containing Covid-19 in the country, which does not violate the privacy of any individuals.

He referred to the statement of objections filed by the government in which it is said that Aarogya Setu application, launched on April 2, is in exercise of powers conferred under the Disaster Management Act, 2005, Epidemic Diseases Act 1897, National Disaster Management Plan and Executive powers.

The affidavit also states that "The app doesn't violate the privacy of any individual. The right to privacy has not been compromised as adequate privacy protections have been built in the app. The app has built in privacy principles of right to access and correct personally identifiable information for registered users, use limitation, purpose limitation, data minimization data retention and data security."

It is also contended that "The Aarogya Setu project is an outcome of joint efforts from various volunteers from industry, academia and government. The external volunteers participated in the Aarogya Setu project in their individual capacity on a pro-bono basis. The data collected by the Aarogya Setu application is governed by the Aarogya Setu Data Access and Knowledge sharing protocol which clearly defines what data can be shared with whom and for what purpose."

Moreover, it is claimed that "Aarogya setu application is for the benefit of larger public interest. Violation of privacy should not be imaginary, it should be real and it should have reasonable expectations. The app is in the interest of the public at large. There is a rational nexus between objectives sought to be achieved with less impair, maximum benefits are yielded. Even on applying 'necessity test' also the Aarogya Setu application is a valid one."

It adds that "The application is one of the useful tool for the health and other administrative authorities to adopt mitigating measures by identifying the persons tested positive in a given locality as well as their contacts with non-covid 19 affected persons and also pre-notice to non-covid 19 affected person of their contacts with covid-19 affected persons which helps non-covid 19 affected person for taking preventive measures including medications." The Government of India has clarified that it has not passed any orders mandating use of Aarogya Setu application for accessing any government service or facility.

ASG also pointed to the conduct of the petition by saying that "Petition who claims to be a public interest technologist has never contacted the Government of India with any of his queries."