'No Informed Consent' : Karnataka High Court Restrains Centre & NIC From Sharing Response Data Of Persons Collected Through 'Aarogya Setu'

The Karnataka High Court on Monday passed an interim order to restrain the Central Government and the National Informatics Centre(NIC) from sharing the response data given by an individual in the 'Aarogya Setu' app (the government's contact-tracing app developed in the wake of COVID19) with other government departments and agencies, without obtaining informed consent of the users.

A division bench comprising Chief Justices AS Oka and Justice Vishwajith Shetty passed the order after prima facie noting that there was "no informed consent taken of users for sharing of response data as provided in the Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020"

The bench noted that the informed consent of the user is limited to the collection and manner of collection information as provided in the privacy policy which is available on the app.

"Prima facie we hold that there is no informed consent of users of app for sharing of response data as provided in Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020 as there is no reference to protocol in the terms of use and privacy policy available on the app.

Prima facie we hold that informed consent of users of app is taken to what is provided in the privacy policy which is available through the app and therefore is informed consent of the user of the app which is limited to collection and manner of collection and use of information and retention of data as provided in privacy policy which is available on the app. However, it is made clear that the use and retention of information and data will be limited to what is provided in the privacy policy", the order said.

The bench also recorded the assurance of Central Government that it will not deny any benefit or services to a citizen only on the ground that Aarogya setu app was not installed.

"We accept that assurance of the Government of India that it will not deny any benefit or services to a citizen only on the ground that he has not installed Aarogya setu app", the bench said.

The order was passed in a writ petition filed by cyber security activist Anivar Aravind challenging the imposition of the 'Aarogya Setu' app on citizens on the grounds of violation of right to privacy.

"There are two part of the matter. One is privacy policy which has been uploaded on the app. As far as that is concerned, we have not granted any interim relief. As far as protocol is concerned, we are granting interim relief", the bench stated in the beginning of the order.

The bench clarified that the interim order is limited only to the aspect of sharing of response data as per the Aarogya Setu protocol.

The bench also noted that it will be open for Union of India and NIC, to respectively file an affidavit for satisfying the court that Chairman Empowered Group on Technology and Data Management, is legally empowered to issue the said protocol and that informed consent of users is taken for sharing of data as provided under the protocol.

It said "After filing of the said affidavit it will be open for the respondents to apply for vacating the said limited interim relief".

Senior Advocate Dr Colin Gonsalves, appearing for the petitioner, had argued that the collection of personal data via the app was unconstitutional as it was in violation of the principles of the Supreme Court in the KS Puttaswamy judgment, which declared right to privacy as a fundamental right.

It was argued that the data collection and sharing was done without the support of an enacted law. Mere executive orders issued under the Disaster Management Act 2005 cannot be used to support the app, which was collecting and storing data of citizens, which are deeply personal to them.

The central govt has contended the implementation of Aarogya Setu application is supported by law and it is one of the measures adopted for containing Covid-19 in the country, which does not violate the privacy of any individuals.

Weeks after the launch of the Aarogya Setu app, the Ministry of Electronics and Information Technology issued new data access and knowledge sharing protocols for Aarogya Setu, amid concerns raised by many about the privacy safeguards of the app. The protocol was called "Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020"

Under the "principles of sharing of response data", the protocol states that response data "containing personal data" may be shared with the Ministry of Health and Family Welfare, Government of India, Departments of Health of the State/Union Territory Governments/ local governments, National Disaster Management Authority (NDMA), State Disaster Management Authority (SDMA), "such 3 other Ministries and Departments of the Government of India and State Governments and other public health institutions of the Government of India", State Governments and local governments, "where such sharing is strictly necessary to directly formulate or implement an appropriate health response

Click here to read/download the order