How secure is Aarogya Setu app?

Over 50 crore Indians use smartphones. As of December 2019, India had 502.2 million smartphone users which meant that over 77 per cent of Indians access the internet through smartphones. As such the technology can be nurtured to become an important weapon to fight COVID-19 pandemic. China was an early mover involving apps to fight COVID-19.

People were required to install Health Code app, fill in personal details, and then were issued a QR code denoting quarantining status. South Korea asked all its inbound travellers to download a self-health check mobile app on their smartphones and submit their health credentials on this app during their 14-day incubation period. Many other countries used apps to complement state authorities in early contact tracing.

As the government of India announced a second phase of lockdown to prevent the spread of Coronavirus, it also allowed for a guarded system of relaxation of norms for some safe areas. In order to identify the affected clusters, Prime Minister Narendra Modi is encouraging citizens to download and use its location-based mobile app called Aarogya Setu. The app will be further used to issue an e-pass for people to move around the city freely through the ‘safe’ Zones. This idea was inspired by the Chinese government’s colour-coded smartphone app to check the movement of citizens. The Aarogya Setu app has reached 50 million users in just 13 days, becoming the highest downloaded app globally.

Add WION as a Preferred Source

Aarogya Setu is a COVID-19 contact tracing app developed by the Ministry of Electronics and IT. It detects and tracks the user’s movement with the help of GPS and Bluetooth sensors and sends out a notification if they come in contact with infected people by using its database and algorithms. Users have to enter personal information while registering on the app and the data will be shared only with the government of India, excluding any third parties. Interestingly it is not the only contact tracing application proposed by the government. Several state governments have their own app like – COVA Punjab, GoK Direct by Kerala, Mahakavach by Maharashtra, Quarantine Watch by Karnataka, Test Yourself Goa and Test Yourself Puducherry.

As countries race to monitor and contain the outbreak, some experts say several human rights, including the right to privacy, are at serious risk. Normalising the act of surveillance further increases the threat of setting the stage for politically motivated use of information. To say the least, it is a two-edged sword, helpful in fighting a disease which can also later be turned against the app users at the command of the authorities. It is an ethical conundrum.

First is the issue of privacy of a patient or a suspect regarding their identity. Second is the probability of misuse of data collected from users of the contact tracing app. Putting in perspective, the Ministry of Health and Family Welfare has issued an advisory asking not to “spread names or identity of those affected or under quarantine or their locality on the social media.” Indian Council Medical Research has also clarified that they will not disclose the identity of any patient.

Here the scope of the Right to Information Act (2005) becomes relevant. RTI Act generally does not permit disclosure of personal health information to any third parties. It is only in extraordinary conditions such as the larger public interest, the information could be shared.

In a path-breaking judgment of Justice K.S. Puttaswamy vs Union of India, the Supreme Court affirmed the right to privacy as Fundamental Right. The Supreme Court has, however, clarified that like most other fundamental rights, the right to privacy is not an “absolute right”. A person’s privacy will be subject to competing state interests. Additionally like all other fundamental rights, the right to privacy too is subject to reasonable restrictions.

Some aspects of an individual’s life are private. As opposed to the information required under law, this may only be disclosed voluntarily. But we are at present in a state of health emergency. Our movement is restricted to protect the common cause over individual rights. Privacy cannot give the right to withhold all information regarding one's self from all institutions at all times. The very concept of societal coexistence is based upon the fact that interest of the community and society supersedes individual interest.

While recognising the privacy concerns raised by various individual and civil society members, the government has updated the privacy policy of Aarogya Setu in order to make it more citizen-friendly and transparent. The new privacy policy explicitly limits the purpose for which data is collected by the app can be used, and reiterates that personal information will not be shared with any third party except to carry out “necessary medical and administrative interventions”.

At the time of registration, the app collects personal information from each user, including name, phone number, age, sex, profession and countries visited in the last 30 days. The personal information is encrypted and uploaded to the government server. Location is also captured every 15 minutes to be only used by the government as anonymised, aggregated datasets for the purpose of generating reports, heat maps and other statistical visualisations for the purpose of the management of COVID-19 in the country or to provide general notifications pertaining to COVID-19 as may be required.

Privacy is not merely the right to control what kind of information is disclosed, but also the right to choose, control and limit to whom the disclosure is made. The fact of disclosure to an institution does not indicate the acquiescence of its disclosure to the general public. It is here that the second aspect of privacy comes into the picture. The viability of the Aarogya Setu App and the likelihood of misuse of data collected through this app is under scanner: Would these contact tracing app be used after the pandemic is over as a state surveillance device? Would the data collected by the app be misused by State authorities or third parties?

The data regarding health i.e. the risk assessment tests and location information will be retained on the mobile device for a period of 30 days from the date of the collection after which, if it has not already been uploaded to the server, will be purged from the app. After 45 days of being uploaded to the server, information related to people who have not tested positive will be deleted from the server. For those who tested positive, the information will be purged after 60 days of having been declared cured.

Up till now, Aarogya Setu is not mandatory. However, several government-aided companies and departments are issuing directives to their employees and staff to compulsorily download the app. A question may arise that if the government make the Aarogya Setu app mandatory for everyone would it survive the test of law in the present scenario?

The Epidemic Diseases Act, 1897 acts on assumption that in the case of infectious diseases, the right to privacy, of infected individuals must give way to the overriding interest of protecting public health. Also, COVID-19 has been declared a “disaster” under Section 10 of the National Disaster Management Act 2005. Accordingly, the Central Government through its National Disaster Management Authority may issue any direction to the states on the ‘disaster’ even though ‘health’ is a state subject. The Epidemic Diseases Act and National Disaster Management Act together may be read to provide the legal framework for the curtailments imposed by the government including collection of data by the Aarogya Setu App. Moreover, Section 69 of Information Technology Act, 2000, provides ample power to the government to collect, decrypt, and monitor data for maintaining public order.

Section 2 of Epidemic Disease Act empowers the state authorities to take such measures and, by public notice, prescribe such temporary regulations to be observed by the public or by any person or class of persons as shall be deemed necessary to prevent the outbreak of such disease or the spread thereof. Aarogya Setu app was designed to collect information from all individual to check the outbreak of disease. With the Act in force, it may provide legal backing to Aarogya Setu app to collect information. The National Disaster Management Act provides the blanket power to the central government to issue any direction including the extreme act of a nationwide lockdown. It may, in time, also include mandatory directive to download the Aarogya Setu app for everyone.

However, implementation of the mandatory directions to download the Aarogya Setu app for everyone is still very difficult to achieve. The all-encompassing executive power provided under the Epidemic Disease Act and National Disaster Management Act can be used to justify the collection of personal information at the moment for it is in the larger national interest, but only till the epidemic persists. Restrictions imposed on the right to privacy are only justified by the temporary powers invoked under the Epidemic Disease Act and National Disaster Management Act. The information collected during this period cannot be misused for another purpose by anyone including the government even after, as Fundamental right to Privacy subsists against the state. The people also have the protection under Section 43A and Section 72A of the amended Information Technology Act where there is a right to compensation for improper disclosure of personal information.

(Disclaimer: The opinions expressed above are the personal views of the author and do not reflect the views of ZMCL)