The ban on 59 China-based apps - Some questions to ponder

Background

Last week, the Information Technology Ministry of the Central Government banned 59 China-based mobile apps. This list includes popular apps such as TikTok, UC Browser, CamScanner and ShareIt. This ban was undertaken by invoking Section 69A of the Information Technology Act (‘IT Act’), and the Website Blocking Rules of 2009. Section 69A of the IT Act confers the Central Government the power to block public access to any kind of online information, for safeguarding the sovereignty and integrity of India, and the security of the State. The procedure for this blocking of public access is prescribed in the Website Blocking Rules of 2009, which state that in a situation of ‘emergency’, an interim ban on public access can be directed, without giving a hearing to the aggrieved party.

The IT Ministry also issued a Press Release, which enlisted the reasons for the ban. The main reason mentioned in the Press Release is that the enlisted mobile apps were compromising on aspects of privacy and data security - by transmitting user data to servers located outside India. Such a compromise of privacy and data security, was, according to the Press Release, prejudicial to the sovereignty and integrity of India. The Press Release only states that the ‘relevant provisions’ of the Website Blocking Rules of 2009 have been invoked, and does not precisely state the ‘emergency’ which justified banning the mobile apps without giving a hearing to their developers.

However, the ostensible reason for invoking the ‘emergency’ provision is the tense situation with China, at the Ladakh border. While the IT Ministry does not explicitly mention China in the Press Release, its intention to send a strong political message to Xi Jinping and the Chinese Communist Party establishment is but obvious. More significantly, the Central Government would also want to ensure that during a tense military situation at the border, the Chinese establishment does not resort to espionage, or cyberattacks against Indian computer networks.

Such a worry is legitimate in light of recent events across the globe - as a Chinese State-backed hacker group is suspected to be behind a major cyber attack that hit Australia in June. As the concerns over data security and privacy are based on solid grounds, it is important for the Central Government to precisely clarify whether its order is interim or permanent in nature.  As of now, it has only been reported in the media that the order is interim in nature, and that a Secretary-level panel of the Central Government shall hear clarifications from representatives of the app developers. At this juncture, let us refer to the stand taken by the Chief Executive of TikTok.

While the Chief Executive of Tiktok has stated that TikTok shall not honor any request by the Chinese establishment to share user data of Indians, such an assurance cannot be taken at face value. This is because China’s National Intelligence Law of 2017 requires all companies of Chinese origin to share data with China’s intelligence agencies, irrespective of whether they operate within or outside the country. To illustrate - TikTok, as a Chinese-origin company shall be bound to share all data demanded by Chinese intelligence agencies, even though it does not have operations in China. This National Intelligence Law is just one among the many methods through which user data can be transferred across the border.

This example highlights that the scope for unauthorized transfer of data to foreign servers existed even before the military stand-off at Ladakh broke out, and the Government’s response of raising questions of privacy and data security has been belated. Keeping this background in mind, I would like to raise two questions while this situation develops.

Two Questions

[1]. As the possibility of unauthorized data transfer to foreign servers existed even before the border standoff, what about personal data that has already been transferred? It is important for us to have an answer to this, as apps such as TikTok, Cam Scanner, and UC Browser were hugely popular, and downloaded by a majority of smartphone users. These apps may collect sensitive personal data of various kinds, such as data relating to religious and political beliefs, financial status, sexual orientation, etc. 

[2]. Along with Chinese-origin apps, there may also be a case of unauthorized data transfer by apps which have significant Chinese investment. Some popular apps which have a significant investment by Chinese companies are Swiggy, Zomato, Big Basket, Paytm and Ola Cabs. Some of these apps also have common investors. To illustrate, Chinese tech giant Alibaba has made significant investments in Paytm, Zomato and BigBasket. 

*(Incidentally, Alibaba also owns UC Browser, which is one of the 59 apps that have been banned.)

Most of us would have linked our Paytm ID in our Zomato account, which in turn would also have our bank account details. While we link this under an expectation of privacy, there does exist a definite possibility of unauthorized sharing of sensitive information of this nature. Hence, it is important to know whether apps that are backed by Chinese investment are engaging in unauthorized transfer of data to their investor companies. An answer to this question shall highlight whether the list of 59 apps chosen by the IT Ministry is exhaustive, and whether other apps that are engaging in unauthorized transfer of data have been excluded.

Along with this, there is also a larger issue that we need to address, relating to privacy and security of the data that is collected by smartphones. Our smartphones store a plethora of personal data, ranging from our fingerprints to bank account details. The Government must examine whether there exist backdoors through which sensitive personal data stored in our smartphones is being transferred and accessed in an unauthorized manner. This issue assumes significance as more than 70% of the Indian smartphone market share is held by companies such as Xiaomi and Oppo, which have their roots in China. Hence, while we focus on mobile apps, let us not forget the smartphone ecosystem as a whole.

Some of these issues shall be partly addressed once the draft Personal Data Protection Bill, 2019 is enacted into law – as the Bill lays down conditions of processing and foreign transfer of personal data. While we push for our long overdue data protection law (irrespective of its shortcomings), let us hold the Government to account on all matters of privacy and data security. The IT Ministry’s approach here can be contrasted with the approach it adopted after launching the Arogya Setu app, which was coercively pushed even before a robust data security infrastructure was created. The ban on 59 apps should be seen in this context, and must be supplemented by addressing other equally pressing concerns of privacy and data security.
-------------------------------------------------------------------------------------------------------------
Update: On 27th July, the Central Government banned 47 additional apps - which were operating as clones or 'lite' versions of the 59 Chinese apps that had been banned earlier. 

The Kerala HC's order on salary deferment - Examining implications for the 'rule of law'

In a significant order delivered on 28^th April, the Kerala High Court had stayed an executive order of the Kerala Government, which partially deferred the salary payment of all government employees who earned more than Rs. 20,000. This was done on the ground that there was no ‘legislative backing’ for such an executive order. Following the Kerala HC’s decision, the Kerala Government promulgated an ordinance to remedy the defect pointed out by the HC. The Kerala HC has also in a subsequent order upheld the validity of the ordinance.

In this post, our focus shall be on the reasoning adopted by the Kerala HC while staying the initial executive order. We shall also discuss its implications for a possible legal challenge to the Aarogya Setu app – which is being implemented by the Central Government on the basis of executive orders - without an anchoring legislation.

The reasoning employed by the Kerala HC

The executive order issued by the Kerala Government was applicable on all government employees who earned a gross salary of more than Rs. 20,000. Under this order, the government employees were subjected to a deferment of a small portion of their salary, for all months from April 2020 to August 2020. The salary that was deferred was equivalent to 6 days worth of salary for each month, from April to August. It is significant to note here that the executive order only deferred the payment of a small portion of the salary, and did not in any way alter or reduce the salary amount that was payable. This measure was a means to reduce expenditure, in light of the fiscal paucity faced by the Kerala Government.

The primary argument of the petitioners was that the executive order violated Article 300A of the Constitution. Under Article 300A – “No person shall be deprived of his property save by the authority of law”. Now, it has been consistently held by the Supreme Court that the term ‘law’ includes only statutory law, and not an independent executive order.  This implies that if an executive order has to be issued, it should derive its authority from an anchoring legislation. The petitioners contended that ‘salary’ fell within the ambit of the term ‘property’ under Article 300A, and that a person can be ‘deprived’ of the same only through a statutory law, and not solely through an executive order.

The Kerala Government on the other hand contended that the power to defer payment of salary can be read into Section 2 of the Epidemic Diseases Act, 1897, along with Section 38 and Section 39 of the Disaster Management Act, 2005. Under Section 2 of the Epidemic Diseases Act, the State Government has the power to frame temporary regulations in a manner that it deems fit, to prevent the spread of an epidemic disease, such as Covid-19.  Section 38 of the Disaster Management Act, 2005 confers the State Governments with the power to undertake a wide array of measures for disaster management. Section 39 on the other hand enlists the responsibilities of different departments of the State Government during a national disaster.

It is pertinent to recall here that the nationwide lockdown has been imposed by the Central Government by invoking the Disaster Management Act. The State Governments have simultaneously invoked the Epidemic Diseases Act to frame regulations for preventing the spread of Covid-19. One similarity between both these legislations is that they confer the Central and the State Governments with a wide array of discretionary powers, during a situation such as the Covid-19 pandemic.

The Court rejected the argument of the government, and accepted, at a prima facie level, the petitioners’ contention that ‘salary’ fell within the ambit of the term ‘property’ under Article 300A. The Court also held that the provisions of the Epidemic Diseases Act and the Disaster Management Act do not confer the Government with the power to defer the salary of government employees during any kind of disaster or emergency situation. Hence, the executive order did not derive its source from any statutory law, which was in violation of Article 300A. The Court accordingly stayed the operation of the executive order.

There are two significant takeaways from the Court’s order. First, it was reiterated that the term ‘law’ under Article 300A refers only to statutory law, and not to a mere executive order. If the State were to defer payment of salaries through an executive order, then such an executive order should derive its authority from a statutory law. Second, the Court held that if the power to defer salaries is not specifically mentioned in the Epidemic Diseases Act or the Disaster Management Act, this power cannot be simply read in through the omnibus provisions present in both these legislations. The key point here is that neither of these legislations confer the Central or the State Governments with unbridled power to undertake any and every measure through executive diktat.

After this order, the Kerala Government promulgated an ordinance that conferred it with the power to defer payment of salary during a public health emergency or a disaster. By invoking the power conferred by the ordinance, the Kerala Government issued executive notifications that achieved the same objective which the earlier executive order sought to achieve – by deferring salary payments of those government employees who had a gross salary exceeding Rs. 20,000.

The Kerala HC subsequently refused to grant any interim stay on the executive notification, and held that it was within the scope of the powers conferred by the newly promulgated ordinance. This way, the Court has further emphasized on the principle that such an executive order should derive its authority from a statutory law, or through an ordinance - which has the same force and effect as a law enacted by the Legislature, under Article 213 of the Constitution.

Implications for the ‘rule of law’ and Aarogya Setu

While staying the executive order, the Kerala HC noted that even in times of an emergency, there can be no deviation from the rule of law. If Article 300A mandated that property cannot be deprived through an executive order that is not backed by a statutory law, then this requirement cannot be dispensed with even in times of a pandemic. Furthermore, as discussed above, the Court noted that the Disaster Management Act and the Epidemic Diseases Act do not confer unbridled powers to undertake any and every action by means of an executive order.

This has significant implications for the legal issues surrounding the Aarogya Setu mobile app. This mobile app is being implemented by the Central Government without any specific anchoring legislation. Furthermore, for devising measures to tackle different aspects of the Covid-19 pandemic, the Central Government has constituted multiple Empowered Groups of Officers, by invoking the powers conferred by Section 10 of the Disaster Management Act. One such group of Officers is the Empowered Group on Technology and Data Management. This Empowered Group, has, through an executive order, notified Aarogya Setu’s Data Access and Knowledge Sharing Protocol. Now, the question that arises here is whether the Aarogya Setu app as a whole, along with its Data Access and Knowledge Sharing Protocol fall within the ambit of the Disaster Management Act.

While examining this issue, it is pertinent to recall that the fundamental rights conferred by Part III of the Indian Constitution are subject to reasonable restrictions enacted through ‘law’. Akin to Article 300A, the term ‘law’ here only refers to statutory law, and does not include an executive order which lacks a statutory basis. The Aarogya Setu app collects a significant amount of personal data, and is undoubtedly an infringement of the right to privacy. As held in the KS Puttuswamy  decision, such an infringement of privacy shall be constitutionally valid only if the proportionality test is satisfied.

The first requirement of the proportionality test is the requirement of legality – under which the measure should be backed by law. The Aarogya Setu app and the Protocol issued can hence be considered valid only if they fall within the ambit of the Disaster Management Act. It is at this juncture that the Kerala HC’s order finds significance, as the Court noted that if the power to undertake a specific measure (such as deferring salary payments) is not specifically mentioned in the Disaster Management Act, the same cannot be simply read into the omnibus provisions of the statute.

Similarly, as the statute does not confer any specific power to collect personal data through a contact tracing app, this power cannot be read into the ambit of the statute. Applying this interpretation, the Aarogya Setu app, along with the notified Protocol, cannot fall within the ambit of the Disaster Management Act, and must be backed by an independent parliamentary law.

This interpretation given by the Kerala HC prevents a rule by executive decree, even in times of an emergency such as the Covid-19 pandemic. It prevents a situation where measures that may infringe on constitutional rights are justified by simply referring to the omnibus provisions of the Disaster Management Act. When the implementation of the Aarogya Setu app is challenged in Court, the bench should adopt an approach similar to the Kerala HC – which ensures that even during a grave emergency, there is rule of law, and not rule by law.

Covid-19: Is there a conflict between safeguarding privacy and public health?

In the previous post, we discussed how we do not ‘trade-off’ or waive our right to privacy when we give our personal data to the State or a private entity. We highlighted how we continue to have a right to privacy over the data that we have parted with, as privacy is a right that belongs to ‘people, and not places’.

In this post, we will analyze a similar trade-off that is being discussed today, which is the trade-off between privacy and public health. This is in light various data collection measures that have been adopted by the Central and State Governments, with the intention of checking the spread of Covid-19.

Different data collection measures and their privacy concerns

To take steps to prevent the spread of the virus, the Central and State Governments have been collecting different types of sensitive personal data. An important category of sensitive personal data that is being collected by State Governments is geo-location data (through GPS). This is being collected for two primary purposes – (i) to ensure that those who have been advised either home or institutional quarantine do not escape the same; and (ii) to conduct contract tracing of those who have been diagnosed positive for Covid-19. This is done to identify those who have come in contact with an infected person, as they have a higher risk of catching the infection and hence need to be tested or isolated immediately.

For instance, the Karnataka Govt. mandated that those who are under home quarantine should upload selfies every one hour with their GPS coordinates on a mobile application.  The only exemption granted is from 10 P.M. to 7 A.M, during which the selfie need not be uploaded. This practically means that the State is deciding the sleep cycle of those who are under home quarantine, as not uploading a selfie within the designated hours may invite harassment from govt. officers. This goes against bodily autonomy and personal choice, which as Justice Chandrachud held in Puttuswamy I, are integral aspects of the right to privacy.

Another smartphone-based application that has gained prominence is the Aarogya Setu application – which is being vehemently promoted by the Central Government. Even this app requires GPS data to work, and provides information with respect to whether you have come in close contact with a Covid-19 patient, the number of positive cases near your area etc. While this app was promoted as a voluntary service that could be downloaded by the user, it is now becoming another recipe for coercion, under the latest lockdown guidelines issued by the Ministry of Home Affairs.

The guidelines state that within containment zones, the local authorities should ensure 100% coverage of the app among the residents – which effectively means that local authorities can coerce all residents to download the app and part with their geo-location data. The guidelines also make it mandatory for employees in both private and public workplaces to download the app, and has cast a duty on the employer to ensure that the employees comply with the same.

A third instance that should concern us is with respect to Sprinklr, which is a New York based company that had received a contract from the Kerala Govt. to manage Covid-19 related data. The data collected by healthcare workers is shared with Sprinklr, which is required to manage the data on its servers. A petition was also filed in Kerala High Court, on the ground that the medical data collected should only be stored locally in government servers, and that the confidentiality of the medical data collected must be ensured. 

In a significant decision, the Court inter alia directed that Sprinklr should not disclose the data to any third party, and must anonymize all collected data. The Court noted that this is necessary to ensure that “there is no data epidemic after Covid-19 epidemic is controlled”. The decision of the Kerala High Court is also of utmost relevance to the other measures that I have referred to above.

All the other instances referred above involve collection of sensitive personal information. They bring to light several privacy concerns such as non-consensual collection of data, and possible sharing of data with third parties. But, instead of addressing such concerns, different state governments have merely contended that such collection of data for purposes such as contract tracing is necessary to check the spread of the disease.

The State’s attitude towards privacy in times of a pandemic

The attitude that both the Central Govt and the State Govts have adopted towards privacy can be highlighted by referring to the arguments of the Kerala Govt. counsel in the Sprinklr matter. The Govt. counsel argued that ‘data management’ is one of the reasons as to why Kerala has successfully managed to control the spread of Covid-19. Now, there can be no quarrel with the proposition that collection of personal data is necessary for contract tracing – which is an important measure to stop the spread of the virus. But, the problem arises when the State disregards privacy under the pretext of meeting the larger objective of public health.

As we discussed in the previous post, a person does not ‘waive’ his privacy when he gives certain personal information to the State, for accessing a benefit or a service. The person continues to have a right to privacy over his data even when it is consensually given to the State (or to a private entity) - and is entitled to a legal remedy if there is an unauthorized use of his personal data. Hence, even if a person voluntarily downloads the Aarogya Setu app, he does not waive his right to privacy over the data that he is sharing with the State. The necessary corollary to this in the current Covid-19 scenario is that even when a person is voluntarily parting with his data for purposes such as contact tracing, he is not  ‘trading-off’ or waiving his right to privacy in order to safeguard public health.

With respect to measures such as uploading periodic selfies and sharing of geo-location data, or parting with medical information, there is no question of consent involved as it is mandatory for certain categories of individuals to part with that information. As consent is not being taken, there is no question of ‘waiving’ or foregoing the right to privacy that arises here. Taking this forward, even non-consensual data collection for protecting public health during the Covid-19 pandemic does not involve any ‘trade-off’ or sacrifice of privacy.

This leads to one common end – which is that when the State collects, uses and stores Covid-19 related data, it should do so in a manner that safeguards privacy. As long as the State does not stick to its rigid stance of viewing privacy and public health as a direct trade-off, it is very much possible to simultaneously safeguard privacy and public health, during this pandemic.

Simultaneously safeguarding privacy and public health

Now, all the measures that have been referred to above can be replaced with alternatives that safeguard privacy, and achieve the objective of protecting public health with equal efficacy. Instead of coercing those under home quarantine to upload hourly selfies, the State can facilitate their quarantine by asking officers or healthcare workers to visit them on a periodic basis, and ensure that they have access to all basic facilities. Such a process shall build mutual trust, which may be more beneficial in ensuring that the quarantine requirements are adhered to.

Uploading of selfies with geo-location data also results in a certain level of stigma. To avoid this stigma, individuals in future may refuse to cooperate and give details about their symptoms, and may also refuse to come forward to get themselves tested. This shall ultimately affect the objective of protecting public health. Hence, not safeguarding privacy may also compromise the State’s larger objective of safeguarding public health.

With respect to sharing and storing of medical data, the State can very well store the data in govt servers, and need not open a Pandora’s box by delegating such actions to a private entity, which is not accountable to ensure confidentiality. It should also ensure that the data is anonymized, in a manner that ensures that no personally identifiable information is publicly accessible. This localized storage of data in govt servers and data anonymization was one contention in the petition filed against the Kerala govt - for sharing the data with Sprinklr. Even in this scenario, storing the data in govt servers and ensuring data anonymization shall not in any way compromise the objective of safeguarding public health.

Finally, making Aarogya Setu mandatory when the app is in its nascent stages leads to further complications, as the State may not have adequately tested the security infrastructure where large amounts of sensitive data (such as geo-location data) are supposed to be collected and stored. The State also has an interest in ensuring that this sensitive personal information such as medical data or geo-location data is not misused by foreign entities for nefarious purposes. Hence, along with compromising privacy, making Aarogya Setu mandatory may create new security vulnerabilities and additional complications for our data infrastructure.

The above discussion highlights that giving scant regard to privacy may lead to unintended consequences. Giving scant regard to privacy for public health may, along with compromising privacy, also compromise public health and security. As Covid-19 is unlikely to die down anytime soon, a lack of privacy safeguards may create a data epidemic along with this pandemic. We, as citizens, must hence continue to be vigilant.

Can the right to privacy be ‘traded-off’ for access to a better standard of living? - Rebutting the arguments made in the 2019 Economic Survey

In this post, we shall discuss one recommendation made in the Economic Survey of 2019, which was published in July last year. This recommendation dealt with using data as a ‘public good’, and it was simultaneously assumed that the poor will be willing to trade-off their privacy for access to a better standard of living. I shall rebut this assumption, and shall argue that ‘trading-off’ the right to privacy for access to a better standard of living lacks constitutional basis.

Background: The arguments and assumptions made in the 2019 Economic Survey

The Economic Survey of 2019 contained a specific chapter (Chapter 4) dedicated to the use of personal data - for effective delivery of social welfare schemes and government services. This Chapter was titled as -‘Data of the people, by the people and for the people’. Before discussing what the Survey argued, it is important to keep note that the Economic Survey as a document is only analytical and recommendatory in nature, and does not bind the government in any manner. However, the arguments made in the Survey merit discussion - as they give indications of the direction that the Government may take in future.

The authors of the survey argued that data should be used as a ‘public good’ – to ensure effective delivery of welfare schemes and services. They argued that existing data is ‘scattered’, and the government must merge and integrate different data-sets through tools such as Aadhaar. While proposing to use data as a ‘public good’ by merging and integrating different personal data sets accessible to the Government, the Survey made two broad assumptions.

First, the Survey assumed and concluded that a sufficient legal framework already exists to safeguard privacy. This assumption is majorly flawed – as if India already had a sufficient framework to safeguard privacy, there would have been no need for a Personal Data Protection Bill. The second assumption made in the survey was that the poor would be willing to ‘trade-off’ their privacy for access to a better standard of living. It was stated that the ‘elitist’ notion of privacy should not be imposed on the poor, who desire access to a better standard of living. It is this assumption that merits further scrutiny.

I aim to make three arguments below, which are as follows: (i) it is incorrect to assume and conclude that the poor do not value privacy, and are willing to trade-off privacy for access to a better standard of living; (ii) rights should not be categorized as ‘elitist’ in nature, as their scope and conception may vary with changing times; and (iii) ‘trading-off’ or ‘waiving’ the right to privacy for social welfare does not have a constitutional basis.  

Do the poor value their privacy?

Under Part III of the Indian Constitution, certain fundamental rights such as Article 19 are available to citizens, while other fundamental rights such as Article 14 and Article 21 are available to all persons. As held by the 9-judge bench of the Supreme Court in the KS Puttuswamy decision, privacy is a fundamental right that is intrinsic to individual liberty, dignity and autonomy. The right to privacy flows from Part III of the Constitution, and akin to the other rights that have read into Article 21, is available to all persons. This means that the right is universal in nature, and does not in any way hinge on the economic status of a person.

Now, to what extent the poor value their privacy when compared to other sections of society is subjective. Persons residing in slums and villages also try to safeguard themselves from unwarranted intrusion or stigma – which are facets of the rights to privacy. While the poor may not have the means to enforce this right when compared to other privileged sections of society, it is incorrect to make a blanket claim that they do not value the same.

The fallacy with viewing rights as elitist in nature

It is fallacious to view rights as ‘elitist’ in nature, as the scope and conception of a right may vary with changing times. This can be illustrated by referring to the history of the right to property in India, which was initially a fundamental right. But, through the 44^th Amendment of the Indian Constitution, the right to property was deleted as a fundamental right, and was relegated to the status of a legal right under Article 300A.

Post- independence, during the Nehruvian era, it was argued that the fundamental right to property worked solely to the benefit of the rich landlords and zamindars, who invoked it while challenging land reform legislations. It was argued that this fundamental right only acted as a hindrance to implementation of legislations aimed at land redistribution, as it gave a tool to the zamindars to challenge the usurpation of their property by the State.

But, over the years, the right to acquire and hold property has become most significant for destitute farmers, who are often deprived of their land (which was their only means of livelihood) when it is acquired by the State for industrial and infrastructure purposes. Unlike the situation in the 1950s, the right to hold property is today most valued today by the poor farmer – who loses his land to State acquisition. The nature, scope and conception of a right may hence vary with changing times, which is why all fundamental rights are universal by their very nature, and cannot be conceptualized as ‘elitist’ or solely for the privileged.

Does ‘trading-off’ privacy have any constitutional basis?

‘Trading-off’ privacy for access to a better standard of living implies a ‘waiver’ of the right to privacy. But, as the Supreme Court held in Basheshwar Nath v. CIT, fundamental rights conferred by Part III cannot be waived. Although this decision was in a different context, it’s holding with respect to non-waiver of fundamental rights is also applicable to the right to privacy. Let us take two examples to illustrate this.

Let us first take the illustration of a women named ‘X’, who enrolls for an Aadhaar number. When X enrolls for an Aadhaar number, she is not ‘waiving’ or giving up her privacy. She is only sharing some personal information with the State. She still continues to have privacy over the data that is shared, and can file a legal claim if there is unauthorized use or sharing of her data.

Let us take another example. When X downloads Whatsapp, the application collects a certain amount of personal data. X parts with this information to gain access to the service provided by Whatsapp. X continues to retain privacy over this data, and is entitled to a legal remedy if Whatsapp shares the data to a third party in an unauthorized manner. These two examples illustrate that when we part with our personal data, we do not automatically waive our privacy over this data, which continues to be safeguarded.

This can be further buttressed by referring to the decision in District Registrar v. Canara Bank, which concerned whether a customer had a right to privacy over financial records that were held by the Bank. It was held that the right to privacy belongs to people and not places. This means that as long as the data belongs to the person, there shall be a right to privacy over such personal data. The place where the data is located or whether the data has been handed over to a third party is of no relevance. This case also illustrates that parting of personal data does not imply an automatic waiver of privacy.

Hence, creating a dichotomy between privacy and access to a better standard of living lacks a constitutional basis. When the poor give their personal data to the State, they do not ‘trade-off’ their privacy for access to a better standard of living. They continue to have a right to privacy over their data. For the reasons pointed out above, if the State were to use data as a ‘public good’ for social welfare purposes, it has a constitutional obligation to do so in a manner that safeguards different aspects of privacy. We must accordingly avoid falling into the trap of creating a conflict between privacy and social welfare, as both can mutually coexist.

(The discussion in this post shall serve as the foundation for our subsequent discussion regarding whether there has to be a trade-off or a prioritization between right to privacy and right to health, during the prevalence of the Covid-19 pandemic)

How integration of databases through Aadhaar severely compromises privacy

In this post, we shall discuss how integration of multiple databases through the Aadhaar number severely compromises privacy - by making it possible to profile and surveil the activities of a person.

In 2009, the Aadhaar project commenced after the Union Government set-up the Unique Identification Authority of India (UIDAI) through an executive notification. Under the Aadhaar project, a resident is required to submit his name, date of birth and place of residence, along with his biometric information – which includes fingerprints and iris scans. The individual would then obtain a twelve-digit unique identity number, which could be printed as an Aadhaar card, and used for establishing one’s identity while availing government services and welfare schemes.

After enrolling for Aadhaar an receiving their unique identity number, an individual could ‘authenticate’ his Aadhaar details to establish his identity for availing welfare schemes and services. While Aadhaar was initially intended to be voluntary mechanism for establishing one’s identity, attempts were made to make enrolling for Aadhaar a mandatory precondition to avail certain subsides and benefits. These attempts were shot down by the Supreme Court in 2013. Subsequently, the Aadhaar Act, 2016 was enacted, and the Union Government created a statutory framework that authorized the collection of identity and biometric information.

The passing of the Aadhaar Act, 2016

Under Section 7 of the Aadhaar Act, Aadhaar-based authentication can be used to establish the identity of an individual, while receiving ‘subsidies, benefits and services, whose expenditure is incurred from the Consolidated Fund of India. Section 2(c) of the Act defines the term ‘authentication’ as the process by which the Aadhaar number of an individual along with his/her biometric and demographic information is submitted to the centralized Aadhaar database (known as the Central Identities Data Repository) for verifying the individual’s identity.

The Preamble to the Act mentions that it’s purpose is to ensure efficient and targeted delivery of subsidies, benefits and services. The Union Government has accordingly contended that Aadhaar helps eliminate identity fraud, and also eliminates fake and duplicate beneficiaries of welfare schemes.

The expansion of the use of Aadhaar

After the coming into force of the Aadhaar Act, having an Aadhaar number was made a mandatory condition precedent for accessing a wide variety of welfare schemes, subsidies and services. The range of schemes and services for which Aadhaar has been made mandatory include – the bonded labour rehabilitation scheme, for persons rescued from manual scavenging to avail rehabilitation schemes, midday-meal scheme, for availing MGNREGA payments, for availing scholarships, appearing in entrance exams etc.

Hence, the scope and ambit of Aadhaar has expanded manifold from what it was originally envisaged for – which was for better targeting of government subsidies that were prone to leakage and corruption. Usha Ramanathan has described this expansion of the use of Aadhaar as a ‘function creep’ -  a scenario where technology that was created for a specific purpose is expanded beyond it’s original objective.

The seeding of multiple databases through the Aadhaar number, and its perils

The expansion of Aadhaar has resulted in a situation where the Aadhaar number of an individual is being ‘seeded’ or linked across multiple databases. This can be illustrated by referring to the following illustration. When an individual who has been rescued from manual scavenging seeks to take the benefit of rehabilitation schemes, he has to link his Aadhaar number with the rehabilitation scheme database.

The same individual may also use his Aadhaar number for availing subsidized foodgrains from the Public Distribution System ( PDS). His Aadhaar number may then get linked to the PDS database. The seeding of the Aadhaar number makes it a common identifier across multiple databases. This seeding of the Aadhaar number also creates a single point of failure – where even if one database is compromised through a data breach or a data theft, then all the other Aadhaar-linked databases become susceptible.

Privacy concerns associated with seeding of multiple databases with Aadhaar as the common identifier

The manner in which the seeding of the Aadhaar number across multiple databases violates the right to privacy was highlighted by Chandrachud, J in his dissenting opinion in the K.S. Puttuswamy II case, where the constitutionality of the Aadhaar project was adjudicated upon. Chandrachud, J pointed out that the seeding of the Aadhaar number across different databases makes the Aadhaar number the ‘central unifying feature’ which may connect information that would usually be unconnected. It could also be used to profile individuals by creating co-relation between human lives, and was capable of influencing the behavioral patterns of individuals, in a manner that would affect their privacy and liberty. He further goes on to state that if traces of the Aadhaar number are ‘left in every facet of human life’, the result shall be a loss of privacy.

Chandrachud, J then mentions that when the Aadhaar number is seeded in every database, it becomes a ‘bridge across discreet data silos’. Anyone with access to the seeded databases can construct a detailed profile of an individual’s life, which was contrary to the right to privacy. This implies that anyone who has access to the seeded databases can collate information about various facets of an individual’s life – such as his religion, economic status, affiliations, medical history etc. He then highlights how seeding of the Aadhaar number nullifies the restriction placed on profiling of individuals by Section 2(k) of the Aadhaar Act. Under Section 2(k), the UIDAI cannot collect and store information relating to the race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history of the individual.

However, when the Aadhaar number is seeded across multiple databases, the effective result is the collection of information relating to religion, ethnicity, medical history, income etc, which nullifies the restriction placed under Section 2(k). This can be illustrated with an example that Chandrachud, J gives in his opinion. When a person from a particular caste is rescued from manual scavenging and seeks to take benefit of rehabilitation schemes, he has to get his Aadhaar number linked to the rehabilitation scheme database. This effectively results in a situation where a profile of that person, as someone who has engaged in manual scavenging, gets permanently added to the scheme database. The stigma of being a manual scavenger in the past gets permanently fixed to the person’s identity.

The same person may use his Aadhaar number for availing other benefits, which shall ensure that his Aadhaar number is seeded across other databases. Anyone accessing these databases can then generate a detailed profile about that individual, by collating information relating to categories relating to the race, religion, ethnicity etc. This can be further illustrated through another example of the Ujjwala scheme. Under the Ujjwala scheme, rehabilitation services are provided for victims who have been rescued from trafficking for commercial sexual exploitation. Even under the Ujjwala scheme, the services can be availed only if the individual links her Aadhaar number with the scheme database. Hence, one the victim submits her Aadhaar number, the stigma of being someone who was trafficked for sexual exploitation gets permanently attached to the victim’s identity.

The victim may in future use her Aadhaar number to avail health services under the Ayushman Bharat Yojana or the National Health Mission. Her Aadhaar number shall then be seeded with this scheme database, which may also contain other information regarding her medical records and medical history. The Aadhaar number hence becomes a central unifying feature across all the linked databases. Anyone who accesses these databases can use the Aadhaar number to deconstruct a profile of the victim’s life – by taking note of her stigmatic past as a victim of sexual exploitation, her medical records, religion etc. The seeding of Aadhaar across multiple databases may accordingly lead to profiling, and effectively nullifies the restriction placed by Section 2(k). This, as Chandrachud, J argues, has the threat of potential surveillance over the activities of the individual, and is contrary to the right to privacy. This was one of the main reasons for his ultimate conclusion – which was that the Aadhaar project as a whole was unconstitutional.

From a reading of Chandrachud, J’s opinion, it is implicit that he does not consider the seeding of Aadhaar to be a reasonable restriction on the right to privacy, even if such seeding is for trying to bring about more efficient delivery of subsidies and welfare schemes. The majority opinion authored by Sikri, J on the other hand only struck down the seeding of the Aadhaar number with databases owned up private parties – such as the seeding of Aadhaar number with bank accounts. With respect to the use of Aadhaar for government welfare schemes, the majority took the view that the invasion of privacy through Aadhaar was ‘minimal’, and that the Aadhaar Act had achieved a fair balance between the right to privacy and other socio-economic rights, such as the right to food.

The majority also did not specifically prevent the government from making Aadhaar authentication a mandatory condition precedent for availing welfare schemes. It only expressed hope that no benefits shall be denied to a person if there is an authentication failure, technical error etc. This way, the majority has also impliedly upheld the seeding of the Aadhaar number across multiple government databases. Hence, while Chandrachud, J concluded that seeding of the Aadhaar number across multiple data was not a reasonable or proportionate restriction on privacy, the majority concluded that the use of Aadhaar achieved a fair balance between privacy and other socio-economic rights.

Conclusion

While there can be differing viewpoints on whether this restriction can be considered as reasonable, what cannot be disputed is that the seeding of the Aadhaar number can result in profiling of an individual, which severely impinges on his privacy. Such profiling of information can be then used by different government departments to surveil upon the activities of a person. Hence, for the reasons mentioned above, the seeding of the Aadhaar number across multiple databases leads to a severe compromise of individual privacy. After the constitutionality of the Aadhaar project was upheld by the Supreme Court, the Government effectively has a carte blanche to merge multiple databases with the Aadhaar number as the common identifier. Ergo, we as citizens should continue to be vigilant, and safeguard our fundamental rights.