Update on Anivar A Aravind v. Ministry of Home Affairs, GM PIL WP (C) 7483 of 2020

SFLC.in’s advisory board member Mr. Anivar A Arvind has filed a petition in the Karnataka High Court challenging the voluntary-mandatory imposition of Aarogya Setu and invasion of privacy rights in the absence of specific legislation governing data collection and processing by it. He is represented by Senior Advocate Colin Gonsalves, Counsels from SFLC.in, Advocate Clifton D’ Rozario, Advocate Avani Choksi, and Advocate Ali Zia Kabir in the matter.        

Till now the Government of India through the Ministry of Railways, Airports Authority of India, and Ministry of Civil Aviation has stated on record that Aarogya Setu is not mandatory to avail rail or air services. The Airports Authority of India also had to revise their state-wise quarantine guidelines which had initially made Aarogya Setu mandatory. Similarly, Bangalore Metro Rail Corporation Limited (BMRCL) withdrew its initial statement that Aarogya Setu was mandatory for metro commuters. The Ministry of Housing and Urban Affairs also amended their draft Standard Operating Procedure (SoP) which had made Aarogya Setu mandatory for metro commuters. The now notified SoP by Ministry of Housing and Urban Affairs states that the installation of Aarogya Setu is advisable in nature. 

In addition to this, the Karnataka High Court, on 19.10.2020 passed an order stating that no service or benefit will be denied by state or state instrumentalities to any citizen for not installing Aarogya Setu. 

Update on Proceedings Dated 11.12.2020

In today’s hearing, Senior Advocate Colin Gonsalves argued that: 

1. On voluntary-mandatory nature: 

The Union of India, in its statement of objections, has categorically stated that Aarogya Setu is voluntary in nature. To substantiate the same, it has relied upon the Ministry of Home Affairs guidelines dated 17.05.2020 and the subsequent guidelines issued by MHA. These guidelines require the installation of Aarogya Setu on best efforts basis. 

Senior Advocate Colin Gonsalves argued that there are still approximately 135 instances where Aarogya Setu has been made mandatory by State or private entities. He relied on the Aarogya Setu tracker maintained by the Internet Democracy Project which has been ordered to be placed on record by the Court. He also said that “best-effort” basis is de-facto mandatory because no employee will refuse to install Aarogya Setu if their employer asks them to install it. He argued further that such consent does not amount to informed consent. 

He then read out the definition of consent and anonymization from the draft Personal Data Protection Bill, 2019 and drew the court's attention to Clause 11 of the Bill which provides for “consent necessary for processing of personal data”.

2. On lack of specific legislation governing Aarogya Setu: 

The Union of India, in its statement of objections, has contended that the Aarogya Setu derives its legislative backing from the National Disaster Management Act, 2005 (hereinafter “the NDMA, 2005”). Section 10(2)(l) of the NDMA, 2005 provides that the National Executive Committee can lay down guidelines for, or give directions to, the concerned ministries or departments of the Government of India/ State Government etc. regarding measures to be taken by them in response to any threatening disaster situation or disaster. 

In addition to this, the Union of India has contended that Aarogya Setu is governed by the Aarogya Setu Data Access and Knowledge Sharing Protocol which was released on 11.05.2020. 

Senior Advocate Colin Gonsalves contended that this is in contravention of the Puttaswamy (2017) judgment also known as the Right to Privacy judgment, it was held that “There must be a law in existence to justify an encroachment on privacy is an express requirement of Article 21. For, no person can be deprived of his life or personal liberty except in accordance with the procedure established by law. The existence of law is an essential requirement.” He argued that a protocol is no substitute for a law and that the NDMA, 2005 is a general law that does not govern data collection, processing, or sharing, and therefore, is not a valid law for the purposes of governing data collection and processing by Aarogya Setu. Senior Advocate Colin Gonsalves also emphasized on the 11 principles laid down in the Puttaswamy (2017) judgment. 

3. The  Purpose Limitation Test

Senior Advocate Colin Gonsalves argued that the Aarogya Setu does not pass the purpose limitation test as it has been extended to e-pass, donations, telemedicine consultation, status check, and Open API services. While reading out the terms of service for Aarogya Setu Open API, it was argued that even security is sub-contracted to companies. 

4. The functionality of the App

Senior Advocate Colin Gonsalves referred to the IEEE paper titled “A survey of COVID-19 contact tracing Apps” and informed the court that Aaorgya Setu is prone to relay attacks. He also highlighted the problems with proximity estimation, GPS, and false negatives. In addition to this, he argued that the number of downloads is an insufficient metric to gauge the success of an app. 

5. The Aarogya Setu Protocol

Senior Advocate Mr. Colin Gonsalves brought Court’s attention to Aarogya Setu Data Access and Knowledge Sharing Protocol. He referred to the phrase “strictly necessary” in Para 6(e) and contended that it is delightfully vague. He also drew Court’s attention to Para 5(e) of the Protocol which states that the demographic data will be retained as long as the Protocol will remain in force. This means that the demographic data can be retained forever unless the individual requests the deletion of their data. 

6. The Sunset Clause

Regarding the sunset clause, Mr. Gonsalves argued that the sunset clause pertains to the Protocol and not to the App itself. Therefore, there is no sunset clause for Aarogya Setu. 

7. Open-sourcing of Aarogya Setu

Senior Advocate Mr. Colin Gonsalves argued that even the open-sourcing of Aarogya Setu is partial in nature wherein the version of App on Play Store does not correspond to the version available on GitHub. 

The matter has been now listed for hearing on 15.12.2020 at 12:45 PM.

Also, read our coverage of the matter here:

1. Aarogya Setu is optional for air passengers, Airport Authority of India informs Karnataka High Court

2. Karnataka High Court orders the State of Karnataka to clarify its stance on Aarogya Setu

3. Karnataka High Court allows amendment of petition in Aarogya Setu case: Update on petition challenging Aarogya Setu's voluntary-mandatory nature and lack of a specific legislation

4. Aarogya Setu is not mandatory for air or rail travel

5. Petition Challenging the de-facto imposition of Aarogya Setu in Karnataka High Court