Shri Narendra Modi
Government of India
Minister of Electronics and IT
Government of India
- Shri Santosh Kumar Gangwar
Minister of Labour & Employment
Government of India
Minister of Home Affairs
Government of India
Minister of Road Transport & Highways
Government of India
1 May 2020
Subject: Representation to protect privacy, autonomy and dignity of workers during COVID-19 outbreak
We, the undersigned organizations, collectives and individuals write this representation to your offices to express serious concern about the violation of the privacy of workers through mandated use of the Aarogya Setu mobile app. We acknowledge the severity of the COVID-19 crisis which has gripped the country and maintains that it is especially during such public health emergencies that we must ensure the privacy and dignity of essential frontline workers are protected.
During the ongoing COVID-19 crisis, the government has embraced the use of technology for health surveillance and it launched a mobile app called Aarogya Setu for self-assessment and contact tracing on 02 April 2020. While the government initially claimed that the use of Aarogya Setu would be purely voluntary, downloading the app was soon made mandatory for all Central Armed Police Forces personnel and employees of Prasar Bharati. However, as per news reports, army personnel have been instructed not to use the Aarogya Setu app at office premises, operational areas and sensitive locations due to data security concerns.
So far, some companies, notably Zomato and Urban Company, have mandated use of Aarogya Setu for their delivery workers. As lockdown restrictions are gradually eased and other food delivery services, e-commerce platforms and ride-hailing apps resume operations, they may take the decision to mandate the use of Aarogya Setu for their workers. In the near future, mandatory use of Aarogya Setu may also extend beyond the gig economy and undermine the rights and interests of workers in the traditional economy such as factory workers.
While many delivery personnel and drivers share location data with their companies as part of routine business operations, the privacy risks posed by the Aarogya Setu app are much higher for two reasons. First, the Aarogya Setu app will collect sensitive health data in addition to location data. Second, while location data was previously only shared with the employer, it will now also be available to government agencies through the Aarogya Setu app. Therefore, the intrusion on the privacy of gig and platform workers is significantly greater than ordinary workplace surveillance. In any case, companies already have access to data about the location of workers and their interactions with customers, and contact tracing is possible even without the Aarogya Setu app.
It is pertinent to note that the Central Government has not mandated private companies to use Aarogya Setu and it remains a voluntary measure, however, in effect it is being made mandatory by such entities. A news report titled ‘Draft e-com SOP: COO responsible for meeting norms, staff to download Aarogya Setu app’ published by the Economic Times on 19 April 2020 suggests that the Government had privately circulated a Draft Standard Operating Procedure for E-commerce with stakeholder companies which mandates the use of Aarogya Setu by all workers. The Draft Standard Operating Procedure also holds the Chief Operating Officer of the company responsible for any failure to abide by these guidelines. Therefore, mandating the use of Aarogya Setu appears to be a liability reducing measure by private companies and it amounts to the government indirectly mandating the use of the app after publicly assuring citizens that it would not do so.
The Aarogya Setu app has been heavily criticized for failing to adhere to internationally recognized data protection principles endorsed by the Hon’ble Supreme Court in the landmark judgement in K.S. Puttaswamy v. Union of India (2017 10 SCC 1). In Puttaswamy (Privacy), the Court recognized that privacy was a fundamental right guaranteed under the Constitution of India. The Court further noted in the age of Big Data, collection and processing of personal data of individuals can reveal a lot about their lifestyle, choices and preferences. The Court acknowledged that in certain circumstances, the use of such technologies may be justified if the government was pursuing a legitimate goal. However, even in such circumstances, these technologies must be deployed in a necessary and proportionate manner.
In order to satisfy the proportionality standard adopted in Puttaswamy (Privacy), the use of any privacy infringing technology must satisfy five criteria. First, it must have a legislative basis. Second, it must pursue a legitimate aim. Third, it should be a rational method to achieve the intended aim. Fourth, there must not be any less restrictive alternatives which can also achieve the intended aim. Finally, the benefits must outweigh the harm caused to the right holder. In the present case, Aarogya Setu fails the very first prong of the proportionality standard because it does not have a legislative framework to govern its functioning and to ensure adequate procedural safeguards. In the absence of a legislative guarantee containing a sunset clause, sensitive personal data about health and movement of gig workers collected by the Aarogya Setu app could be misused for profiling and mass surveillance even after the COVID-19 outbreak is over.
In the specific context of health data, the judgement in Puttaswamy (Privacy) emphasized on the need for a data protection legislation to ensure that personal data was not used to discriminate against individuals on the basis of their health status. The Court further went on to note that the government may collect and process health data of individuals during epidemics to design appropriate policy interventions but such data must be anonymized.
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 issued under Section 43A of the Information Technology Act, 2000 similarly classify health data as “sensitive personal data” and specify that health data can be collected and processed by body corporates only with the consent of the individual [Rule 5(1)]. The Rules also impose various obligations on body corporates relating purpose limitation [Rule 5(2) and 5(5)], notice [Rule 5(3)], storage limitation [Rule 5(4)], right to access and correction [Rule 5(6)] and right to opt-out [Rule 5(7)].
The proposed Digital Information Security in Healthcare Act also lays down stringent safeguards to preserve the confidentiality of digital health data and associated personally identifiable information. The draft legislation recognizes that individuals must consent to collection and sharing of their health data and it outlines specific purposes for which health data can be utilized by different entities. Pertinently, the proposed Act permits the use of digital health data for epidemic control only after it has been anonymized or de-identified and it
prohibits employers from accessing the health data of workers under any circumstances. Therefore, even though India does not have a comprehensive data protection legislation at present, the importance of protecting health data of individuals has been recognized by the judiciary and the government.
In addition to lacking legislative basis, the Aarogya Setu app deviates from international best practices for contact tracing apps and fails to comply with data protection standards for the following reasons:
a. Lack of Consent: The use of Aarogya Setu cannot be considered voluntary anymore as it has been made mandatory for delivery workers. Therefore, there is no scope for delivery workers to refuse consent or opt-out.
b. Lack of Data Minimization: Registration for the Aarogya Setu app requires sharing large amount of personal data: name, phone number, age, sex, profession, countries visited in the last 30 days and smoking habits. This is inconsistent with the principle of data minimization.
c. Lack of Transparency: While it is claimed that personal data collected by Aarogya Setu is aggregated and anonymized, there is no publicly available information about what processes and techniques are followed for aggregation and anonymization. This is relevant because there is high risk of re-identification unless personal data is properly anonymized. Therefore, the app must be subjected to thorough security testing by governmental and independent agencies.
d. Lack of Algorithmic Accountability: The Terms of Service for Aarogya Setu exempt the government from any liability arising out of misidentification of an individual’s COVID-19 status. Therefore, individuals are left at the mercy of opaque algorithms which perform risk assessment and do not have any remedy in case of false positives. If gig and platform workers were falsely identified as high risk individuals by Aarogya Setu’s algorithm, they would be required to self- isolate and lose their income and freedom of movement.
f. Risk of external transfer and integration with other databases: Personal data collected by the Aarogya Setu may be transferred to an external cloud-based server and there is no guarantee that it will only be stored locally on the individual’s device. Reports suggest that the data collected by Aarogya Setu is being integrated with other databases maintained by the Indian Council for Medical Research and Integrated Disease Surveillance Programme. This is worrisome because it is difficult to delete such integrated datasets and secondary inferences at a later stage.
Classified as independent contractors, gig and platform workers do not enjoy the same level of income and job security as legally recognized employees. They are particularly vulnerable during the COVID-19 crisis when finding alternative employment is practically impossible and they lack bargaining power vis a vis companies or the government. Therefore, they should not be forced to download the Aarogya Setu app which lacks transparency and accountability in its present form.
The International Labour Organization’s guidance on applicable labour standards during the COVID-19 pandemic dated 23 March 2020 also clearly states that governments must put in place measures to protect the privacy of the workers. It also instructs governments to ensure that health surveillance is not used for discriminatory purposes or in any other manner prejudicial to their interests.
In addition to these privacy concerns, there is also a need for governmental intervention to provide income security to gig and platform workers who have been unable to work during the lockdown or have witnessed a significant drop in their earnings due to low demand. Gig and platform workers are paid per delivery and they are not guaranteed a stable income. As a consequence, despite toiling for long hours during these difficult times, many gig and platform workers are still struggling to make ends meet because there are not enough deliveries for everyone. Further, personal protective equipment and medical insurance should be provided to gig and platform workers who are at risk of contracting COVID-19 due to exposure to many customers every day.
In collaboration with gig workers’ unions, Tandem Research and Centre of Internet & Society have developed a comprehensive charter of recommendations for COVID-19 relief measures to protect the socio-economic well-being and health of gig workers, and we urge your Ministry to address these issues of financial relief and occupational health safety as well.
Considering the damaging impact of the Aarogya Setu app and COVID-19 lockdown on the privacy, autonomy and dignity of workers, we urge your office to undertake the below mentioned measures in collaboration with the private sector.
a. Take cognizance of privacy concerns associated with Aarogya Setu and issue an advisory clarifying that use of the app should not be made mandatory for workers in the gig economy and also the traditional economy.
b. In addition to (a), to ensure greater safety, rely on certain methods of risk mitigation such as working with companies to provide daily temperature checks and personal protective equipment to all gig and platform workers who continue working during the COVID-19 pandemic.
c. Further, devise the right incentive structures both for companies and workers to ensure that gig and platform workers are able to sustain themselves during the lockdown and those displaying symptoms of COVID-19 are not forced to work to ensure their livelihood. This includes provisions for medical insurance and financial relief to all gig and platform workers who have been unable to work during the lockdown or have witnessed a significant decrease in earnings due to low demand.
All India Central Council of Trade Unions
All India Union of Forest Working People
Asia Dalit Rights Forum
Association for Progressive Communications
Association for Protection of Democratic Rights
Chennai Metropolitan Construction and Unorganised Workers Union
Delhi Solidarity Group
Digital Empowerment Foundation
Feminism in India
Forum Against Oppression of Women, Bombay
Foundation for Media Professionals
Free Software Community of India
Human Rights Law Network
Indian Delivery Lions Organization
Indian Federation of App Transport Workers
Indian Journalists Union
Indian Social Action Forum
Internet Democracy Project
Jan Swasthya Abhiyan, Mumbai
Jharkhand Nagrik Prayas
LABIA - A Queer Feminist LBT Collective
Mazdoor Kisan Shakti Sangathan
National Alliance of People’s Movements
National Adivasi Alliance
National Fishworkers’ Forum
Pakistan-India Peoples’ Forum for Peace & Democracy, India Chapter
Point of View
Pothe Ebar Namo Sathi
People’s Union of Civil Liberties
People’s Union for Democratic Rights
Red Dot Foundation
Socialist Party of India
Swathanthra Malayalam Computing
United Christian Forum
Abha Bhaiya One Billion Rising
Abhinav Anand Student
Akram Parvez Technical Art Director
Ammu Abraham PUCL Maharashtra
Anand Patwardhan Film Maker
Ankur Sarin Faculty, IIM Ahmedabad
Anuradha Kapoor Feminist Activist
Arun PS Policy Researcher
Ashish Ghosh Retired Teacher, University of Delhi
Asis Kumar Das Social Activist
Avani Chokshi Advocate
Basawa Prasad Kunale Advocate
Brijesh Kumar Former Secretary, Ministry of Electronics & Information Technology
Brinda Adige Ananya Mahila Okkutta
Ch Narendra Senior Journalist
Chayanika Shah Queer Feminist Writer and Researcher
Chitra R Educator
Darshan R Software Engineer
Deepak Mukarji Founder Member, United Christian Front
Dr Shakeel Physician
Dr Mira Shiva Public Health Physician
Dr Mohan Rao
Former Professor, Centre of Social Medicine and Community Health,
Dr Tusharkanti Dey
Community Health Advisor (Retired), All India Institute of Hygiene
& Public Health
Felix Padel Anthropologist and Author
Gautam Bhatia Advocate
Geeta Seshu Free Speech Collective
Gurbir Singh President, Mumbai Press Club
Gurshabad Grover Technology and Law Researcher
Harsh Kapoor South Asia Citizens Web
Indira Unninayar Advocate
Irfan Engineer Director, Centre for Study of Society and Secularism
Janaki Srinivasan IIIT-Bangalore
Japleen Pasricha Feminist Activist and Entrepreneur
John Dayal Former President, All India Catholic Union
Kalyani Menon Sen Feminist Learning Partnerships
Kannan Gopinathan Former IAS Officer and Activist
KP Sasi Filmmaker
Kunal Majumdar Committee to Protect Journalists
Leo Saldanha Researcher
Madhu Bhaduri Retired IFS Officer
Madhu HS Chartered Accountant
Maitreyi Krishnan Advocate
Manoj Mitta Journalist and President, FMP
Mary Mathai Former Chemist and Homemaker
Meena Gupta Retired Civil Servant
Megha Garg Gandhi Fellow
Nachiket Udupa Activist
Nadika N Writer and Researcher
Nidhi Agarwal Activist
Nikhil Naren Advocate and Author
Oishik Sircar Associate Professor, Jindal Global Law School
Padmini Ray Murray Design Beku
Pamela Philipose Journalist
Paranjoy Guha Thakurta Journalist and Filmmaker
Prabha Nagaraja TARSHI
Pradeep Esteves Context India
Prajval Shastri Astrophysicist
Prof. Sandeep Kumar Shukla
Professor, Department of Computer Science and Engineering, IIT
R Ramanujam Professor, Institute of Mathematical Sciences, Chennai
Rahim Contractor Civil Engineer
Former Professor, Department of Economics, M. D. University,
Rashi Balachandran Human Centred Designer
Reetika Khera Associate Professor, IIM Ahmedabad
Revati Laul Journalist and Director, FMP
Rishab Bailey Technology and Law Researcher
Director and Professor, Department of Economics, University of
Rupsa Mallik CREA
Salma Francis Vision for Oasis Waves Society (VOWS)
Sandeep Pillai Software Professional
Sandhya Gokhale Forum Against Oppression of Women, Mumbai
Sanjay Kak Filmmaker
Satyavir Singh Former Principal Commissioner, Customs and Central Excise
Assistant Professor, West Bengal National University of Juridical
Sebastian Poomattam Lawyer and Priest
Sharanya Nayak Activist
Shivaji Sarkar National Union of Journalists
Shreya Munoth Advocate
Soma Basu Journalist and Media Researcher
Sonakshi Yadav Student
Sreechand Tavva Independent Technology Consultant
Srikanth L Cashless Consumer
Srikanth. KS Independent Researcher
Srinivas Kodali Free Software Movement of India
Srinivasan G Software Professional
Subhashis Banerjee Professor, Dept of Computer Science and Engineering,
IPoS (Retd.) Former Deputy Director General, Ministry of Communications, Government of India
Subodh S Gupta Public Health Professional
Subodh Sharma Professor, Dept of Computer Science and Engineering, IIT Delhi
Sudhanshu Pathania Ph.D Scholar, NALSAR
Sujata Patel Distinguished Professor, Savitribai Phule Pune University
Sukla Sen Peace Activist
Sulakshana Nandi Public Health Researcher
Sundar Burra Retired IAS Officer
Sunep Imsong Technologist
Sunila Singh Women’s Rights Activist
Swati Punia Lawyer
Tara Murali Architect
Tarunima Prabhakar Project and Research Lead, Tattle Civic Technologies
Teesta Setalvad Citizens for Justice and Peace
Ujjwal Singh Professor, Department of Political Science, University of Delhi
Vandana Mahajan Independent Feminist
Vickram Crishna Independent Researcher
Vinay K Sreenivasa Advocate
Virginia Saldanha Activist
Xavier Dias Editor, Khaan Kaneej Aur Adhikaar
Zafar Iqbal Former Civil Servant, Consultant and Advocate