As the world grapples with the Covid-19 pandemic and its profound impact across regions and industries, the aim for all countries in stemming the coronawave is to ensure the right to health and right to life, using least restrictive measures, respecting principles of liberty, equality and privacy. The pandemic’s devastating onslaught has resulted in adoption of multidimensional policies such as locking down borders, analysing travel history, leveraging technology to trace and isolate the infected, establishing isolation centres to test and treat the virus, etc.
Till now, India’s response to coronavirus has consisted mainly of restrictive measures. The containment strategy while an essential measure to protect the right to health and life, has had a severe impact on our basic human rights and civil liberties like freedom of movement and assembly, right to personal liberty and privacy and, in some circumstances, freedom of expression and press.
Under human rights laws, barring certain absolute rights, states have a wide “margin of appreciation” to derogate from human rights, provided their actions are in conformity with the law, proportionate and are necessarily in the interest of national security or public safety or public health etc. Amidst the pandemic, in a disturbing trend, countries around the world are using the pandemic as a pretence to use overly intrusive tools, including use of facial recognition and phone tracking, resulting in a search for balance between protecting public health and personal privacy.
Against this backdrop, recent guidelines dt 01.05.2020 issued by the Ministry of Home Affairs mandating use of Aarogya Setu, a contact tracing application that collects, stores, and makes use of users personal information, continuously tracks users location using both GPS and Bluetooth, makes use of a centralised data collection system, fails to adhere to the consent, necessity and proportionality principles, lacks accountability and transparency requirements, for both public and private sector employees and persons in containment zones, placing obligation upon employers to ensure 100% coverage, has raised serious concerns with respect to privacy, informational autonomy, security, data protection, and individual self-determination.
In this context, Lord Acton’s saying “Power corrupts, and absolute power corrupts absolutely”, is extremely relevant, even though the extraordinary situation created by Covid-19 may mandate extraordinary solutions it is imperative that in this fight against Covid-19 we do not permanently erode our basic human rights and civil liberties. Stalking by individuals is a penal offence under the Indian Penal Code which is punishable with up to 3 years of imprisonment– What about stalking by State through mass surveillance tools/ applications? What are its limits and under what circumstances, if any, can such measures be permissible? Is there a real danger of being swamped over by such surveillance systems?
Understanding Privacy
The advent of Covid-19 has brought with it serious privacy threats that involve unprecedented development/ deployment of advanced technologies, systems and infrastructures that are highly capable of being used to violate an individual’s right to privacy and pose the newest, and arguably one of the most serious, threats to liberty in modern society.
Questions that still loom large for consumers, industry and policy makers are how to define privacy in this global data driven digital age, its limits and scope, and what should be the balance between privacy and public health. What is privacy–Each and every individual’s ability, without any discrimination, to make choices/decisions with respect to his body, personal information and having complete autonomy over his personal choices free from State interference- A right to freely choose where you live, what you do, whom you marry, sexual orientation, right to religious freedom and a right to live with dignity.
Canada Supreme Court Justice (retired) Hon. Gérard V. La Forest, in R. v. Dyment, [1988] 2 S.C.R. 417, prominently judged that “privacy is at the heart of liberty in a modern state” and “the restraints imposed on government to pry into the lives of the citizen go to the essence of a democratic state”. The US Supreme Court, recognising the technological advancements, in Katz v. United States, 389 U.S. 347, 351 (1967) extended the interpretation of the Fourth Amendment to include not just properties or physical places, but also people, as long as the person concerned exhibits first “an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as reasonable”.
In India, on 24th August 2017, a nine-judge bench of the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India, 2017 10 SCC 1 unanimously affirmed right to privacy as a fundamental right, placing individual dignity and autonomy at the heart of the constitutional order. However, it was clarified that like most other fundamental rights, the right to privacy was not an absolute right, and could be overridden for preservation of public health and safety.
Justice D.Y. Chandrachud, while delivering the main judgement, held that privacy is intrinsic to life, liberty, freedom and dignity and therefore, is an inalienable natural right-“While the legitimate expectation of privacy may vary from the intimate zone to the private zone and from the private to the public arenas, it is important to underscore that privacy is not lost or surrendered merely because the individual is in a public place. Privacy attaches to the person since it is an essential facet of the dignity of the human being.”
The Puttaswamy judgement lays down a three-part test to determine whether an action of State breaching a citizen’s right to privacy was valid or not. First, whether the action has a legitimate basis. Second, whether the action was necessary for achieving a legitimate goal. Third, it has to be an action which is proportionate for the achievement of that aim.
Mandatory imposition of Aarogya Setu application
Aarogya Setu’s collection, use and disclosure of personal information in absence of a specific and explicit law bestowing upon the Government express powers that provide a basis for collection, collation and dissemination of personal information is prima facie illegal and in violation of Articles 14, 19 and 21 of the Constitution.
Even though, the Application, having a legitimate purpose of preservation of public health, passes the second test, its mandatory imposition, in absence of users’ consent, in violation of the necessity principle and disproportionality invades the Constitutional rights of individuals. The critical nature of obtaining consent from the user and providing an option to him to withdraw the same, before collecting, collating and disseminating sensitive health records is fortified by Chief Justice S.A. Bobde’s observations in the Puttaswamy judgement, wherein he observed that consent was essential for distribution of inherently personal data such as health records.
The exercise of extraordinary powers by the Executive during this crisis has, once again, highlighted the pivotal role the legal system plays in securing the rule of law and the burden placed upon the courts to detect and address the Executive’s abuse of extraordinary powers. At present several writ petitions, including Jackson Mathews (Managing Partner at Leetha Industrie) vs. Union of India & Ors., John Daniel (General Secretary of the Thrissur District Congress Committee) vs. Union of India and Anr., challenging the mandatory imposition of Aarogya Setu application are pending adjudication
Before the Kerala High Court, wherein the Petitioners have, inter alia, raised the following interesting issues, (i) Legality of holding employers vicariously liable for criminal acts of their employees (nondownload of application); (ii) Apart from failure to address the staggeringly low number of smartphone users (out of approx 1.3 billion people less than 400 million), the application fails to address issues of users phone crashing or leaving of phone at home by user.
The HIV/AIDS epidemic of the 1980s and 1990s is a perfect example that demonstrates how illegitimate and overly intrusive infringement of people’s civil liberties, using emergency powers, can backfire and prove to be counter-productive to the aim of preservation of public health. Among the measures that were adopted, were routine testing, often undertaken without explicit patient consent; reporting to local health authorities’ names of those who test positive for infection; contact tracing; and notification of possibly infected people.
Health experts found that reporting names of HIV patients by doctors to States, contact tracing and notification measures that were adopted to contain the spread, directly resulted in a steep decrease in number of detected cases as the people with symptoms chose not to get tested because of the stigma surrounding the disease, and the same resulted in refusal by states to accept name-based reporting. Ronald Bayer, a professor at the Centre for the History and Ethics of Public Health at Columbia University, in his research paper argues that “good public health respects civil liberties, and anything that advances human rights and civil liberties would advance public health” and “We learned that if you intrude on privacy you will be counterproductive in terms of controlling the epidemic”.
Thus, in these unprecedented times, when collection and circulation of patients’ personal information for preservation of public health is necessary, right to privacy and autonomy are at their most vulnerable/fragile state. It has become essential for each and every citizen to be vigilant to the infringement/ intrusion of civil liberties and human rights, not to impede the Government’s efforts, but to ensure that these treasured rights are not permanently effaced from statute books, and extraordinary powers granted to the Government do not continue once Covid-19 is over.
At present, mandatory imposition of the Aarogya Setu, in absence of statutory safeguards, scientific evidence to back its efficacy, necessity, transparency and proportionality, falls foul of State’s commitment to uphold the rule of law, international human rights obligations and principles of privacy, liberty and security, and the government should come up with novel tools equipped with constitutional safeguards including less obtrusive applications that prevent arbitrary interference with people’s privacy, are subject to a time bound periodic review as adopted by UK in its Coronavirus Act, 2020, and while advancing public health also advance civil liberties and human rights.
Geeta Luthra, Senior Advocate, LLM, M.Phil (Cambridge).
