Privacy concerns during a pandemic

The government’s technology solutions to fight COVID-19 do not meet minimum legal requirements

In his now-legendary dissenting judgment, delivered at the height of Indira Gandhi’s Emergency, Justice H.R. Khanna, invoking Justice Brandeis of the U.S. Supreme Court, wrote that “[the] greatest danger to liberty lies in insidious encroachment by men of zeal, well-meaning but lacking in due deference for the rule of law.” Justice Khanna was not speaking about the crushing of freedom at the point of a bayonet. He was concerned, rather, about situations where the government used the excuse of a catastrophe to ignore the rule of law. Quoting Brandeis, he said, “experience should teach us, “to be most on our guard to protect liberty when the Government’s purposes are beneficent.”

Today we live in the midst of a grave public health crisis. There is little doubt that the government is best placed to tackle the COVID-19 pandemic. Doing so requires it to take extraordinary actions. This is why the efforts of the Central and State governments to maintain a nationwide lockdown, to enforce norms of physical distancing and to restrict movement, have been met with support.

It can be tempting in these circumstances to argue that the executive’s powers are limitless; that, if the government so chooses, fundamental rights can be suspended at will. The pandemic, the argument goes, is an existential threat and the paramount need to save lives takes precedence over all other interests. Appealing though it is, this argument is not only wrong but also dangerous, for precisely the reasons that Justice Khanna outlined: when faced with crises, governments — acting for all the right reasons — are invariably prone to overreach. Any temporary measures they impose have a disturbing habit of entrenching themselves into the landscape and creating a ‘new normal’ well after the crisis has passed. Paying close attention to civil rights, therefore, becomes critical, not to impede the government’s efforts, but to ensure that rights — fragile at the best of times, and particularly vulnerable in a crisis — are not permanently effaced.

Data and public health

The state’s most significant responses to the pandemic have been predicated on an invasive use of technology, that seeks to utilise people’s personal health data. While the measures deployed intuitively sound reasonable, the mediums used in implementing the programme overlook important concerns relating to the rights to human dignity and privacy.

Broadly, technology has been invoked at three levels. First, in creating a list of persons suspected to be infected with COVID-19; second, in deploying geo-fencing and drone imagery to monitor compliance by quarantined individuals; and third, through the use of contact-tracing smartphone applications, such as AarogyaSetu.

Each of these measures has induced a miasma of despair. In creating a list of infected persons, State governments have channelled the Epidemic Diseases Act of 1897. But this law scarcely accords the state power to publicise this information. What’s more, these lists have also generated substantial second-order harms. As the director of the All India Institute of Medical Science, Dr. Randeep Guleria, pointed out, the stigma attached to the disease has led to an increase in morbidity and mortality rates, since many with COVID-19 or flu-like symptoms have refused to go to hospitals.

The use of geo-fencing and drone technologies is similarly unsanctioned. While cell-phone based surveillance might be plausible under the Telegraph Act of 1885, until now the orders authorising surveillance have not been published. Moreover, the modified surveillance drones used are equipped with the ability to conduct thermal imaging, night-time reconnaissance, and also — as some private vendors have claimed — the ability to integrate facial recognition into existing databases such as Aadhaar. Contrary to regulations made under the Aircraft Act of 1934, the drones deployed also do not appear to possess any visible registration or licensing. Indeed, many of the models are simply not permitted for use in India.

Most concerning amongst the measures invoked is the use of contact-tracing applications that promise to provide users a deep insight into the movements of a COVID-19 carrier. The purported aim here is to ensure that a person who comes into contact with a carrier can quarantine herself. Although the efficacy of applications such as these have been questioned by early adopters, such as Singapore, the Union government has made AarogyaSetu, its contact-tracing application, its signal response to the pandemic.

Thus far, details of the application’s technical architecture and its source code have not been made public. The programme also shares worrying parallels with the Aadhaar project in that its institution is not backed by legislation. Like Aadhaar it increasingly seems that the application will be used as an object of coercion. There have already been reports of employees of both private and public institutions being compelled to download the application. Also, much like Aadhaar, AarogyaSetu is framed as a necessary technological invasion into personal privacy, in a bid to achieve a larger social purpose. But without a statutory framework, and in the absence of a data protection law, the application’s reach is boundless. One shudders to think how the huge tranches of personal data that it will collect will be deployed.

The importance of civil rights

The Supreme Court’s judgment in K.S. Puttaswamy v. Union of India (2017) is renowned for its incantation, that each of us is guaranteed a fundamental right to privacy. But the Court also recognised that the Constitution is not the sole repository of this right, or indeed of the right to personal liberty. For these are freedoms that inhere in all of us. The Court additionally thought it important, as Justice S.K. Kaul wrote, that the majority opinions of Justice Khanna’s brethren be buried “ten fathom deep, with no chance of resurrection.”

To be sure, the right to privacy is not absolute. There exist circumstances in which the right can be legitimately curtailed. However, any such restriction, as the Court held in Puttaswamy , must be tested against the requirements of legality, necessity and the doctrine of proportionality. This will require government to show us, first, that the restriction is sanctioned by legislation; second, that the restriction made is in pursuance of a legitimate state aim; third, that there exists a rational relationship between the purpose and the restriction made; and fourth, that the State has chosen the “least restrictive” measure available to achieve its objective.

In this case, not only are the government’s technological solutions unfounded in legislation, there is also little to suggest that they represent the least restrictive measures available. A pandemic cannot be a pretext to abnegate the Constitution. Inter arma silent leges , said Cicero: “For among [times of] arms, the laws fall mute”. But our fight against COVID-19 is no war. Even if it were, our Constitution is intended for all times — for times of peace and for times of crises.

Suhrith Parthasarathy is an advocate practising at the Madras High Court; Gautam Bhatia is a Delhi-based lawyer; and Apar Gupta is a lawyer and executive director of the Internet Freedom Foundation

Recommended for you