On the issue of the Aarogya Setu App, IPC has collated a list of demands that the government needs to meet now.
The central government's health tracking application - Aarogya Setu - has generated a lot of debate in recent times. The central issue, as with a lot of technological interventions in governance, is two-fold - Is the app likely to malfunction? Is the app open to misuse? Given the extent and nature of the health and humanitarian crises, these issues are urgent and pressing. IPC has put together a list of demands for the government in order to ensure that the rights of the citizens are safeguarded alongside their health. Make the Software Truly Open Source The most vocal demand is for the Aarogya Setu app to be made open source (software for which the original source code is freely available). Open source software can be checked for security flaws that could result in breaches of privacy, by independent coders and researchers. However, since Aarogya Setu is not open source, this is not presently possible, and such issues can therefore only be audited by the developers of the app alone. Making the app open source is also likely to solve other bugs and issues within the app, as it allows a larger number of people to examine the code and find problems the developers may have overlooked. Recently, the code was released on GitHub, however, this code was both incomplete and not the actual code on which the app runs. Make the List of Developers Accessible to the Public A related cause for concern in terms of transparency issues regarding the app that has been highlighted is that the list of developers is not wholly public, and many of the developers are volunteers from the private sector. Making the list of developers public would improve the transparency of the app, along with making the app open source, as it would then become clear who has access to the data collected by the app and when. Make Explicit What It is Mandatory For, On What Legal Basis, And How That Squares With the Right to Privacy Another criticism of the policy behind Aarogya Setu is that the mandating of the app (making it mandatory - or compulsory, by law - to use it) seems to have no legal basis. Former Supreme Court judge BN Srikrishna called this governmental decision to mandate the app “utterly illegal”, and whether this app is compatible with the right to privacy (as established by Constitutional case law such as the judgment of Puttaswamy v. Union of India, which held the right to privacy to be intrinsic to the fundamental right to life, subject to a test of whether any given law’s reduction of privacy is proportional to the objective of the law) has been questioned. Though this mandating has recently been scaled back, requiring the app for things such as the issuance of ‘e-passes’ is also arguably an overstepping of the app’s scope in terms of individual privacy, as there are no alternative ways of getting such e-passes issued, and so the app remains essentially mandated in certain situations, in turn subjecting people to the surrender of their data in situations where it is not necessarily connected to the spread of COVID-19. Make Explicit How Data Collected by the App can be Deleted Currently, users are also unable to delete their data from the app, and there is no set time frame for this data to expire within the app, creating the possibility that such data will be maintained and used even beyond the COVID-19 pandemic. The resulting demand here is for a feature that would either automatically delete all data (that is not essential for tackling future pandemics, and if it is deemed essential, it should only be stored anonymously) after the pandemic, or allow users to do so. Another solution that has been suggested is that data be automatically deleted every 21 days. Though it has been claimed that data is deleted over time (60 days for sick people, 30 days for healthy people), there is no public clause regarding this matter. Moreover, The Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020 states that under "extraordinary circumstances", the Government may retain data collected through the app for a period of more than 180 days. However, it does not clarify what is meant by such "extraordinary circumstances", and the vagueness of this language leaves this clause open to misuse. Make the Privacy Policy of the App Clearer and More Detailed Another demand regarding the app concerns the privacy policy of the app. Here, the suggestion is that the privacy policy of the app itself specify which departments of the government may access the data, in order to prevent the misuse of this data. Appoint an Auditor to Oversee How the Data Collected by the App is being Used Appointing an independent auditor (subject to Parliamentary or Judicial oversight) has also been suggested as a possible countermeasure to the misuse of data collected by the app. Such an auditor would be able to oversee how the collected data is being used, and would ensure that protocols on the collection and use of this data have been complied with, preventing the abuse of data. Amend Privacy Policy to Ensure Data is Not Linked With Other Existing Databases and Clearly Define Who Has Access To It and For What Reason As the privacy policy and terms of use of the app do not specify whether or not the data collected by the app can be integrated with existing datasets, such as healthcare records of hospitals, it has been suggested that these documents be amended to include the restriction that the collected data may not be integrated with any such datasets. The integration of Aarogya Setu data with other datasets would likely violate the proportionality test of the right to privacy as detailed in the Puttaswamy judgment, by intruding into individual privacy beyond the scope of controlling COVID-19. The Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020 also allows for the sharing of data collected by the app with non-governmental entities for “research purposes”, but as this term is broadly defined, the possibility of misusing data opens up in that this data may be accessed by entities for reasons other than why it was initially provided, i.e., to combat COVID-19. Put In Place a System to Anonymise Data that is Not Being Deleted Though the privacy policy of the app states that the data collected by it will be anonymised, it does not state exactly how this will be done. This in turn has led to the demand that the app’s privacy policy reflect an anonymisation mechanism that ensures three things: - first, that it be impossible to ‘single out’, i.e., concretely identify, an individual from the information within the data, - second, it should not be possible to link records to specific individuals (so, the information should not be connected with specific names), and - third, that no additional personal information that is not present in the dataset about an individual should be inferable from the data collected within the app. Address Concerns Raised By Reliable Rating Mechanisms MIT’s Technology Review recently downgraded the app from its former rating of two out of five stars, in response to a recent set of policy revisions regarding the app, among which was making the app mandatory for air travel. The app lost further points for collecting more data than is required in combating the pandemic, raising privacy concerns. Specify That the App Will Only Be Used To Control The Spread Of The Disease and Not For Other Related Or Unrelated Purposes While other countries have specified that their iterations of contact tracing apps will not be used for any purpose other than disease control (for example, they will not be used to enforce legal orders relating to lockdowns), no such requirement has been mentioned in the case of Aarogya Setu, in turn creating the possibility that it may be used for legal enforcement beyond containing the COVID pandemic. Create a More Robust Liability Regime For The Government for Breaches of Privacy and Malfunctioning The terms of service of the app include clauses which limit the government's liability regarding claims from the use of the app. For example, it states that the government will not be liable if an individual cannot access the app, if there are errors in the contact tracing of the app, and in cases of unauthorised access or alteration to an individual's data within the app. However, this dramatically reduces the accountability of the government and developers of the app, rendering them unaccountable for privacy breaches that may occur through the app. #app #data #privacy #collected #aarogya #setu #aarogyasetuapp #policy #india #asia #news #contact #tracing #bluetooth #coronavirus #corona #covid #covid19 #Indianpolicycollective #pandemic #legal #health #government #disease #control #judiciary #future #tech #technology #security #bug #virus #tracker #problem #malfunction #govt #alternation #enforce #protocol #mandatory #epass #pass #interstate #public #transport
Comments