The Ministry Of Home Affairs in its recent lockdown guidelines stated that all public and private sector employees physically going to work should download the Aarogya Setu application.
In its orders, the ministry said that it is the responsibility of the heads of all the organisations to ensure “ensure 100% coverage of this app among the employees”.
Additionally, the subsequent lockdown guidelines in Noida and Greater Noida also enforced the use of the application. It stated that not having the Aarogya Setu application on smartphones while out in public places will be considered a violation of the lockdown guidelines. This was confirmed by Additional Deputy Commissioner of Police, Law and Order, who even said that those violating this rule may attract punishment.
Even the Central government has made its mandatory for its employees to download the application before they report to work. Last week media reports even went as far as to say that Centre is also planning to make it mandatory for all new smartphones that will be sold in India to have the app as a pre-installed service.
The Aarogya Setu application since its launch has been met with privacy and data protection concerns. It has even been criticised by privacy experts for its poor data protection laws, with a French cybersecurity expert even saying that he has found a security issue with the application.
All these events have begged the question of how necessary it is to download the application, and whether someone can force you to do it. Since everyone from the government, as well as private organizations, asked to make the use of the application compulsory, can someone actually force you to download Aarogya Setu? To answer this, it is important to look at the issue from the Government’s perspective as well as how their whether their decision is in accordance with due laws.
Can The Government Make It Compulsory to Download Aarogya Setu?
To understand whether you can be forced by the State to download the application, it is important to understand the legality behind it.
The lockdown guidelines have been issued under the National Disaster Management Act. The act falls under the concurrent list and therefore it can only request the state governments to follow the guidelines it has suggested. Therefore the order to ensure 100% coverage of the application which has been reiterated under the lockdown guidelines only acts as a suggestion that the states can follow. The states are free to decide for themselves and can also develop separate guidelines when it comes to making Aarogya Setu compulsory for its citizens.
The National Disaster Management Act states nothing about any situation in which the government is allowed to invade or impinge on the right to privacy of a citizen. The data requested by Aarogya Setu, such as name, gender, age etc. is their personal property and constitutionally they aren’t required to furnish the same to the government for data collection, as stated by Constitutional expert Gautam Bhatia.
The Supreme Court in 2017, had ruled that Indians enjoy a fundamental right to privacy. It said that the right to privacy is intrinsic to life and liberty and thus comes under Article 21 of the Indian constitution. This is another reason why the government can’t make it compulsory to download Aarogya Setu.
One of the judges in the case, Justice DY Chandrachud had even addressed the current situation specifically. In his judgement, he had said that even if a situation may arise wherein the government has to collect data to monitor and manage the epidemic, it can do so only after the said data is anonymised. Data anonymization is essentially a way to protect private information. This is done by erasing or encrypting the identifiers that store the data. For example, data anonymization can ensure that while details such as names, age, phone numbers are collected, the source fo the data is kept anonymous
Does Forcing Someone To Download Aarogya Setu Violate Their Right To Privacy?
Even if the state governments agree to make Aarogya Setu mandatory for all, they still need to follow certain guidelines and pass through several legal checks.
For this, a variety of conditions need to be fulfilled before the government can start collecting data. The first is that the decision to collect data needs to be coming from a law. This condition isn’t yet satisfied due to the above argument of the NDMA coming under the concurrent list.
The second is that the government’s action must be suitable for addressing a problem. Therefore before making Aarogya Setu compulsory, the state should first show that collecting data will prove to be fruitful in fighting the disease and establish a legitimate claim for data collection.
Also, it is the State’s responsibility to fulfil the third reason, which is the proportionality principle. This principle essentially states that there must be a balance between the State’s purpose and the extent the rights are infringed. Currently, there are a lot of questions against the effectiveness of contact tracing applications. In a country where there are only 400-450 million smartphone users in a population of 1.3 billion, the effectiveness of a mobile contact tracing application can surely be questioned. Such doubts again create a grey area on whether the proportionality principle is satisfied.
Past judgements have shown that in the case violation of privacy has been demonstrated, it is the State’s responsibility to prove it otherwise. In simple words, unless the government proves it legally that using Aarogya Setu in no way poses a threat to your data privacy, they force you to download the application.
Can Private Employers Make The Application Compulsory?
Private organizations are the other stakeholders that have been asked to ensure downloading of Aarogya Setu. But can they actually force you to download the application?
The Personal Data Protection Bill provides the answer to that. The bill, which is currently being considered by a Joint Parliamentary Committee states that employee consent is necessary for data collection and processing. Only certain data can be processed by the employer without the consent of the employee, and the same is restricted to the ambit of salaries. Therefore under the present version of the bill, no other information apart from information on salaries can be collected by the employers. Since Aarogya Setu requests for data such as age, name, gender amongst others, an employer can not force you to download the application.
Therefore, you can refuse to share your sensitive data by claiming that downloading Aarogya Setu does exactly that, in the event your private employer asks you to download the application.
Recently a group of 45 organisations and more than 100 individuals on wrote to Prime Minister Narendra Modi, home minister Amit Shah and IT minister Ravi Shankar Prasad. They expressed their concerns that the decision to make Aarogya Setu mandatory could violate privacy laws as well as the Puttaswamy privacy judgement.
Legal experts, therefore, believe that the move to make Aarogya Setu compulsory has no legal backing. The government directives mandating Aarogya Setu for all public and private employees suffers from serious legal flaws and fails on several principles such as proportionality and suitability.