In an effort to contain the spread of COVID-19, governments across the world have used contact tracing as a means to identify and map the spread of the virus. This has led to a large-scale push for digital contact tracing in the form of smartphone applications that alert users in case of potential exposure to someone who has been infected. These applications can generate heat maps of areas with high rates of infection, and have proven useful in identifying emerging hotspots. However, in the rush to introduce digital methods of contact tracing, concerns around privacy, surveillance and potential discrimination and exclusion remain unaddressed. Governments must keep in mind that digital contract tracing cannot replace manual contract tracing, and successful contact tracing is a result of manual and digital contact tracing working in tandem.¹ Applications have also reported cases of false positives and false negatives, and require high participation from the local population to be of any real significance.

In India, the National Informatics Centre (NIC) developed the Aarogya Setu application to serve as a contact tracing, syndromic mapping and self-assessment digital service, in addition to a number of similar applications released by state governments.² The application collects demographic, health data and real-time location data and colour codes users based on the risk that they pose to others due to their health status, and maps infection hotspots.

We examine the Aarogya Setu application against a series of tests in our evaluation framework in order to determine whether the use of Digital ID in this application is legitimate, human-rights respecting, and balanced against potential risks.

Legislative Mandate

Is the use of Aarogya Setu codified in a valid law?

Aarogya Setu has been deployed in the absence of an appropriate statutory framework and is not codified in a valid law. It was initially mandated by the Ministry of Home Affairs on the basis of a Government Order (G.O.)³ that finds its basis in the Disaster Management Act, 2005. No legislation has been passed by Parliament to authorise the creation and mandatory deployment of the application. In response to data protection concerns around the application, the government released the Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020⁴ (“Protocol”) which lays down broad principles of data protection, along with the Android and iOS source code of the application.⁵ India also presently lacks a data protection framework, which leaves the collection and use of data collected from the application to the vagaries of executive orders.

The framework governing the use of Aarogya Setu in India is not codified in valid law, and is made up entirely of delegated legislation.

Legitimate Aim

Does the law have a legitimate aim?

The use of Aarogya Setu must correspond to a legitimate aim in the law governing it. It is necessary to point out that the application is not codified in a valid law. A reading of the G.O. (drawn from the Disaster Management Act, 2005) in combination with the Act could satisfy the legitimate aim test. The present COVID-19 pandemic would qualify as a disaster under Section 2(d) of the Act, 2005 and deployment of the application for digital contract tracing could be justified as a form of disaster management under Section 2(e). The Disaster Management Act aims to provide effective management of disasters and matters connected therewith or incidental thereto.

In the absence of a valid law, these objectives could qualify as a legitimate aim.

Defining Actors and Purposes

Does the law clearly define all the actors and purposes involved in Aarogya Setu?

In the absence of primary legislation governing the application, we will have to rely on its Protocol and Privacy Policy for a definition of the actors and purposes. The Protocol directs the Privacy Policy to clearly specify the response data and the purpose for which it is collected by NIC.⁶

The Protocol states that the NIC can share information with the Ministry of Health and Family Welfare, Government of India, Departments of Health of the State/Union Territory Governments/local governments, National Disaster management Authority (NDMA), State Disaster Management Authorities (SDMAs), and other Ministries and Departments of the Government of India and State Governments and other public health institutions of the Government of India, State and local governments, where such sharing is strictly necessary to directly formulate or implement an appropriate health response.⁷ The NIC can also share response data in de-identified form (defined in the Protocol as data which has been stripped of personally identifiable data to prevent the individual from being personally identified through such data and assigned a randomly generated ID⁸) with such Ministries or Departments of the Government of India or the State/Union Territory Governments, local governments, NDMA, SDMAs and such other public health institutions of the Government of India or State Governments or local governments with whom such sharing is necessary to assist in the formulation or implementation of a critical health response.⁹ Data can also be shared with Indian universities and research institutions/entities registered in India - however, what constitutes a research institution or entity has not been clearly defined and can be broadly interpreted.¹⁰ This could potentially include pharmaceutical companies, for instance, who could then have access to sensitive health information without sufficient safeguards in the absence of a data protection framework.¹¹

The Privacy Policy states that the purpose of the application is for collected data to “be used by the Government of India in anonymized, aggregated datasets for the purpose of generating reports, heat maps and other statistical visualisations for the purpose of the management of COVID-19 in the country or to provide you general notifications pertaining to COVID-19 as may be required.”¹² The Protocol states that collected data will be used “strictly for the purpose of formulating or implementing appropriate health responses and constantly improving such responses.”¹³

In addition to plans to integrate more functions such as telemedicine within the application, Aarogya Setu is intended to become the “initial building block for India Health Stack”,¹⁴ which is indicative of growing function creep of the application beyond its original stated purpose.¹⁵

While there is a lack of clarity in specifying all of the actors who will have access to collected data, the purpose of the application has been clearly articulated. However, the Protocol and Privacy Policy can be easily modified with no oversight, and the functions of the application are slowly expanding.

Regulating Private Actors

Is this use of the ID system by private actors adequately regulated?

The use of the ID system by private actors has not been adequately regulated.

Apart from government entities, other actors such as Indian universities, and research institutions and entities registered in India have access to anonymised data. The Protocol and Privacy Policy are unclear on the criteria for qualifying as a research institution or entity. Moreover, there is no requirement that this research cannot be for-profit or even only in the field of Covid-19 research, opening the doors for private companies to access data by classifying themselves as research entities.

Further, researchers have documented how information from the application can be easily used by anyone for non-COVID surveillance purposes, such as estimating population spread in a particular area, or even spying on army bases.¹⁶

There is also no restriction on private parties mandating use of the application for any purpose.

An Open API platform set up by Aarogya Setu also allows third-party apps to check the health status (and no other personal information) of a user with their consent. There are protective measures including user notification in case of breach, anonymisation, encryption and audit logs.¹⁷ However, there are concerns that a reading of the other clauses in the terms and conditions suggests that third party applications will have access to data apart from “health status” but must commit to not use it.¹⁸ The requirements are loose enough to allow any company registered and operating in India with more than 50 employees, customers or users to be authorised to access the API.¹⁹ With the intended use of the application as the basis of the National Health Stack, integration with third parties raises the possibility of the application being forming the basis of an immunity passport to access services and gain entry to spaces (which can lead to exclusions and discrimination).

Data Specification

Does the law clearly define the nature of data that will be collected?

The Protocol states that the NIC shall collect only such “response data as is necessary and proportionate to formulate or implement appropriate” health responses.²⁰ While the Protocol broadly outlines the kinds of data that will be collected, it directs the Privacy Policy to provide a more detailed list of data collected and the purposes for which it will be used. This data is collectively referred to as response data in the Protocol.²¹ The response data consists of:

• Demographic data: Name, mobile number, age, gender, profession and countries that the individual has visited in the last 30 days.
• Contact data: Data about any other registered user that the individual has come in close proximity with, upon which their applications will automatically exchange their unique Digital IDs, and record the time and duration of the contact, the proximate distance between the individuals and the GPS location at which the contact occurred.
• Self-assessment data: Responses provided by that individual to the self assessment test administered within the application.
• Location data: Data about the geographical position of an individual in latitude and longitude. The Privacy Policy states that location details of the individual are also captured during registration, after which the application continues to collect and record location data at 15 minute intervals.

In the absence of a statutory legislation governing the application, these categories of collected data have only been enumerated in the Protocol and Privacy Policy, both of which could be amended to expand their scope without legislative oversight.

User Notification

Does the ID system provide adequate user notification mechanisms for this use case?

There is no explicit provision for user notification mechanisms on how user data is used or shared (including with third parties), or for breach of user data.

This is particularly concerning because of the sensitive nature of the data collected by the application (such as health information and real-time location), and the harms that could arise out of unauthorised disclosure or sharing of this information.

The later updates to the application now notify the user of any changes to the privacy policy. However, it is important to note that while the application itself is available in multiple local languages, the Privacy Policy and Terms of Service are only available in English, which makes such notifications (and consent on the basis of this) meaningless to a majority of users.

User Rights

Do individuals have rights to access, confirmation, correction, and opt out?

Users of the application fill in their own demographic details, as well as a self-assessment of their health, and the application allows them to access and correct this information at will. The Protocol also directs the NIC to “document the sharing of any data and maintain a list of the agencies with whom such data has been shared. Such documentation shall include the time at which such data sharing was initiated, the persons or agencies who are being provided access to such data, the categories of data that are being shared and the purpose for which such data is being shared”, however only to the extent reasonable.²² There is no provision for how users may access this data. Moreover, neither the Protocol nor the Privacy Policy enables users to confirm whether their information is held by the NIC or any government agency after the specified retention period.

While users are given the option of deleting their Aarogya Setu account (which would also delete response data from their phone), the application clearly states that this will not cause response data to be deleted from government servers.²³ Moreover, while use of the application is voluntary on paper, it is still de facto mandatory for many in order to access essential services. For instance, when it is mandated by employers, opting out of using the application is not a realistic option.

While users have some rights over their information, they cannot confirm their data or delete their own data from government servers, and many cannot opt out of using the application at all.

Redressal Mechanisms

Are there adequate civil and criminal redressal mechanisms in place to deal with violations of their rights arising from the use of Aarogya Setu?

As stated in the Protocol, any violations would lead to penalties under Sections 51 to 60 of the Disaster Management Act, 2005.²⁴

However, there are no other redressal mechanisms for users specifically relating to the application.

Data Minimisation

Are principles of data minimisation followed in the collection, use, and retention of personal data for this use case?

Principles of data minimisation are followed to varying degrees.

The Protocol limits the NIC from collecting more data than is necessary and proportionate, and “strictly for the purpose of formulating or implementing appropriate health responses and constantly improving such responses”.²⁵ Of the information collected by the application, the collection of real-time location leads to obvious concerns about surveillance, but has been justified on the grounds of the contact tracing aim of the application. However, the need for a user to enter their professional status in order to use the application remains unclear.

Moreover, while there are limits to sharing only information that is strictly necessary, there is no requirement that the information must be strictly proportionate for the appropriate health response.

The Privacy Policy states that location data will be retained on the mobile device for a period of 30 days from the date of collection after which, if not already uploaded to the Server, it will be purged from the application. Location and COVID-19 positive/high likelihood of infection status (which results in all information automatically being uploaded to the server) will, to the extent that such information relates to people who have not tested positive, be purged from the server 45 days after being uploaded. This information for persons who have tested positive for COVID-19 will be purged from the server 60 days after such persons have been declared cured of COVID-19.²⁶ As per the Protocol, the NIC must permanently delete self-assessment, location and contact data after 180 days under ordinary circumstances,²⁷ but is silent on what would constitute extraordinary circumstances that would allow data to remain on the server after this period, except that it can be carried out on a recommendation by the Empowered Group.

Access to Data

Does the law specify access that various private and public actors have to personal data in this use case?

Considering the sensitive nature of the information collected and stored by the application, there are inadequate obligations on the disclosure of this information, particularly to third parties.

The NIC can share information with the Ministry of Health and Family Welfare, Government of India, Departments of Health of the State/Union Territory Governments/local governments, NDMA, SDMAs, and other Ministries and Departments of the Government of India and State Governments and other public health institutions of the Government of India, State Governments and local governments, where such sharing is strictly necessary to directly formulate or implement an appropriate health response.²⁸ It can share response data in de-identified form (defined in the Protocol as data which has been stripped of personally identifiable data to prevent the individual from being personally identified through such data and assigned a randomly generated ID) with such Ministries or Departments of the Government of India or the State/Union Territory Governments, local governments, NDMA, SDMAs and other public health institutions of the Government of India or State or local governments with whom such sharing is necessary to assist in the formulation or implementation of a critical health response.²⁹

It has been pointed out that the Protocol, while allowing sharing of data with “research institutions” and “research entities”, has not defined what would constitute these entities, giving wide scope for third party entities to potentially access sensitive medical information.³⁰ As highlighted previously, users will not be notified when their information has been shared with a third party, or what information has been shared and to whom.

Mandatory Use and Exclusions

Does the use of digital identity in Aarogya Setu lead to exclusionary impacts?

The use of Aarogya Setu is no longer mandatory. However, it has been made mandatory for many essential purposes, and there is no restriction on private parties (such as employers) mandating the use of the application.

Since many users do not have a meaningful choice to opt-out of the application, this will have exclusionary impacts.

Risk Assessment

Is this use case regulated taking into account its potential risks?

There is no data protection law in place (and no sufficient judicial or legislative oversight) governing the use of personal data for Aarogya Setu.

Response to Risks

Is there a mitigation strategy in place in case of failure?

Information collected through the application is stored in a centralised server, with no clear information about its functioning.

There is no clearly articulated mitigation strategy built into the design of the application.

Despite having introduced a bug bounty programme,³¹ there have been instances where potential security issues were publicly dismissed, and articles reporting these concerns have been withdrawn or taken down.³²

Notes