A Comprehensive Look at Covid Surveillance and Privacy in India #SaveOurPrivacy

Tl;dr

With a view to address the public health challenges due to Covid-19 a range of technology interventions are being developed that impact personal privacy. We at IFF have been watching it with concern and have authored a comprehensive working paper to inform public policy formation in India. This includes a substantive analysis of the use and publication of health data, specific development of surveillance technologies around location tracking and finally the deployment of contact tracing through handheld device applications.

We devote substantial space to a front-end analysis of three contact applications Singapore’s TraceTogether, MIT’s Private Kit : Safe Path’s Project and Aarogya Setu. We also consider the possible public policy and rights related ramifications of the recent announcement of a partnership between Apple and Google towards contact tracing. To conclude we make substantial prescriptions premised primarily on the legal framework of the Indian Supreme Court’s developing jurisprudence on the fundamental right to privacy. Over this week, we are going through a series of posts explaining how we can protect our health and privacy at the same time. It’s possible if we try!

Re-framing the Privacy and Public Health trade-off

The world seems like a distressing place right now irrespective of the number of pick-me up videos from celebrities and influencers. A reason for this worry includes the substantial erosion of civil liberties such as the freedom of assembly and movement due to the advice from policy makers to maintain social distancing due to the Covid-19 pandemic. In these extraordinary times, it is very likely that the lockdown may not be a permanent feature of life and we again be able to meet our friends, family and colleagues in person.

However, there are repeated warnings that some systems which are being developed and deployed will outlast the length of the pandemic. This prominently features fears of mass surveillance which hallows out democratic systems with incredible effectiveness. At the same time technology based solutions, in a digital society provide for incredible facility in effectively tracing the path of infection of the Covid virus. One such solution which is being offered as being a compromise on privacy for the greater, common good is the Aarogya Setu App by the Government of India.

Recognising the digital nature of our society, we must press each available facility including technology to neuter the threat posed by Covid. This must be done in a rights respecting manner, and to make sure that such a realignment in policy priorities are made possible we have worked at pace to develop an exhaustive working paper that poses concerns and offers solutions on the path forward.

Overview of the working paper

This working paper is a comprehensive effort spanning 88 pages and 9 sections. The first two sections are devoted to the basic premises of public health requirements and the existing legal framework for the fundamental right to privacy. We have then in the next three sections looked extensively at the three primary methods how technology based interventions have impact on the fundamental right to privacy. Starting with the collection, use and dissemination of personal data which includes lists of people who have been placed in quarantine. Then going towards location based tracking and finally contact tracing. All three sections contain an analysis of influential literature and also some case studies to provide granular recommendations.

Following this we also analyse the incentives which need to be factored to increase user adoption of technology interventions, which we premise is based on growing trust. This can be achieved by respecting a person’s autonomy and has to be done in a manner which respects their rights. To illustrate how a contact tracing system can be built around these prescriptions, the paper builds out a front-end analysis of three contact applications Singapore’s TraceTogether, MIT’s Private Kit : Safe Path’s Project and Aarogya Setu (Pages 59-73) in Section 7. We also look at the Apple-Google partnership and the promise that it holds, but also indicate the unique risks which emerge from trans-national, silicon valley companies deploying such solutions which requires a heightened level of scrutiny.

Finally, we end with an appeal to policymakers stating, “.Adapting a silicon valley adage, if we move fast, we may just break more than things – possibly, even democracy itself. It is hoped that this working paper provides policy makers in India with an opportunity to pause, reflect and consider that constitutional imperatives of personal privacy must steer technology based responses to the Covid-19 pandemic.”

We have three primary objectives from this working paper

A comprehensive map on Covid technology interventions: Our first and preliminary interest has been towards consolidating the incredible amount of literature on the technology based interventions that grows everyday. This is to document, analyse and then later pose solutions. We have here aimed to learn from the practices and learnings from several foriegn jurisdictions that can aid thinking in India.

Breaking the digital rights and technology development silos: Today technology based interventions are being designed they are driven out of a desire to immediately address the health and safety of large populations. These are increasingly done by technologists and programmers who may require detailed literature on digital rights and the implications for democratic guarantees. We hope this paper which undertakes specific case study analysis helps assist design based thinking and provides for actionable guidance in a manner which protects people holistically by safeguarding their health and privacy.

Collaborative solutions for government: We don’t have all the answers. But, maybe if we work together, some credible suggestions can be made to the government. Covid has brought a sense of urgency to collaboration and we hope to take your suggestions through this week and then submit this working paper to Government authorities. To facilitate ease of comment we are hosting it on Google Docs with the functionality for comment and review. In addition to this please do engage with the wider community over at the Internet Freedom Forum.

What does IFF plan to do with this working paper?

We will first work through this week with a series of explainers on our website to break it down into smaller, digestible pieces. So for instance by day after we plan to publish our case study comparison of contact tracing apps. This will be followed up by a further explainer on action based solutions to aid and assist policy makers. Based on feedback we receive through the week will also reach out to government, technologists, academics and experts.

This working paper is only one of the many public advocacy strategies in our tool kit to protect your privacy and fight against mass surveillance. For instance we have already filed RTIs to improve transparency in the development of such technology based interventions. More action will be taken as we continue to advocate for the protection of personal privacy along with public health.

Links to our Covid related work

  1. Working paper “Privacy prescriptions for technology interventions around Covid-19 in India” dated April 13, 2020 (Google Docs version / PDF Version)
  2. Representation to the Department for Telecom on ensuring connectivity and protecting net neutrality due to higher dependency on telecom networks (link)
  3. Representation to the Ministry of Health to issue an advisory against the disclosure of the names of persons placed under quarantine (link)
  4. Petition before the Supreme Court to restore 4G connectivity in Jammu and Kashmir to properly equip healthcare professional around Covid-19 (link)

The Corona virus is a not only a threat to our health. It is a threat to democracy. We need your help now more than ever. Please donate to IFF today and become a member.

3 Likes

Thanks for this superb analysis. Given how the government is coaxing app developers to market Aarogya Setu, I’m concerned it’ll specifically target health and fitness tracking apps, or even Google/Apple directly to share people’s health data? Sorry if you’ve already discussed this in the paper.

2 Likes

Apparently, even Singapore’s TraceTogether had privacy issues till it was pointed out to the developers https://splira.com/2020-03-28/

2 Likes