THE world is grappling with the kind of situation that it has never seen before. The rapid pace of COVID-19 spread made it necessary for the governments around the world to use extreme means and measures that would otherwise be considered Orwellian. These emergency measures include attempts to effectively enforce a lockdown and, strictly prohibit and track movements of the citizens in a bid to break the chain of infection.
As governments are attempting to contain the contagious virus, the use of technology for monitoring people undergoing quarantine has doubled. Considering the scale of the crisis, civil liberty activists and privacy advocates seem to have tacitly embraced such Orwellian state of affairs, unlike the ordinary times. It is obvious that this pandemic is reshaping our relationship with surveillance technology, albeit to the fear of some the surveillance could become a norm.
Across the globe, countries are expansively deploying tech-enabled surveillance infrastructure of Face Recognition Technology (FRT) based CCTVs, drones and cell phone tracking devices for contact tracing and enforcing quarantine. The growing number of countries such as Israel and South Korea are 'contact tracing' using mobile applications or cell phone records. It is a process of mapping the travel history of an infected person by analyzing location records of the cell phones. It is followed by pinpointing the other contacts for quarantine that might have come in contact with such a person. Meanwhile, Taiwan has gone a step further in quarantining the traced contacts by deploying an 'electronic-fence'. If a mobile user's SIM card is tracked beyond the reach of a network station or found to be switched off, law enforcement authorities quickly approach the suspect.
In India local authorities of several states such as Rajasthan, Punjab and Delhi, have published the lists of personal details, in online media and platforms, of those suspected or infected of COVID-19. The Karnataka government has taken this to an inordinate level by mandating all quarantined persons to send a selfie with geo-tags through an official app named 'CoronaWatch' every hour, except during sleeping time 10 PM to 7 AM. Now, the Ministry of Electronics and Information Technology (MeitY) has also launched an app- 'Aarogya Setu', which uses Bluetooth and GPS of user's device to alert an individual if they come within six feet of a Covid-19 infected person.
In normal times, such measures are targeted against terrorists or criminals; while also scrutinized vide privacy and civil liberty concerns. However, the public health emergency of such unprecedented magnitude is being touted as a valid justification for deploying tech-enabled mass surveillance and subversion of individual rights. Even the World Health Organisation (WHO) has sought to play down privacy concerns in these unprecedented times, by terming such measures as "public health surveillance". The WHO has simply legitimized the governments' argument that the pandemic situation necessitates the use of an extraordinary measure of mass surveillance.
Is surveillance a matter of concern for India?
There are certain unique reasons due to which implementation of these emergency measures, in India, is worrisome.
Firstly, in India, neither the Central nor the state governments have provided any legal basis for directing such measures. For instance, neither the official press release of the Aarogya Setu app and Karnataka's mandatory selfie direction mention any legal grounds for such actions nor have they provided any privacy policy attached with it. The absolute abandonment of civil liberties and privacy in the interest of public health, without the bare minimum legal foundation, portends negative consequences.
The government has invoked the Epidemics Diseases Act, 1897 and Disaster Management Act (DMA), 2005 to deal with the COVID-19 outbreak. Both, the colonial era Acts do not specifically cover surveillance in their scope. However, there is an argument that due to the basic residuary power vested with governments under mentioned laws, the government can take 'necessary' steps such as surveillance to curb the spread of the virus.
If the case is so simple, then it is doubtful that why the government has not availed the same residuary powers to also notify the standing rules on privacy or lawful manner of deployment of tech-enabled surveillance measures. As a natural consequence, government directives infringing an individual's right to privacy and liberty cannot be tested for their legality. This is particularly dangerous in a country like India where even a data protection statute does not exist.
Secondly, the details regarding the technical capabilities of the government for surveillance are largely a secret. It is the sudden outbreak of pandemic that has forced the government to openly introduce a deluge of unregulated, contemporary and emerging technologies for mass surveillance. Further, the secrecy about the techniques of surveillance impedes the legislative checks or institutional audits. If the public is unaware of how a technology works (due to non-disclosure by the Executive), the said manner of surveillance then cannot be even challenged in any court of law. There is a growing concern among certain privacy advocates that the tech-enabled surveillance could persist beyond the pandemic once it gets accepted and normalized in the present emergency times. History is witness that the world's most dictatorships and authoritarian regimes emerge amid the crises.
Thirdly, due to the use of technologies of varying level of invasiveness, there are doubts regarding the necessity and proportionality of such measures in relation to the right to privacy and individual liberty. The Puttaswamy (I) judgment upheld, explicitly recognized in reference to public health, that to legitimately restrict fundamental rights such as privacy and liberty for implementing a measure, such measure should be proportionate in nature.
More than half of the population of the country doesn't have access to internet services. In the context of such a scenario, how is surveillance through a mobile application is a necessary measure? Further, several state governments are taking very extreme measures of disclosing the home addresses and other personal details of infected and suspected persons. An obviously lesser intrusive measure such as informing at a locality level about the presence of infected cases in particular areas could have sufficed. Allahabad HC also held such practices, publishing personal details of anti-CAA protestors in public, of the UP government as "arbitrary invasion of privacy".
Invariable disclosure of private information of infected and suspected persons has prompted concerns and possibilities of social intimidation. There have already been reports from across the nation of infected and suspected patients facing the stigmatisation, and various forms of discrimination which are further resulting in a negative social impact. For instance, in Maharashtra, public listing of coronavirus suspects on social media led to several cases of forceful eviction of quarantined people by their landlords. Such events question the proportionality and necessity of the measures adopted.
There is no denying that certain limitations can be imposed on civil liberties given the urgency of the COVID-19 crisis. However, in a democratic set up like India, it is expected from the government that its actions be transparent. All the worrisome aspects related to public health surveillance measures can be subdued by making concerted efforts to introduce legal backing for its actions, to establish institutional oversight and to use the least intrusive means. For providing the legal basis, the government can issue the standing rules that would lay down the legal and accountability measures for the responsible local authorities undertaking public health surveillance. The governments should avail the residual powers under the NDMA and the Epidemic Diseases Act to also issue the ad-hoc rules and guidelines in addition to the emergency surveillance measures.
The government can presently provide such ad-hoc rules for privacy protection based on similar principles as delineated in the Personal Data Protection Bill 2019 ("PDPB 2019") for the data collection during health emergencies. Clause 12 of the PDPB 2019 exempts the data fiduciaries from taking consent under urgencies like a pandemic, but strictly imposes requirements of data minimization or purposes limitation, lawful processing, transparency and accountability. Introduction of such principles will ensure that the information collected during surveillance is being handled under the constitutional checks to maintain privacy as much as possible
Such ad-hoc rules will obligate the government as a data fiduciary: 1) to follow the principle of purpose limitation which limits the collection to the minimum possible data which is sufficient for tracing contact, enforcing quarantine and any other specific purpose; 2) to use the anonymised data only and adopt all security measures to prevent leaks and maintain the confidentiality of personal data of data subject; 3) to delete the collected data at the earliest after it has been used for the specified purpose. This will automatically shun away the emerging concern that the surveillance's effect could persist beyond pandemic. Further, it will inhibit the misuse of personal data and abuse of surveillance measures.
It is suggested that the government should hold no secrets about its surveillance techniques as they are purposively for the benefits of the public only. It should adopt a method of "Public Notice" system such that the local district administration has to notify the measure and manner of surveillance before its implementation. At the very least, this notice should disclose the legal rules governing the tech-enabled surveillance measure, and its purpose. It should be clear on the authorization required for the retention, access, and use of information collected through the use of such novel technology. Such a notice would provide a window to the public to exercise a meaningful control and oversight over the manner of deployment of such tech-enabled surveillance.
Unarguably, the present situation calls for the governments to take substantial measures to protect the lives and health of the public at large, but this should not happen in the utter disregard of principles of constitutional democracy. There is no hard choice between public health and individual's right to privacy and liberty. Both can mutually co-exist under the legal framework that guarantees the challenge to the unnecessary expansion of the surveillance regime.
As pointed out by Deborah Brown, a senior digital-rights researcher at Human Rights Watch, "surveillance measures should come with a legal basis, be narrowly tailored to meet a legitimate public health goal, and contain safeguards against abuse". The fundamental rights are lung to the edifice of our entire constitutional system. The government should make efforts to prevent any injuries to it as much as possible amid the worst pandemic our generation has seen.
(Aryan Babele, a final year student of Rajiv Gandhi National University of Law, Punjab. He runs a blog titled "Law for Innovative Technologies". The article includes research inputs from Faiz Uddin Ahmad, a Second Year Student at Rajiv Gandhi National University of Law, Punjab)