The court was hearing a petition filed by data privacy activist Anivar Aravind, who has alleged violation of privacy of citizens through data collection and sharing done by the Arogya Setu app.
“Till further orders, we hereby restrain the Government of India and National Informatics Centre, the eighth and seventh respondents, respectively, from sharing the response data by applying the provisions of the Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020, issued vide order dated May 11, 2020 unless the informed consent of the users of Aarogya Setu app is taken,” the court said.
The court, however, said that the Centre and NIC can file an affidavit to satisfy it on the legal sanctity of orders issued by the Chairperson, Empowered Group on Technology and Data Management, and that the informed consent of Aarogya Setu app users will be taken for sharing of data as laid out in the protocol.
The bench observed that the Centre has not clarified whether the powers of the Chairperson of the Empowered Group on Technology and Data Management are binding under the Disaster Management Act, 2005. “There is nothing on record to show that the powers of the authorities under the said Act of 2005 have been delegated to the said Empowered Group,” it observed.
“The sharing of health data of a citizen without his/her consent will necessarily infringe his/her right of privacy under Article 21 of the Constitution of India. There-fore, prima facie, the said protocol regarding sharing of ‘response data’ cannot be permitted to be implemented,” the HC observed.