Is COVID-19 Infecting our Privacy too?

By Shubhangi Agarwal and Harsh Singh

 

In times of emergency, government gets a free hand to take extreme measures in order to curb the impact of the crisis. This sometimes results in limitations being imposed on the rights of the people. A choice between individual right to privacy and public health easily shifts the balance in favor of the latter. Even in dealing with the COVID-19 pandemic, the government paid scanty regard to the privacy of the patients and those who were under quarantine. The State of Karnataka released a list of all international passengers with their complete residential addresses so that they can be identified to be under quarantine by the public.[i] Delhi government went a step ahead and put posters with names and addresses outside homes of people.[ii] The poster read “Do not visit. Home under quarantine.” Similarly, in Gujarat, the Ahmedabad Municipal Corporation (AMC) circulated complete details of all COVID-19 positive patients[iii] to enhance contact tracing.

The contrary, a less intrusive approach, adopted by the Odisha government is laudable. It has, by an Order[iv], made publishing of names and details of affected persons punishable under the Indian Penal Code. Similarly, Pune authorities also warned public against revealing identity of those infected with the disease.[v] This article seeks to answer some important questions pertaining to individual privacy vis-à-vis public health that has come to light due to the pandemic.

What does the law say?

1. Proportionality test of the Puttaswamy judgment

The nine judge bench in Justice K. S. Puttaswamy (Retd) v Union of India[vi] guaranteed us right to privacy under the constitution. However, it is not an absolute right and comes with restrictions. The court enunciated the proportionality test in the above judgment and developed the test further in the Aadhar judgment to check the validity of the state actions which infringe upon this fundamental right. Apart from the requirement of authority of law which should sanction the state action, the proportionality test lays down that i) there should be a legitimate aim, ii) there should be a reasonable nexus between the means used and the objective sought to be achieved, iii) the state action should be the least intrusive method in order to achieve the objective, and iv) there should be a balance between the infringement of right and the overall public benefit.[vii]

If the state actions curtailing individual privacy during COVID-19 pandemic is challenged before the court, will they pass the test of proportionality? The two Acts which have been invoked by the central and state governments to deal with the pandemic are: the Epidemic Diseases Act, 1897 and the Disaster Management Act, 2005. Both the Acts are broadly worded and do not authorize the government to infringe the right to privacy of the individuals. Sec. 6 of the Disaster Management Act, 2005 vaguely allows the Center to law down policies, plans and guidelines for disaster management and for effective response to disaster. Similarly, sec. 2 of the Epidemic Diseases Act, 1897 empowers the state government to make any regulations for preventing the spread and outbreak of a disease. What is troublesome is that apart from absence of clear provision authorizing them to breach the privacy of people, both the Acts also lack adequate safeguards to prevent their misuse at the hands of the state machinery.

The details of those under quarantine and of affected patients are being made public with the objective to curb the spread of the disease and to save people who are not affected from coming in contact with those who are affected. This may be argued to be a legitimate aim of the state, however, the extent to which public sharing of personal information may be helpful in fighting against COVID—19 seems limited. In absence of any cure or vaccine, social distancing is the only weapon to advance the fight against corona, and for its effective unqualified enforcement by police officials, sharing personal information of people has no role to play.

Moreover, there exists no rational justification to allow the personal information of people to seep out through the troop of doctors and public officials into public domain. The troop is in charge of treating the patients and effectuating contact tracing. To make publicly available, residential addresses and mobile numbers of those who are affected, will be of little help in fighting this pandemic. Therefore, a proper balance cannot be reached between invasion of privacy by the state and the larger public interest.

2. Justice D.Y. Chandrachud’s Majority Opinion

Justice D.Y. Chandrachud delivered the majority opinion in the privacy judgment and aptly held that “an unauthorized parting of the medical records of an individual which have been furnished to a hospital will amount to an invasion of privacy. On the other hand, the state may assert a legitimate interest in analyzing data borne from hospital records to understand and deal with a public health epidemic such as malaria or dengue to obviate a serious impact on the population. If the State preserves the anonymity of the individual it could legitimately assert a valid state interest in the preservation of public health to design appropriate policy interventions on the basis of the data available to it.”

The above opinion of the learned judge deals with individual privacy and its interface with public health emergency. It makes it abundantly clear that a legitimate assertion of the state on the personal data of the people will be valid only when it is handed over in an anonymized form and is used for drafting appropriate regulations to deal with the epidemic. Even in the face of health emergency, the judgment does not allow for complete sacrifice of right to privacy.

3. Right to informational self-determination as a facet of privacy

Informational privacy is a sub set of right to privacy as was held in the Puttaswamy judgment. This means that a person has control over the dissemination of material personal to her.[viii] According to the judgment, the person has individual autonomy over the use of her personal data and has a right to know the reasons for which her data is being used. Consent is paramount before using such data. Although public health can be a valid exception to the above principle, right to be forgotten (a facet of informational privacy) should be given effect to in such times. This means that even if personal data of people is being processed without their consent- i) the same should be done for a specific period and be removed once the purpose is achieved, and ii) in no circumstance, should it be made public.

Inference can also be drawn from the recent Allahabad High Court judgment[ix] in which the court slammed the UP government for putting up banners throughout the city with photographs, names and addresses of more than 50 CAA/NRC protesters. The court took suo moto cognizance of the case to protect privacy of these protesters. It ruled that the state can take necessary steps to maintain law and order but not at the expense of fundamental rights of the people.

4. Draft Personal Data Protection Bill, 2019

The Draft Personal Data Protection Bill, 2019 (PDP Bill), which was introduced in the Lok Sabha in December 2019, could have offered some respite on this debate. Clause 12 of the Bill lays down medical emergency involving a threat to life, medical treatment during an epidemic and public health – as valid grounds for not taking consent while dealing with personal data of people. However, even the PDP Bill prescribes that such curtailment of privacy should be for a limited purpose and must fulfill the criteria of lawful processing. Therefore, data processors (public officials in this case) can process the personal information of people for the limited purposes of contact tracing, research and medical treatment, and once the aims are achieved, they must remove it after a follow up period of one month. It is unlawful for them to disseminate such information into public domain.

Looking at it from a sociological perspective

The disclosure of personal information of people should be bare minimum. All efforts should be made to conceal critical information pertaining to sexual orientation and religious beliefs. Revealing identities of people who are affected may lead to their stigmatization and ostracization from the society. There are already reports that nurses and doctors have been asked to evict their homes by landlords[x] because people fear that the medical professionals carry the virus on them. Fearing the same harassment and discrimination, people may not come forward to share their travel history. Such publicizing of identities not only violates right to privacy, but also jeopardizes other fundamental rights inferred from Art. 21. Right to live a dignified life[xi] and right to reputation[xii] are significantly constrained. It also leads to emotional, moral and psychological distress which affects the well-being of people.

Conclusion

A robust democracy is one where civil liberties and rights are not eroded in times of crisis. It still remains to be seen whether the state actions infringing privacy during COVID-19 can pass the constitutional challenge. Both the Epidemic Diseases Act, 1897 and the Disaster Management Act, 2005 provide legal immunity to state officials for acts done in “good faith”.[xiii] The present unprecedented situation is a clash between the individual right to privacy and the acts done in good faith during a crisis. These are desperate times and state cannot be entirely blamed for resorting to extreme measures. However, they should be for a legitimate aim and adequate safeguards should be present to check their misuse. Moreover, the measures employed by state for constant surveillance on people under quarantine should cease to operate once the emergency is over lest we gradually transit into an Orwellian state.

“No society in which these liberties are not, on the whole, respected, is free, whatever may be its form of government; and none is completely free in which they do not exist absolute and unqualified.”

The authors, Shubhangi Agarwal and Harsh Singh, are final year law students at Dr. Ram Manohar Lohiya National Law University, Lucknow.

 

[i] Naveen Menezes and Bellie Thomas, ‘Government publishes details of 19,240 home-quarantined people to keep a check’ Bangalore Mirror, available at https://bangaloremirror.indiatimes.com/bangalore/others/government-publishes-details-of-19240-home-quarantined-people-to-keep-a-check/articleshow/74807807.cms, last seen on 05/04/2020.

[ii] Hemani Bhandari, COVID-19 poster outside west Delhi house keeping people away’ The Hindu, available at https://www.thehindu.com/news/cities/Delhi/covid-19-poster-outside-west-delhi-house-keeping-people-away/article31176892.ece, last seen on 06/04/2020.

[iii] Press Trust of India, ‘Names of 36 COVID-19 patients in Ahmedabad city made public’ Business Standard, available at https://www.business-standard.com/article/pti-stories/names-of-36-covid-19-patients-in-ahmedabad-city-made-public-120040301086_1.html, last seen on 05/04/2020.

[iv] Health and Family Welfare Department – Government of Odisha, Notification No. 8005/HA-Misc.-01/2020, available at https://health.odisha.gov.in/pdf/Media-regulations-advisory-prevention-Covid-.pdf, last seen on 07/04/2020.

[v] Press Trust of India, ‘Those revealing identity of COVID-19 patients to face action’ The Economic Times, available at https://economictimes.indiatimes.com/news/politics-and-nation/those-revealing-identity-of-covid-19-patients-to-face-action/articleshow/74590731.cms, last seen on 06/04/2020.

[vi] Justice K. S. Puttaswamy (Retd) v. Union of India, (2017) 10 SCC 1. (Privacy judgment)

[vii] Justice K. S. Puttaswamy (Retd) v. Union of India, (2019) 1 SCC 1, ¶ 318. (Aadhar judgment)

[viii] Nariman J. Concurring Opinion in Justice K. S. Puttaswamy (Retd) v. Union of India, (2017) 10 SCC 1.

[ix] In Re Banners Placed on Roadside in the City of Lucknow, (PIL) No. 532 of 2020 (Allahabad High Court, 09/03/2020).

[x] Niharika Sharma, ‘Stigma: the other enemy India’s overworked doctors face in the battle against COVID-19’ Quartz India, available at https://qz.com/india/1824866/indian-doctors-fighting-coronavirus-now-face-social-stigma/., last seen on 05/04/2020.

[xi] Jolly George Verghese v. The Bank of Cochin, (1980) 2 SCC 360.

[xii] Umesh Kumar v. State of Andhra Pradesh, (2013) 10 SCC 591.

[xiii] S. 4, Epidemic Diseases Act, 1897; S. 73, Disaster Management Act, 2005.