The Karnataka High Court barred the Indian government and the National Informatics Centre from sharing user data stored in the Aarogya Setu app with other government departments and agencies without obtaining informed consent from app users. Aarogya Setu is the Indian government’s contact tracing app for Covid19.

Sharing information from the app without informed consent is a violation of the Supreme Court judgment that declares the right to privacy a fundamental right for all Indians. The users’ informed consent, as of now, is limited to the collection and the manner of collection of information, according to Aarogya Setu’s privacy policy, which does not mention data sharing or use.

However, the court did not put a stay on sharing information already collected via the app.

“…We hold that there is no informed consent of users of app for sharing of response data as provided in Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020, as there is no reference to protocol in the terms of use and privacy policy available on the app,” the Karnataka High Court bench noted Monday, in its response the petition brought by Anivar Aravind, a privacy activist.

Related on The Swaddle:

MIT Researchers Reviewed the Aarogya Setu App and Rated It 2/5

The Ministry of Electronics and Information Technology put together the Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020, in response to several queries regarding the app’s privacy policies after its launch in 2020. The protocol states that data may be shared with several ministries, departments, and public health institutions of the Government of India, including the Ministry of Health and Family Welfare, Government of India, Departments of Health of the State/Union Territory Governments/ local governments, National Disaster Management Authority (NDMA), State Disaster Management Authority (SDMA), and more, “where such sharing is strictly necessary to directly formulate or implement an appropriate health response.”

However, though the protocol seeks to inform people about data-sharing, it did not mention taking users’ informed consent before sharing the data. This became a problem as the Government made installing Aarogya Setu mandatory in order to use services like rail or air travel — an order which was repealed by the Karnataka High Court in October 2020.

“It is made clear that the use and retention of information and data will be limited to what is provided in the privacy policy,” reads the court order.