I was on @rahulkanwal's show on India Today yesterday, on privacy during COVID19 + Aarogya Setu app. Couldn't share all my points, but here goes:

1. The Privacy challenge we are all facing right now is balancing the health of many versus the privacy of a few.
(1/n)

2. These are unprecedented times, unprecedented measures are being taken. Surveillance happening right now: contact tracing,lists being published,drones being used to surveile,quarantined folks being asked to selfie themselves&Facial recognition being used on them by police.(2/n)

While some actions may be necessary right now + speed would have been given prominence over other factors, measures need to be taken to limit negative impact on individual privacy.

3. Three things here:
(a) Just because these are unprecedented times, doesn't mean that (3/n)

there shouldn't be proportionality in actions taken + necessity be benchmark.

Necessity&proportionality need to impact our choices when it comes to privacy violating actions. Releasing traveler data, publishing lists of quarantined ppl is neither. Govts have done this. (4/n)

(b) It's imp that we ring-fence measures to areas where necessary+time-limit them to emergency situations
(c) There are opportunistic co's looking to sell surveillance tech to govts eager to buy them. Situation cannot be used to legitimise tech that violates privacy.
(5/n)

4. Many of us have called for surveillance reform in India. Surveillance Reform bill should limits actions of what India's security agencies can do,would help protect rights. Can have a specific provision for temp measures that may be taken in situations like this one (6/n)

5. On Aarogya Setu app & contact tracing:
(a) Only works if everyone has app running+ location&Bluetooth on. Won't work for people w/o smartphones, which is large population in India. However it is imp right now to have contact tracing if it's done keeping privacy in mind. (7/n)

(b) Data being collected by app is stored locally(on device)only. This is good. it traces user movement&details of those in proximity. Data should only be shared w govt once a case tests +ve. Data of +ve case shouldnt be public,nor of those who they've been in contact with. (8/n)

(c) It's very important that the Aarogya Setu app be open sourced, so that it can be tested for privacy, and that further improvements be suggested by security researchers, so that the purpose of contact tracing be met even while protecting privacy. Singapore did this. (9/n)

Lastly, repeating this IMPORTANT point:

The measures being taken now should be temporary and limited by proportionality and necessity. They should NOT continue beyond this situation.

This situation cannot be used to legitimise violations of privacy as the norm.

(10/10)