Read on Twitter
On May 11 @GOI_MeitY published the Aarogya Setu data access and sharing protocol, signed by @SecretaryMEITY. IFF has done a clause by clause analysis of the Protocol and found many shortcomings.
1/12 https://internetfreedom.in/we-studied-the-protocol-and-no-this-doesnt-sufficiently-protect-your-privacy/
1/12 https://internetfreedom.in/we-studied-the-protocol-and-no-this-doesnt-sufficiently-protect-your-privacy/
A generous description is that it does not satisfy thresholds of legality, necessity and proportionality. More realistic is that without intervention the framework does little to improve privacy and justifies the Government’s otherwise unconstitutional practices.
2/12
2/12
The Protocol shouldn't be bandied about like it is a legislation which holds @SetuAarogya accountable. @SecretaryMEITY has said there are no plans to create an underlying legislation since the “priority at present is to deal with the epidemic itself”
3/12 https://www.business-standard.com/article/economy-policy/no-plan-to-bring-in-law-to-regulate-aarogya-setu-at-this-point-secy-meity-120051000727_1.html
3/12 https://www.business-standard.com/article/economy-policy/no-plan-to-bring-in-law-to-regulate-aarogya-setu-at-this-point-secy-meity-120051000727_1.html
Also we are concerned with risks of:
Mission Creep
Excessive Sharing across government departments
Justifications for a centralised system of data collection
4/12
Mission CreepExcessive Sharing across government departmentsJustifications for a centralised system of data collection4/12
Broad purposes which go above and beyond exposure notification technologies, which one of the drafters of the Bill posited as the sole purpose of @SetuAarogya. In this context, the vagueness in the purpose of the Protocol is certainly curious.5/12 https://vidhilegalpolicy.in/2020/05/11/aarogya-setus-data-access-and-knowledge-sharing-protocol-2020/
The Protocol uses buzz words like “necessary and proportionate”, but does nothing to meaningfully incorporate these privacy respecting principles, as subsequent sentences undercut these principles with liberty.
6/12
6/12
There is considerable opportunity to share data across govt departments and institutions. It brings into question whether @SetuAarogya's purpose is containing the spread of COVID-19 or discovering applications of a system which is feeding on people’s data during a crisis.
7/12
7/12
Finally, we find that the Government is already linking Aarogya Setu with different Government and university databases. This means that the risk of a permanent system of surveillance is already under way!
8/12
8/12
The sunset clause misses the point i.e. we need a defined period after which all data collected by @SetuAarogya and the supporting systems is destroyed. It talks about deletion of personal data with no reference to what happens when it comes to the extracted anonymised data.
9/12
9/12
For more please read our full clause by clause analysis here. We also look at a PPT accompanying a recent Press Briefing and highlight concerns with that as well.
https://drive.google.com/file/d/1CsDRlMDvqAH1Dq2xU5nP7GxdnDPIKhWp/view
10/12
https://drive.google.com/file/d/1CsDRlMDvqAH1Dq2xU5nP7GxdnDPIKhWp/view
10/12
We would like to thank @VrindaBhandari @gautambhatia88 and Abhinav Sekhri in helping us unpack the Protocol with such comprehensiveness, in such a short time frame.
11/12
11/12
IFF remains a grassroots org committed in the fight against mass surveillance and hopes to ensure that the Government remain accountable while deploying technology in responding to a pandemic. Please help sustain our efforts and donate to us!
12/12 https://internetfreedom.in/donate/
12/12 https://internetfreedom.in/donate/
