Thread by @rhetonik

(1/n) A list of about 150 residents of Nagpur city was openly shared on several WhatsApp groups last night. It contained tabular data that consisted of names, addresses, phone numbers of home quarantined individuals, organized by zones and police station. #covid19india

(2/n)This list did not mention a header or footer or any source or owner responsible for this sensitive data. It did not mention whether consent was sought from home quarantined individuals for sharing their private information openly over digital or offline media. #covid19india

(3/n) This immediately triggered vigilantism on groups where the list was shared. A lot of those listed on the set of home quarantined individuals started receiving calls. #covid19india

(4/n) Many justified open sharing of private information that was otherwise meant to stay restricted with relevant authorities, in the name of social security.

(5/n)Let us realize that COVID-19 is a temporary threat. Private and sensitive information such as addresses and phone numbers shared openly, will stay in public domain even after COVID-19 were gone. It makes those self quarantined individuals vulnerable. #covid19india

(6/n) An issue that needs urgent attention is the trust and accountability of civic bodies with personal data. Do they follow processes to ensure secure chain of data storage and access? Which civic body is responsible for creation and maintenance of that PDF? #COVID2019india

(7/n)Another issue is whether and what consent to share private data was sought. What level of data sharing was agreed upon by said individuals? Was this data allowed to be shared openly or was it meant to stay restricted to civic bodies? #covid19india #privacy #dataprotection

(8/n) If data was shared without consent from individuals, then it is a violation of the fundamental right to privacy as it makes individuals vulnerable to vigilantism, nuisance, spam, and anti-social behaviour. #covid19india #privacy #data #dataprotection #righttoprivacy #India

(9/n) While it creates an environment for #vigilantism, rumours, and possible #violence, this also attracts legal action under the Indian Penal Code Section 505(1)(b) and 505(1)(c) over statements conducing to public mischief, and #IPC 153, 153A, and 153B. #covid19india

(10/n) At the time of a global crisis, the least we can do is act responsibly and protect each other's fundamental rights. Please refrain from spreading private and sensitive information, and rumours or hatred against those infected/suspected. #covid19india #privacy

(11/n)Lakeer ke fakeer!
Dy Commissioner says they were restricted from disclosing details of COVID positive cases, so this disclosure is legit. WTF!
The Dy Commissioner needs education on privacy, data breaches, and Section 72A of the IT Act of 2000. #covid19india #privacy

(12/n) Anyone planning to pursue / already initiated #legal action against this? I'd like to volunteer! We need reforms in the way data is managed by public agencies. It cannot be this callous. Guidelines for data authorization, access, sharing, and disposal are needed. #privacy

(13/n) Reports coming in,of similar non-consensual disclosures of self isolated individuals in Ajmer and Mohali too. People's Health Movement @jsa_india is taking this up with @MoHFW_INDIA. Anybody who's affected by this data leak can seek support with JSA. #covid19india