Thread by @barandbench

Kerala HC is hearing the batch of pleas filed over data privacy concerns in the Kerala Govt's contract with US-based company Sprinklr for management of data COVID-19 data of its citizens.

Apart from the plea taken up last hearing (Balu Gopalakrishnan v State of Kerala), at least 2 more PILs in filed by Opposition leader Ramesh Chennithala (Congress) and BJP State president K Surendran against Kerala being heard today. Advocate Asaf Ali has argued for Chennithala

Advocate Asaf Ali argued for Chennithala that data was taken from ignorant persons by Asha workers and shared with Sprinklr without their consent.

Advocate Mathews J Nedumpara now making arguments.

Adv Mathews Nedumpara says he has instituted individual proceedings "I am dead against the concept of Public Interest Litigation."

Court asks him to come to what interim prayers he wants.

"Mr Nedumpara, we will ask you once again - what is that you want today?"Kerala HC.

"We request you not to take names", Kerala HC says when Nedumpara starts to say he is not against anyone including CM.

"What is that you want today?" Court asks again.

"This is a vacation sitting, there are counsel waiting", Kerala HC tells Nedumpara. "We are telling you that we are accepting you allegations ex facie, but we require the State and respondents a chance to reply before we take a decision on registration of FIR."

"Hear me", Nedumpara requests, adding that he is being interrupted at every turn.

"Are your lordships hearing me?" Nedumpara asks as he presses on with submissions concerning registration of FIR.

"We are hearing very intently", HC responds.

Adv Nedumpara says that he is asking whether he can ask for a writ of mandamus to file an FIR an in the matter.

Kerala HC asks whether it can order the registration of an FIR without hearing the other side.

HC adds that it will consider the submission.

Nedumpara adds a second point that the Kerala HC should direct the Govt to consider bringing in an ordinance for a data protection law.

Kerala HC assures, "we will consider."

Advocate Krishnadas P Das now making submissions for BJP President, K Surendran (petitioner).

Adv Mathew Kuzhalandan arguing for a data security consultant, Binosh Alex Bruce (petitioner). Says that Govt failed to consider public interest in the #sprinklr deal. Says that nothing prevents Sprinklr from creating "secondary data" generated out of the COVID-19 data collected.

Kerala HC asks whether the petitioner is speaking about the "demographic risk". Adv Mathew Kuzhalandan agreed, suggesting that the Court may pass an order today directing that no secondary data should be created out of the COVID-19 data collected by #sprinklr

The very collection of data is against the KS Puttaswamy (right to privacy) judgment, says advocate George Poonthottam supporting a petitioner.

Kerala HC asks if there is anything to show that the people were forced to give the data (which got uploaded to #sprinklr servers).

"Is it your case that the persons who gave the data to Asha workers under pressure?" Kerala HC asks.

#sprinklr

Adv Poonthottam argues that data was collected contrary to law.

Kerala HC says it will come back to the argument. Observes that there is no case yet showing that persons were forced to give info, rather angle is that persons were unaware that info would be shared with #sprinklr

We are concerned about data confidentiality, says Kerala HC. "We are not blaming you or finding fault", the proceedings are not discriminatory. But Court is concerned that the confidential data of the persons should not be manipulated 5 years later after the epidemic.

“Life and data confidentiality is more or less equal in our eyes in value” says Kerala HC. Once COVID-19 is over, there should not be a data epidemic, says HC. People must not be made to run from pillar to post to New York (over data privacy breaches), adds High Court.

Advocate NS Nappinayi, specially appointed by State to assist the Court, given her expertise in cyber law makes submissions.

Kerala High Court asks whether the state is in error in not informing citizens that their data would be processed by a third party.

Kerala HC queries whether there is a possibility a person would have refused to share information if they knew that data would be spared with a 3rd party.

Adv Nappinayi answers in affirmative. HC appreciates candour.

Nappinayi goes on to speak on the security of data stored.

Kerala HC expresses concern that the contract is in "standard form".

#sprinklr

Adv Nappinayi says that apart from certain standard T&C, the contract was negotiated for the benefit of the State, with due appreciation for the data confidentiality of the citizens. Kerala HC says these aspects are not contained in the statement submitted for the State of Kerala

Nothing to state that the Govt had identified the company, Kerala HC takes critical note, in response to submissions that the Kerala Govt had identified #sprinklr. HC points out that the Kerala Govt's statement intimates that it was Sprinklr that first approached the Kerala Govt.

-The company offered to come to you
-You thought that the offer was reasonable
-The contract was in a standard form contract

Kerala HC observes, based on the statement filed for Kerala Govt. So you were forced to take a standard form contract, HC orally remarks.

What is worrying us that the IT Secretary took a decision without even consulting the law dept, even though there are many legal issues involved, Kerala HC says.

This is a contract under Article 299(1) of Constitution, it cannot be treated casually, the Kerala HC says.

There is a very precise restriction on the purposes for which the data can be utilised, Advocate Nappinayi asserts, speaking on how the data stored would be protected.

#Sprinklr

You are now talking about a situation where there is a data breach. They (people whose information is collected) can sue you. Are you not taking a risk for more litigation for a wrong committed by #sprinklr ? Kerala HC queries.

When data is submitted, in transit to its storage, it is in encrypted form. For some time, #sprinklr had access to the data for management. It is not transfer of the data to Sprinklr. The data is stored in Amazon servers. Sprinklr is given access to these servers: Adv Nappinayi

Data is in the control of the govt, being stored on Amazon servers. Access for a brief time is given for data analysis: Adv Nappinayi.

Adds that there has been an internal audit process to ensure that there has been no breach wrt data collected from April 4 till yesterday.

There has been no transfer of data. The petitions are based on apprehensions. Data has been at all times been protected and it is ensured that there is no retention of data by #sprinklr beyond contract, and that the data is deleted if the contract is not renewed: Adv Nappinayi.

With the present numbers, in the present situation, was a third party processor/SAAS provider necessary? Kerala HC asks.

Govt believed that it was necessary, says Adv Nappinayi.

#sprinklr

Why is it that you (Kerala) did not choose a data analytical tool from India for the purpose? Kerala HC asks. Why approach a foreign company, the Court asks.

UOI with NIC support ready to offer such an application, the Court says perusing UOI statement.

Kerala HC asks AAG why #sprinklr was chosen. S Kannan making submissions for Kerala

"Is this the way contracts are entered into?" Kerala HC says, based on Kerala Govt's statement which states that Sprinklr offered their services. "In the next page, you say that it was selected."

What are the credentials of #sprinklr in the statement? Why haven't you given us that information? Kerala HC states.

S Kannan says that it may be submitted further. Adds that the Govt was confronting an unprecedented crisis.

Why only this company? Kerala HC queries.

You had about 17 days to negotiate, Kerala HC says on going through when Kerala Govt began negotiations with #sprinklr based on submissions. Where is the question of emergency? What was the tearing hurry to go ahead with the contract without consulting with the Law Dept? - HC

For goods and services with costs less that Rs 15,000, there is no need to go to the law dept, Adv S Kannan.

HC says that this submission (i.e. there was no need to go to law dept) is concerning, pointing out that Govt statement itself deals entirely with legal implications

In your statement, you mention that this was a standard form of contract. Where is the question of leeway (to guard the interests of data providers in Kerala)? Kerala HC asks.

Why was jurisdiction ceded to New York? Kerala HC asks.

#sprinklr

Advocate Nappinayi: All responsibility rests with Kerala; vendor says he will not retain or share the data; we have no basis for apprehension or concern...

Kerala HC asks if there is any counsel appearing for #sprinklr.

No one appears, the Court finds. Adv Nappinayi continues.

Court breaks for a 20 min recess. Court to reconvene at 2.15 pm.

Kerala HC continues hearing the cases filed against the #sprinklr deal. Advocate N S Nappinai continues submissions on why Sprinklr was opted for.

It is not like the Kerala Govt is going to be bound "till death does it part" to Sprinklr. Today, govt believed that this was the best option available to analyse the unstructured data: Advocate NS Nappinai. Adds that it is open to Kerala to continue with #sprinklr or not.

Your submission is that IT department decided to take up this deal because it was "pro bono", but then there are submissions that you have to pay for it after 6 months, Kerala HC takes critical note.

#sprinklr

Party in person Atul Sohan says that he wants to implead in the matter. Asserts that no order should be passed unless he is heard.

"Is that a command or a request?" Kerala HC asks.

"It is a request", says Sohan, "But a strong one."

#sprinklr

Sohan asserts that he should be heard because he has certain information. He adds that a prayer he is making is that the collection of COVID-19 data should not be stopped.

#sprinklr

Kerala HC says that it is not considering any impleadment petitions for now, will be considered later. The matter is only in the admission state, the Court points out.

#sprinklr

Assistant Solicitor General tells Kerala HC that failure to consult the legal department by Kerala Govt before entering the #sprinklr deal was a serious legal lapse.

According to you, if the state govt approaches you, you are willing to give (tech) support? Kerala HC asks Asst. Solicitor General.

ASG P Vijay Kumar responds in the affirmative. Adds that allied instructions have been given by the Union Health Department.

#sprinklr

ASG P Vijay Kumar also adds that there is concern that the antecedents of #sprinklr were not looked into.

We hope that the state does not treat this as adversarial litigation. The fight against COVID-19 is not over, today a child has died. We are all concerned: Kerala HC orally observes.

#sprinklr

One lawyer starts talking about an alternative app that may be used instead of #sprinklr . Kerala HC responds that it is not hearing on what alternative app to use. Says that it is up to Kerala Govt and the Court is hearing why Sprinklr was chosen.

Referring to venue of dispute resolution being New York, USA, a counsel points out in the passing that as per the laws in the US if the government asks for certain data, the company is bound to hand it over to them.

#sprinklr

Central Govt says (in its statement) that data can be given to third party only after anonymising the information i.e. names, addresses etc. of the persons cannot be given. What do you have to say about that? Kerala HC asks Govt.

#Sprinklrdatascam #sprinklr

State counsel responds that names are not given as of now, phone numbers are masked.

Phone numbers also cannot be given, Kerala HC emphasises.

#sprinklr #Sprinklrdatascam

Who takes the responsibility of anonymising the data? Kerala HC asks.

The Kerala Govt will have to, responds Advocate Nappinai.

#sprinklr #Sprinklrdatascam

Kerala HC asks Advocate Mathews Nedumpara why he has named so many people in his petition without any allegations.

Nedumpara said he was following principles of natural justice, that he cannot seek prayers against them (without arraigning them).

#Sprinklrdatascam

Party in person Atul Sohan tries to submit interim prayers. He says that if orders are passed without being heard, it would infringe his rights. HC says that it is not taking up any impleadment petitions.

#sprinklr

"What do you want to say, tell us" Kerala HC asks Sohan. "How can an impleading petitioner seek prayers (without being impleaded)?"

#Sprinklrdatascam #sprinklr

Please understand we are in an admission hearing. We are concerned about data confidentiality. The Kerala Govt has made extremely serious submissions... We do not know how the company was selected...: Kerala HC orally remarks.

#sprinklr #Sprinklrdatascam

Kerala HC adds that it may be too late to set aside the contract as the COVID-19 fight may be impeded. The Court will have to strike a balance, it is orally remarked.

We cannot let the battle be affected in any manner, Kerala High Court says.

#Sprinklrdatascam

We are not happy with the state, how they have conducted the #Sprinklrdatascam deal, Kerala HC adds. There are various concerns raised that will have to be argued in later days, Kerala HC.

Court says that it will be passing an order injuncting #sprinklr from misusing data shared with it as part of COVID-19 data management in Kerala.

Kerala HC starts dictating order.

Kerala HC admits all writ petitions filed raising confidentiality concerns over Kerala Government's contract with #sprinklr for management of COVID-19 data.

Imperative data regarding with whom data is shared; how it is maintained confidentially; how it is to be dealt with after processing/analysis - and its conditions -become vital, Kerala HC.

#sprinklr #Sprinklrdatascam

Petitioners project apprehensions that there may be unauthorized and commercial exploitation of data shared with #sprinklr. Further, Court recounts that there are concerns that the jurisdiction lies with New York if there is any breach of data.

#Sprinklrdatascam #sprinklr

Court summarises submissions made for Kerala: State is firm in the assurance that there could have been no breach of data in the past. However, it is admitted that there has only been an internal audit from April 4, and not of the time prior, Court recounts, inter alia. #Sprinklr

Kerala HC recounts submissions for Central Govt by ASG that primary concern is regarding data confidentiality of citizens; that MSA shows New York as the venue of jurisdiction; lack of confidentiality clauses and the failure of legal dept to vet the contract. #Sprinklrdatascam

Kerala High Court records submission of ASG that if Kerala Govt approaches them even now, the Central Govt is still willing to provide all support. Recounts that Centre had questioned why a foreign company was approached for the data processing. #Sprinklrdatascam #sprinklr

Kerala HC says that it passing its directions with the singular intent of"ensuring that there is no data epidemic after the COVID-19 epidemic is controlled."

#springst #Sprinklrdatascam

MEiTY is of the opinion that sensitive data should be stored in government servers. And further that such information should be shared only after it has been anonymised, Kerala HC observes.

Records Kerala AAG's submission that only anonymised data will be supplied to #sprinklr

1. Kerala HC orders Kerala Govt to anonymise all data collected from citizens with respect to COVID-19 before allowing access to #sprinklr. This must be done with respect to all data collected in future. Sprinklr should be given access only after the data is so anonymised.

2. Kerala HC injuncts Sprinklr from committing any act which will be directly/indirectly in breach of confidentiality of data entrusted to them under the contract. They shall not disclose/part with the data with any 3rd entity of whatever nature/composition anywhere in the world

3. Kerala HC orders #sprinklr not to deal with data entrusted in conflict with the various confidentiality clauses/caveats and that they will forthwith entrust back all such data to the Government of Kerala as soon as the contract is completed.

4. As per Govt submission, no data is with #sprinklr as of now. Therefore, Kerala HC orders that any secondary data with #sprinklr would be entrusted back to the Govt of Kerala and this shall be treated as a peremptory direction.

5. #Sprinklr injuncted from advertising or representing to any 3rd party that they have access to any data relating to COVID 19 patients or persons vulnerable/susceptible to it.

6. #sprinklr ordered not to use or exploit any such data for any commercial benefit and they shall deal with such information maintaining full confidentiality for the Kerala citizens whose data is collected.

7. #sprinklr not to use the data collected or to use the name or official logo of the Government of Kerala.

Kerala HC directs Kerala Government to inform every citizen from whom data is taken that such COVID-19 data is likely to be accessed by #sprinklr or a 3rd party and their specific consent for the same should be obtained in the necessary form before data collection.

Matter adjourned by three weeks. All respondents are to complete their pleadings by then.

#sprinklr #Sprinklrdatascam #KeralaHC #Covid_19india

Kerala HC injuncts Sprinklr from misusing COVID-19 data, Kerala Govt ordered to take informed consent from citizens before data collection
#sprinklr #Sprinklrdatascam #KeralaHC
barandbench.com/news/litigatio…