Thread by @SFLCin

The Aarogya Setu petition challenging its legality and voluntary-mandatory nature by our advisory board member @anivar is listed for hearing today.

@anivar is represented by Senior Advocate Colin Gonsalves, counsels from SFLC.in, Advocate @clifroz, Advocate @avani_chokshi and Advocate Ali Zia Kabir in the matter.

Senior Advocate Colin Gonsalves will be continuing his arguments today. You can read the updates on last hearing here:
sflc.in/update-anivar-…

In the last hearing, the Court had ordered the parties to file a brief note on the functioning of Aarogya Setu and its technical details. The ASG had then pleaded more time to make elaborate arguments.

In today's hearing, Senior Adv Colin Gonsalves contended that Aarogya Setu violates the purpose limitation principle as enshrined in Puttaswamy (2017) case. He contended that the App has e-pass, donation, telemedicine consultation, and most recently, the Open API functionality.

Senior Adv Colin Gonsalves contents that it is mandatory to take a self-assessment test if a person gets admission to various places based on the colour of a self-assessment test.
Similarly,without GPS the app will be inoperable, therefore, it is mandatory to share location data.

Senior Adv Colin Gonsalves refers to the IEEE article titled "A Survey of COVID-19 Contact Tracing Apps" and informs the Court that Aarogya Setu is prone to relay attacks. He also highlights the problems with proximity estimation, GPS, and false positives.
ieeexplore.ieee.org/stamp/stamp.js…

Senior Adv. Colin Gonsalves also contends that number of downloads is an insufficient metric to gauge the success of an app.

He then reads out definitions of consent and anonymization from the draft Personal Data Protection Bill, 2019. He also draws Court's attention to Clause 11 of the Bill which provides for "consent necessary for processing of personal data".

Senior Adv Colin Gonsalves informs the court that this is what a law governing data collection and processing looks like whereas the National Disaster Management Act, 2005 is a general law.

The Hon'ble Chief Justice states that the draft Protection Bill, 2019 is not a law yet.

Senior Adv Colin Gonsalves informs the CJ that he is highlighting the PDP Bill, 2019 only for illustrative purposes. As of now, the Union of India is in contravention of Puttaswamy I due to the absence of specific legislation governing data collection and processing.

Coming back to his arguments on free consent and de-facto imposition of Aarogya Setu, Senior Adv Colin Gonsalves refers to @iNetDemocracy 's tracker of instances where Aarogya Setu has been made mandatory.

He insists that consent obtained from employees or people by de-facto imposition of the App does not amount to free consent.

The bench assembles and the hearing resumes.

Senior Adv Gonsalves presses for interim prayer no.iii i.e. an order restraining the respondents during the pendency of this petition from proceeding with the Aarogya Setu and with the data collected, in any manner....

....whether the collection of data from members of the public is stated to be voluntary or involuntary.”

Senior Adv Colin Gonsalves court's attention to Aarogya Setu Data Access and Knowledge Sharing Protocol.

He refers to the phrase "strictly necessary" in Para 6(a) and contends that it is delightfully vague.

He draws the court's attention to Para 5(e) of the Protocol which states that the demographic data will be retained as long as the Protocol will remain in force.

This means that the demographic data can be retained forever unless the individual requests the deletion of their data.

Regarding the sunset clause, Senior Adv Colin Gonsalves argues that the sunset clause pertains to the Protocol and not the Aarogya Setu app. Therefore, there is no sunset clause for Aarogya Setu.

He reiterates the mission creep in Aarogya Setu and states that under the terms of service of Aarogya Setu Open API, even security is sub-contracted to companies.

He argues that the open sourcing of Aarogya Setu is partial in nature wherein the version of App on Playstore does not correspond to the version available on Github.

Senior Adv Colin Gonsalves, now, quotes principles of privacy as enshrined in the Puttaswamy 1 and the paragraphs concerning the requirement of specific legislation governing Aarogya Setu.

With this, Senior Adv Mr. Colin Gonsalves wraps up his arguments.

The matter has now been listed for hearing on December 15th, 2020 at 12:45 PM.

*contends