SUMMARY
MHA had said that use of Aarogya Setu app shall be mandatory for employees in private and public sector
A petition has been filed in Kerala high court against mandatory downloading of the app
Founders believe that it can be an important step, but privacy concerns need to be addressed first
Covid19 Tech Impact
Latest updates & innovations, in-depth resources, live webinars and guides to help businesses navigate through the impact of the COVID19 pandemic on India's economy.
Over the past month, the Indian government’s contact tracing app Aarogya Setu has made headlines for several reasons — from reaching 15 Mn users in four days to privacy concerns to mandatory downloads. The app has been the buzzword for India on social media as well as in daily use.
But beyond its alleged weak data security, the government directives on mandatory installations and the liability on employers to ensure “100% use of the app among all employees” has come under fire from India Inc.
“Use of Aarogya Setu app shall be mandatory for all employees, both private and public. It shall be the responsibility of the Head of the respective organizations to ensure 100% coverage of the app among the employees” — MHA order number 1-29/2020-PP dated May 1, 2020
The directives came into effect along with the third phase of lockdown on May 4 and multiple entrepreneurs we spoke to emphasised that the app is an important aspect of the fight against Covid-19 but the burden of ensuring downloads among employees is too much.
Even those entrepreneurs, who may not have been concerned about privacy issues, are now seeking government clarifications on data-usage and storage and more.
John Daniel, general secretary, Thrissur District Congress Committee, has filed a petition in Kerala High Court challenging the mandatory use of the app. Daniel pointed out that the centre’s directive had violated the fundamental rights of the citizen. There was also a possibility of misuse of the personal data collected by the app as well as surveillance of citizens.
The mandatory directive also took away the right of a person to decide and control the use of their personal data. One cannot be forced to give away data to a system, the petition claims.
The guidelines also had also made it clear that prosecution would be launched against those employers who did not comply with the directive, as per section 58 of the Disaster Management Act 2005. The directive did not specify which department or ministry or officials would be accessing the data, the petition said.
While many startup founders and chief executives agreed that some measures are needed, some did advise caution. Hospitality player Treebo Hotels’ cofounder and CEO Sidharth Gupta believes that drastic times call for drastic measures. “I think it’s fine for the government to use any and all mechanisms to implement a measure like this, which is crucial for monitoring and control the spread of the pandemic. Startups are known for hustling their way through their challenges. Looks like the government is doing the same. Can’t complain,” he added.
Similarly, Pune-based healthtech startup Doc32’s Hitesh Kakrani says that these are unprecedented times and the government has done relatively well. “We should do our best as well, as heads of our businesses we are also accountable to our customers, employees and stakeholders. If some additional care and responsibility from our ends could expedite the process of opening up economy, we should welcome it,” Kakrani added.
The Question Of Data Privacy
Delhi-based consumer electronics startup Leaf cofounder Ayush Banka says that instructions to check the status in the app prior to travelling for work is a good thing. But he also wanted more clarity on the data being collected. “But the app in itself has been under the radar due to the multiple data points it tracks on a regular basis that increases privacy risks for individuals, coupled with lack of proper data protection laws in India. So that stays in a grey area. Penalizing the management for making sure everyone uses the app is just pushing it further,” he added.
A consumer lending entrepreneur, who wished to remain anonymous, told Inc42 that it is not unreasonable to mandate companies to have the app downloaded in their employee smartphones as it will help the government in contact tracing. “However, valid chinks have been raised by hackers regarding the safety of the data collected by the app from unscrupulous hackers etc. The government should comprehensively and verifiably address the chinks exposed by the hackers so that it enables trust around the app, and doesn’t curtail adoption of it,” he added.
The privacy concerns around the app first began with its launch with issues in the privacy policy. However, over the last few weeks, more security concerns have come to light. French ethical hacker, Robert Baptiste, who goes by the name Elliot Alderson on Twitter, raised a security flaw saying that he was able to find out the Covid-19 status of a given area by exploiting a flaw which allows users to set a location within the application.
The above-mentioned founder also suggested that the government could also give specific clarifications of how it plans to delete this data which is being collected after the pandemic.
A Pune-based edtech founder said the question is the enforcement of mandatory installation by the companies. “On a high level, I’d say its a good thing for companies to actively encourage employees to install and use, however tracking and enforcing might not be feasible because of technical limitations,” he adds.
