On May 30, the Ministry of Home Affairs issued a fresh set of guidelines for lockdown 5.0, another phase in India’s attempt to battle the coronavirus epidemic. Many more activities will be allowed from June 8. Much like the directives they replace, the new guidelines also contain a provision requiring employers to “ensure that Aarogya Setu is installed by all employees having compatible mobile phones”. The mandate is to be discharged on a “best effort basis” by the employer.
Aarogya Setu is a contact-tracing mobile app developed by the National Informatics Centre that seeks to utilise location data sourced from personal mobile phones of users to help the authorities in tracing individual cases of infection to contain the epidemic. The app is supposed to let users know if there is a Covid-19 positive case in the vicinity. However, the app involves data gathering at an unprecedented level, which includes a user’s name, gender, age, mobile number, travel and smoking history as well as location and address.
More troublesome, the state can watch the user’s movements. This access to sensitive personal data comes without a sunset clause, limiting when it will end. India’s Personal Data Protection Bill, 2019, has not become law and so India lacks a robust legal framework necessary to protect individual privacy and associated liberties.
Lack of data protection
Curiously, this directive has been viewed by many as being somewhat of a relaxation in contrast to the Centre’s previous order, which made using the contact-tracing app mandatory for all employees belonging to the public as well as the private sector in the face of the Covid-19 pandemic. Even privacy activists celebrated the supposed dilution as a victory.
First impressions aside, the Centre’s position offers more than one reason to postpone the party. The new set of directives are all the more intrusive as they seek to utilise the “employer” – a private actor – as the mechanism and means of ensuring compliance with the Centre’s vision and technology on the aspect of contact tracing.
The directive is an invitation to the overzealous employer to impose upon the employee the requirement to comply with the Centre’s desire that we all sign up for the app, without asking questions. All of this without the government having to address privacy or data protection concerns or even passing a law about this.
By making the private employer responsible for ensuring that employees download the app, the Centre seeks to suggest that the installation of Aarogya Setu on our personal devices is actually a compulsory condition for rejoining work. The manner in which the government has done this leaves employees with little option – being unable to summarily deny an element of coercion in such actions.
Already, several instances have been reported of employers reminding the employee that the installation and use of the application will be a mandatory requirement for entering the workplace. Many employers share the government’s vision on contact tracing. Most want to recommence business and almost all do not want any trouble.
Better yet, the employer is required to “ensure” discharge of the mandate on a “best effort basis”. This is wholly nebulous: the expression can mean different things to different employers. Obviously, this is antithesis to the theory of enforcement of laws, which begs for clarity and uniformity.
The obligation to enforce laws, much like that of making them, is an essential state function. Outsourcing this to the private non-state actor is an unprecedented example of intrusive governance, which seeks to meddle in the affairs of the citizen in an arena where the state has classically speaking, lacked locus.
The state has no business interfering in the relationship, which an individual may have with his employer or in urging a private non-state actor to ensure conformity with the vision or policies of the government by using the influence that the former may exercise as a reason of his fiduciary position.
In its current form, the directive could be legally challenged. The government has taken a circuitous route to make us sign up for an app without giving us a choice in the matter. The state would be better advised to appeal to the conscience of the individual citizen rather than to his non-State employer.
The author is a Delhi-based lawyer. Views are strictly personal.