The Dialogue, a Delhi based technology policy think tank published and released a 14-point privacy framework for the Aarogya Setu App. We believe there is merit in deploying Aarogya Setu to help combat Covid-19 through contact tracing and we believe that changes and tweaks to the privacy and security architecture of the app will make it far more robust and effective to deliver on its purpose.
The framework suggests that measures should be taken to harmonise right to privacy with the right to public health, and such measures be limited to the extent necessary, legal and proportional, in order to meet the ends of maintaining public health.
The framework is built around core privacy principles that would foster public confidence and trust in the app, without compromising on the functionality of the app.
It is important that to popularise it among the masses, the application be open source. Moreover, by allowing data auditing, concerns regarding lack of checks and balances, and accountability will be resolved. Secondly, the app does not clearly define the purpose of its use. Further, the policy should be designed in such a way that minimal data is collected for maximum output.
In the framework, the report recommends the promulgation of an ordinance which would legitimise the mandatory download of the app only after ensuring the existence certain predefined criteria. Other suggestions include, deletion of all data (except anonymised data required for tackling future pandemics) post the pandemic, data minimisation, access restrictions, defined protocols, and appointment of an independent auditor who will ensure that privacy respecting measures are being adhered to at every step of the data cycle.
On the technical front, adoption of state-of-art anonymisation techniques, enhancement of the grievance redressal forum, and most importantly, making the App ‘open-source’ are pointers that would enhance the architecture of the app, and embed privacy in the design.
The app needs to be transparent and verifiable. It is important that to popularise it among the masses, the application be open source. Moreover, by allowing data auditing, concerns regarding lack of checks and balances, and accountability will be resolved.
Kazim Rizvi is founding director of emerging public policy think-tank, The Dialogue. The views in this article are his own.