The Jammu and Kashmir administration shared data of citizens, who registered with the Government of India’s controversial COVID-19 contact tracing application Aarogya Setu, with the police, a Right to Information (RTI) reply has revealed.
The RTI filed by New Delhi-based activist Saurav Das, accessed by The Kashmir Walla, demanded to know “the security practices and procedures implemented by such agencies/persons that have been given access to the data” under the Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020 as notified by the GoI.
In a brief response to the query, the office of the Chief Medical Officer (CMO) in south Kashmir’s Kulgam district has admitted that it shared with the police the data of persons who tested positive for COVID-19, including those who died and recovered from the virus.
Fazil Ali, the CMO, told The Kashmir Walla in a phone interview that the data was shared after his office received “directions” from the police but also stated that the Health Department “needed their assistance as well.”
The contact tracing of COVID-19 patients was done in coordination with the police, Ali said, but declined to comment on whether the department had shared patient data collected outside of the Aarogya Setu application, insisting that “we have answered all the questions in the RTI.”
The Aarogya Setu application was developed by the National Informatics Centre under the Ministry of Electronics and Information Technology during the COVID-19 lockdown last year.
The use of the application was controversial since its launch, with activists and cyber experts pointing to extensive data collection — including individual’s movements — but also security loopholes and the lack of data privacy laws associated with it.
“What we fear is that because the protocol doesn’t have a purpose limitation which means what is Aarogya Setu for and what will be the data used for is not clearly mentioned anywhere,” Das told The Kashmir Walla.
“Therefore the data is free to be used however and a general consent has been taken by people and the data has been shared with law enforcement agencies and possibly for surveillance purposes.”