COVID19 A probe into the Indian Data Protection Laws

Ø   

The petitioners alleged that: (i) the contract barely has any safeguards against the commercial and unauthorised exploitation of data entrusted towards Sprinklr;  and (ii) in case of any breach by Sprinklr, the Kerala government will have no legal recourse before the courts in India since the contract grants exclusive jurisdiction to the court of New York. The petitioners also submitted that the contract is violates Article 299 (1) of the Constitution of India.

Ø   

The Kerala government submitted that the contract was executed in order to overcome the “worst case projections” and the possibility of sudden spike in cases due to the outbreak of COVID-19. The Kerala government anticipated that tracking and tracing of citizens would be necessary with the assistance of a scalable information technology system and the available in-house technology was not well-equipped. The Information Technology Department of the government supported these contentions and asserted that the protection systems on Amazon Cloud Service makes it impossible for anyone including Sprinklr to breach the data confidentiality.

Ø   

The Union of India (UOI) emphasized that exclusive jurisdiction granted to the New York courts is unacceptable and that the State of Kerala should have resorted to competent Indian entities to maintain such ‘sensitive medical data’. The UOI also expressed concerns about the confidentiality of the data and potential breach.

Ø   

In view of the above, the court:

§    

directed the Kerala government to provide only anonymised data to Sprinklr and apprise the citizens that the data so collected from them will be accessed by Sprinklr or any other third party;

§    

issued a peremptory order that any residual data available with Sprinklr shall be entrusted back to the Kerala government;

§    

injuncted Sprinklr from committing breach of the terms of confidentiality and from parting with the data so provided under the contract to any third party;

§    

directed that Sprinklr shall not deal with the data entrusted upon them and shall entrust back all the data so provided by the Kerala government under the contract; and

§    

injuncted Sprinklr from advertising or representing to any third party regarding the data or using the name or logo of the Kerala Government in any kind of promotional activity.

Ø   

The Kerala High Court further observed that data confidentiality is about protecting data from unlawful, unauthorised and unintentional access and disclosure. Therefore, the authorisations to view, share and use data forms the hypostasis of all confidentiality requirements. The Kerala High Court also observed that the corner stone of managing data confidentiality is to a large extent, determined by the control over access to it and the modus and manner, in which it has been dealt with.