RIGHT TO PRIVACY CHALLENGES IN THE TIMES OF

COVID-19
Louis Brandeis and Samuel Warren are considered the fathers of the concept of the
right to privacy, publishing in 1890 an article entitled “The Right to Privacy” in the
“Harvard Law Review”. They created the notion of the “right to be left alone”,
proclaiming that there is a certain zone of individual behaviour and interpersonal
relations which should be free from any external interference both vertically (from the
state) and horizontally (from other individuals).

In India the famous Maneka Gandhi case upfront the right in its full fledged way.

Closure of national borders, restrictions on air traffic, enforced remaining at home

under threat of fines, closure of cultural centres, and prohibition of physical activity
done outdoors constitute examples of new restrictions on the right to privacy which
must find their normative justification in times of a global pandemic. Community
action, including the decision of 20 March 2020 of leaders of Nation (India) states to
close the India’s external borders for 21 days, also fundamentally restricts one of the
expressions of the right to privacy, the free movement of persons. Article 21 of the
Constitution could provide an answer to the question of permissible limits on the right
to privacy. In the context of the challenges posed by the pandemic, it is important to
state in this article that the factors which may justify the state limiting the right to
privacy include public safety, protection of health and protection of the rights and
freedoms of others. There is no doubt that restricting the right to privacy may have a
secondary impact on the exercise of other rights such as freedom from forced labour,
electoral rights, or freedom of economic activity.

 PUBLICATION OF MEDICAL REPORTS

While mass monitoring and data processing systems appear to be

indispensable weapons in a government’s arsenal against the ongoing
pandemic, citizens should exercise extreme caution to ensure that these
systems do not become the new normal.
Privacy of COVID-19 suspects violated; names, addresses made
public

In the course of the government’s efforts to contain COVID-19 pandemic

across different states in the country, an essential component of patients’
rights is being violated. On March 20, the Rajasthan government made
names and addresses of COVID-19 suspects public through newspapers and
social media, claiming that it will ensure effective containment of
coronavirus transmission.

The names of 46 people suspected to have contracted the virus in Ajmer

along with their addresses have been revealed in some local Hindi
newspapers, too. Likewise, a list of home-quarantined persons in Nagpur
went viral on social media groups, carrying names of over 300 people from
the city who have been advised home isolation or self-quarantine. Details
included the person’s name, address, mobile number, start date of
quarantine as well as the police station under which jurisdiction the
residents comes.

Similarly, in Delhi and Chandigarh, posters have been glued outside the
homes of suspects mentioning their names, quarantine period and the
number of people in the family who have been asked to remain in isolation.
The posters start with ‘COVID-19: Do not visit. Home under quarantine’,
and it is undersigned by the magistrate of the respective districts under
which the suspects belong. Going a step ahead, the Mohali district
administration has even published suspect details on its website, including
the names of the suspect and his or her family members, along with their
phone numbers and residential addresses. Recently, a list of suspects from
Pune was also doing the rounds on social media.

We are stamping patients with indelible ink and are not freeing them from
quarantine for 14 days even if they come out as negative initially so the
stamp is also a kind of public declaration of them being suspects of COVID-
19. 

Health data is precious and should be protected

Recently, information on Covid patients and those placed in quarantine has

found its way to the public domain. Karnataka published a list of people
quarantined. So did the district administration in Mohali. Such
disclosures may seem right from a common man’s point of view, but they
have a devastating impact on individual liberty and hence are against the
fundamental right to privacy.

Such disclosures invite danger, too. Last month, several doctors and nurses
treating coronavirus patients were forcibly evicted by their landlords who
feared the healthcare workers would make them susceptible to Covid.
Stigma and harassment await those who are undergoing quarantine if their
sensitive private information goes public.

Shockingly, the Mohali list included names and addresses of more than 300
people suspected of carrying the coronavirus. The quarantine list was based
on the self-declaration form international passengers entering India were
made to fill. Few would have thought the information would reach the
public domain.

Public health surveillance programmes, however well-intentioned, have to

respect principles of liberty, equality and privacy. The Constitution has
recognised privacy as a fundamental right in India, as explained in the
Supreme Court’s Puttaswamy judgment. Unlike in, say, the UK where
privacy is viewed as competing with other rights, India projects it as a
substantive right subject to very few exceptions.

The Puttaswamy judgment lays down a three-part test to examine whether

an action of State alleged of breaching a citizen’s privacy is valid. First, it
has to be an action sanctioned by law. Second, it has to be an action which
is necessary for a legitimate aim. Third, it has to be an action which is
proportionate for the achievement of that aim. A bare perusal of the
Epidemic Diseases Act, 1897 and the National Disaster Management
Act, 2005 shows that no provision in these Acts allows or legitimises
publishing personal data of the persons on a public database. As such, the
action of the executive to upload private information of people undergoing
quarantine in the public domain is prima facie violates the fundamental
right to privacy.

With no specific data protection law in place in India (a draft regulation is

around), collection and release of private information of a person in the
public domain without their consent is a source of concern because these
information records hold significant commercial value for healthcare and
pharmaceutical companies, health insurance providers, among others.
 CITIZEN SURVEILLANCE AND COVID 19

Dire times call for ingenious, and often, radical measures. The COVID-19
pandemic, which has led to actions being taken under the Epidemic
Diseases Act, 1897, and the Disaster Management Act, 2005, in India, is
one such unprecedented and grim event. While governments and health
workers all over the world are grappling to curb the spread of the virus, it
has been realised that surveillance of affected persons is of paramount
importance in order to assess and implement preventive and control
measures.

India realized, early on, that contact tracing, communication, and data
analytics would need to form the backbone of the country’s efforts to check
the spread of the COVID-19 pandemic. To carry out this exercise, the
Central and State governments have had to collect reams of personal data
from individuals across the country. The collection, processing, and
dissemination of personal and aggregated data has played a pivotal role in
the government’s proactive response to the deadly virus. Healthcare workers
and municipal authorities have been directed to elicit the maximum data on
every confirmed case in order to recreate the patient’s life for the days
leading up to infection. Through this process, authorities identify potential
sources of infection and vulnerable individuals who may need to be treated
or quarantined.

The government introduced the controversial ‘Aarogya Setu’ mobile

application to enable contact tracing, improve situational awareness, and
publish relevant information to the public. The download and use of the
App was made mandatory for all public and private sector employees by the
Ministry of Home Affairs, in its notification on April 29, 2020. And the App
has, to date, been downloaded by nearly 10 crore users.

 Contact Tracing in India

Along with mobile applications such as Aarogya Setu and other applications

introduced by State Governments, India has been using mapping techniques
from contact tracing to creating buffer zones for Covid-19 clusters and hot
spots, along with location tracking techniques to track infected patients. The
various mobile applications and Bluetooth trackers also look at techniques
of mapping the spread of the disease through geographic information system
(“GIS”), which assist policymakers and authorities during outbreaks. The
Indian Government has also tested an application that uses telecom data to
send emails and text-message alerts to the authorities if a person has evaded
quarantine.

Legal framework in the ambit of Epidemic Diseases Act,

1897 and Disaster Management Act, 2005

Reports suggest that the State power has been exercised for arresting persons
spreading fake news on the disease, arresting persons gathering in large
numbers despite directives of the government, arresting persons not
following home quarantine and sharing publicly the list of suspected patients.

Using excessive power without transparency has historically shown a

negative impact on the community participation. Being forced into
unhygienic quarantine and issues in accessing essential services is deepening
the distrust between people and the State. Two persons have already
reportedly died due to suicide fearing the disease and many suspected
patients have absconded public hospital facilities.

The current regulations on COVID-19 allow states to practice the coercive

actions comparable to those undertaken by the colonial government. These
actions have already put restriction on movement, free speech, religion,
profession and privacy. The restrictions are legal in as much as they are
necessary and proportionate to a legitimate aim.

Given the nature of the pandemic which requires extensive state

surveillance and usage of force, these must be balanced by corresponding
checks on the use of State power to protect the rights of individuals.

 EXCESSIVE ADMINISTRATIVE POWER AND

PRIVACY RIGHTS
 Excessive powers in data sharing

The justification given by the executive for such public disclosure is that
harmonised data-sharing has become an essential tool in the ongoing fight
against coronavirus.

This is a knee-jerk reaction. The executive must not forget that priority for
the nation at the moment is to contain the spread of this pandemic and not
deter people from cooperating. If reporting symptoms would cause personal
data to be published online, it will certainly hesitate people from coming
forward especially in today’s time when we desperately need them to
cooperate the most.

For the sake of constitutional order and for safeguarding the privacy of
persons during this process, the executive must refrain from uploading
personal information of persons in the public domain. As the executive
explores data-driven solutions and public disclosure of information as
methods to contain this pandemic, we as a nation must consider how our
data will be held in the aftermath of this pandemic.

Can the Indian legal framework deal with the COVID-19

pandemic? A review of the Epidemic Diseases Act
The present article examines the legal landscape of the response to the
COVID-19 threat with a specific focus on the Epidemic Diseases Act, 1897.

Recently, there have been calls to update this colonial law as it does not

provide guidelines to the states to act to prevent and mitigate epidemics. On
the other hand, experts with experience of working within the government
seem to believe that the law is appropriate and does not require any changes.

The role of the Act within the legal framework of

COVID-19
The Union government is using various measures to prepare and respond to
the COVID-19 pandemic. These are:

● In January, it invoked its powers under the Disaster Management

Act, 2005 to enhance the preparedness and containment of COVID-19 at
hospitals. Notifying the pandemic as a disaster enabled the states to use
funds from the State Disaster Response Fund on COVID-19.
 ● In March, the Ministry of Health advised states to invoke the provisions
of Section 2 of the Epidemic Diseases Act, 1897.

● As a signatory to the International Health Regulations, 2005 (IHR), India

needs to establish an appropriate public health response to international
spread of diseases. This is done through the Integrated Disease
Surveillance Program (IDSP).

The Epidemic Diseases Act, 1897 was designed to put government machinery
into action once there is a considerable threat of a dangerous epidemic disease
and not as a code for establishing general public health systems.

The provisions of the law seem to be innocuous. It consists of four sections

which provide wide powers to the government. The state governments are
empowered to regulate dangerous epidemic disease, a term not defined in the
law. The government is empowered to regulate ships or vessels leaving or
arriving in India. Disobedience to the regulations is made a punishable offence
while providing for immunity to public officers for performing functions under
the law.

The power of states during a pandemic

Most Indian states including Delhi, Haryana, Karnataka, Maharashtra and Uttar
Pradesh have invoked their powers under the law. This enables them to
undertake Non-Pharmaceutical Interventions (NPIs) to mitigate the
epidemic spread in absence of medicines to treat the disease. These NPIs so far
include closing of educational institutions, malls, schools, gyms, advisories on
social distancing as well as regulations regarding home isolation and
quarantine.

However, some of the regulatory provisions provide extensive powers to

government officers. For instance, state regulations such as the Bihar
Epidemic Diseases COVID-19 Regulations 2020, Uttar Pradesh Epidemic
Diseases COVID-19 Regulations 2020, Delhi Epidemic Diseases COVID-19
Regulations, 2020 authorise officers of the government to admit and isolate
a person in certain situations.
This can be done forcefully. The officers are also given powers of surveillance
of individuals and private premises. Lockdowns can be issued by the District
Magistrate. Further, free speech is restrained by not allowing anyone to publish
information regarding COVID-19 without prior permission of the government
to prevent the spread of fake news.

While all these powers are to be performed in the noble function of protection
of the public, the results of excessive action can be disastrous.

Regulations vis-a-vis Right to Privacy

The regulations on COVID-19 impact many aspects of fundamental rights of
individuals. Herein, I examine the law with respect to the right of privacy.

The right to privacy, which includes personal autonomy, liberty and dignity, is
a fundamental right. However, the right is subject to reasonable restrictions
such as in furtherance of public interest.

In the Puttaswamy judgment, the court laid down the following tests for
limiting the discretion of the State while impinging on the fundamental right to
privacy:

I. The action must be sanctioned by law

II. The proposed action must be necessary for a legitimate aim

III. The extent of such interference must be proportionate to the need for such
interference

IV. There must be procedural guarantees against abuse of such interference

The test of legitimate aim is satisfied by the Epidemic Diseases Act, 1897 as
its function is to prevent the spread of a dangerous epidemic disease. It is
impossible to define specific proportionate regulations for a novel infectious
disease in a parent law. Therefore, the law provides for delegated legislative
power to the states.

However, the parent law does not provide for procedural guarantees against
abuse of State power of interference with privacy of individuals. For instance,
the law does not define or provide guidelines on the meaning of a dangerous
epidemic disease.
Due to this, the citizens are at risk of both inaction and excessive coercion by
the State. In the past, citizens have been forced to petition to courts for directing
the State to take action, or to defend themselves against excessive action of the
State.

The State can misuse the law for profiling, mass quarantine and targeting of
individuals. Even then, there is legal immunity given to public servants who
function under it. Therefore, the law focuses on public interest while dispensing
with any procedural guarantees against abuse of its powers. Therefore, the
Epidemic Diseases Act does not pass the tests of reasonable restrictions on
the fundamental right of privacy of individuals.

The need for a legal framework for epidemic

preparedness & response

The Epidemics Diseases Act does not balance the rights of individuals with the
power of the State. The government can, however, still utilise learnings from its
own past as well as current practices to make effective regulations. The current
COVID-19 regulations need to be modified to remove immunity against illegal
actions done by State representatives.

A legal framework for infectious diseases in the interest of public health

security is essential to increase transparency and accountability of the State
towards the public. An Indian example of a legal framework with such
procedural checks and balances is the Disaster Management Act, 2005. This
law sets up national, state and district level authorities. It then defines the role
of union and state governments under various ministries. The law also has
provisions for capacity building by setting up institutes, financing mechanism
and human response workforce.

Instead of providing blanket immunity to government officials/departments, the

law requires them to act lawfully. Legal immunity is only provided in specific
cases like good faith action and for communication of warnings.

Further checks on the government action are put by prohibiting discrimination

while providing relief, allowing for payment of compensation to affected
parties for requisition of premises or resources, and publication of annual
reports by the authorities set up under law.
While some immediate fixes in regulatory practices can help the Indian
response to COVID-19, structural changes are required in order to balance
health security with civil liberties.

India has an excessively fragmented landscape for health policy. The Epidemic

Diseases Act is one element of multiple interventions in public health in India.
The limited purpose of the law is to allow states to take extraordinary measures
at the time of a dangerous epidemic disease. It does not establish any
coordination mechanism between states and the union government at the time
of a dangerous epidemic outbreak. The role of the union government is also
negligible (such as port quarantine) under this law.

However, Article 253 of the Constitution allows the union government to

enact a law to give effect to the International Health Regulations - which
asks for setting up mechanisms to prevent, protect against, control and
provide a public health response to international spread of disease.

Any such law when designed for India, needs to pass the tests of
reasonableness as set out by the Supreme Court.

Conclusion:
The dichotomy between public health preservation and protection of the
citizens’ fundamental right to privacy, albeit viewed simplistically at
present, is a serious concern and cannot be ignored. Tracking and
surveillance in the present situation does serve a compelling state interest,
however, for the purposes of constitutional sanctity, it is imperative to
enforce safeguards as well.

Public health interest may be a legitimate reason to increase monitoring of

individuals, but monitoring by government authorities must be approached
with utmost caution. If caution is not exercised in times of urgency, we may
be successful in containing the spread of the virus, but may irreparably
damage the constitutional fabric.

In order to mandate using such procedural best-practices in the future, a

comprehensive legal framework for epidemic preparedness and response is
required instead of the current fragmented response framework through
programmes and missions.
This is required to increase the accountability of the government to its
people. It is imperative that such a law is passed by the union government
while providing states power to utilise their public health framework.