Contact tracing data of citizens that were collected through the Aarogya Setu app has been deleted and the feature disabled, Minister of State for Electronics and IT Rajeev Chandrasekhar has told Parliament. The app was launched as a contact tracing platform by the Centre during the first wave of the Covid-19 pandemic in 2020. It has faced at least two lawsuits over the government’s insistence that it be mandatory for visiting key institutions like airports. Since the easing of the pandemic restrictions, it has morphed into a larger health app of sorts, through its integration with the Ayushman Bharat Digital Mission. How was data on Aarogya Setu used? On Wednesday (February 8), Congress MP Amar Singh sought details of the current legislation or protocol governing the data collected by Aarogya Setu, and a list of the government or private agencies, organisations, institutes and individuals with access to that data. In response, Chandrasekhar said, “The National Executive Committee constituted under the Disaster Management Act, 2005,. issued an order dated 29.3.2020 constituting, among others, an empowered group on technology and data management to identify problem areas and provide effective solutions… and take all necessary steps for effective and time-bound implementation of these plans… in relation to Covid-19 pandemic. As per a decision of the empowered group, its chairperson issued an order dated 11.5.2020, notifying the Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020, to ensure secure collection of data by the Aarogya Setu mobile application, protection of personal data of individuals and the efficient use and sharing of personal or non-personal data for mitigation and redressal of the Covid-19 pandemic.” The minister also said that “approved officials of the Ministry of Health and Family Welfare, State Health Departments, the National and State Disaster Management Authorities and District Civil Surgeons were given secure access to the data collected through Aarogya Setu.” He then informed that in accordance with the Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020, the contact tracing feature of the Aarogya Setu mobile application has been discontinued and contact tracing data collected through it has been deleted. While it served as a contact tracing app, it collected personal details like a person’s name, phone number and gender, along with having access to their live location and Bluetooth. What were the concerns with Aarogya Setu? There were primarily two concerns: the app’s mandatory nature, and privacy issues emanating from its data collection and sharing. Aarogya Setu was initially mandatory for rail and air travel, among other things, and the concerns raised around this were that people availing rail services for instance, may not own a smartphone, which was necessary to use the app. In fact, not just government bodies, but a number of private entities like Zomato and Swiggy made it mandatory for their delivery workers to install the app, and showed that status to customers placing food orders on their platforms. People also raised privacy concerns given the nature of data the app needed to function. While the government claimed the data was encrypted and anonymised, it was unclear what anonymisation protocols were being used. The app also offered a static anonymisation ID, which privacy experts claimed was a weaker model compared to dynamic anonymisation IDs that were being offered on contact tracing tools launched by Apple and Google. To that end, a petition was filed in the Karnataka High Court in 2020 against the mandatory nature of the app and its data collection practices. The court refused to stay the use of the app, but held that the Centre cannot deny any services to a citizen on the ground that the user does not have Aarogya Setu. The court also said the data collected via the Aarogya Setu application cannot be shared with other parties beyond what is specified in the privacy policy presented to users. So, what’s next for Aarogya Setu? When it launched, privacy activists had speculated that there was a significant scope of 'function creep' in Aarogya Setu. This meant the app may be used, eventually, for a different purpose than originally intended. Last February, the National Health Authority announced the integration of its flagship Ayushman Bharat Digital Mission with the Aarogya Setu app, allowing users to create 14-digit unique Ayushman Bharat Health Account numbers from the app. The app will also have additional functionalities like sharing health status through a QR code, Open API, health advisories, and testing lab details, National Informatics Centre Director Seema Khanna had earlier said.
