Aarogya Setu App: All you need to know about the data access and knowledge sharing protocol
On May 11, 2020, Ministry of Electronics and Information Technology (MeitY), Government of India, has issued a notification on the Aarogya Setu Data Access and Knowledge Sharing Protocol in the light of the COVID-19 pandemic.
The Government stated that the Aarogya Setu app is a useful technological solution which is developed for the contact tracing of the COVID-19 hit people. It also informs the users of the app about the risk of the infection and allows them to take self-assessment tests.
The notification further states that the data collected by the Aarogya Setu app is secure and for the protection of data of the users and the efficient use and sharing of personal/non-personal data is done to combat with the COVID-19 pandemic.
What is response data?
As per the notification, individuals refer to those who are infected, at high risk of getting infected or who crossed paths with the infected individuals. Data refers to demographic data (name, mobile number, age, gender, profession and travel history), contact data (if an individual has crossed paths with an infected individual and the geographical location where the contact occurred), self-assessment data (responses provided by the users of the Aarogya Setu app) and location data (geographical location in longitude and latitude of an individual). All these data are collectively called response data.
The notification further states that the National Informatics Centre (NIC) is the developer of the Aarogya Setu App and is responsible for the management of the response data.
Principles for collection and processing of response data:
2- The data collected will strictly be used to implement appropriate health responses and will also help in the improvement of such responses.
3- The developer of the Aarogya Setu app, i.e., NIC, will process the data collected by it in a fair, transparency and non-discriminatory manner.
4- Contact and location data will by default remain on the device of the user and may be uploaded to the server if it is helpful in formulating or implementing appropriate responses to combat with COVID-19 pandemic.
5- The contact, location and self-assessment data of an individual will not be retained beyond 180 days from which it is collected. As per the notification, the data retained will be deleted after 180 days from the date on which it was collected.
6- The demographic data of an individual collected by the NIC will remain till 180 days, or if the individual requests for its deletion, then 30 days from such request, whichever is earlier.
Principles for sharing of response data:
1- The response data of an individual can be shared with the Ministry of Health and Family Welfare, Health Departments of State Governments/ UTs/ local governments and other Ministries and Departments of the GOI. The sharing of the data will only be done to combat with the novel virus.
2- The de-identified data may be shared with the Ministries and Departments of the GOI. The de-identified data means that an individual's identity will be stripped off and the data will be shared through a randomly assigned ID.
Principles for sharing of response data for research purposes:
1- The data shared to the researchers will be hard anonymised. This means that by no means the individual will be identified through the data.
2- The data undergone hard anonymisation will be made available to Indian universities and research institutions/ entities registered in India.
3- In no case, the universities or institutions shall reverse data to identify individuals in any manner. If a person is found doing so, all the rights granted to him to use hard anonymised data will be terminated and the person will liable for penalties. Any violations will lead to penalties under section 51-60 of the Disaster Management Act, 2005, along with other legal provisions.
Thus, it must be noted that the data collected by the Aarogya Setu app is for the betterment of the individuals and it also helps the government in formulating or implementing health responses.