The Government of Karnataka (hereafter “State Government”) in its bid to fight the COVID-19 pandemic was the quick to invoke the enabling provision of National Epidemic Act which gives powers to the State to frame regulations aiding the fight to curb the spread of the infectious disease amongst the population. The Government has extended its support to fight the dreaded disease by providing protection against eviction to tenants belonging to the health sector, encouraging telemedicine consultation.
In a double to prevent the spread of COVID-19 pandemic, the State Government decided to publish database containing a list of all persons (14,910 residents of Bangalore Urban/Rural District alone) in each of the districts who have either contracted the virus or who have been currently placed under quarantine. This database included details of these persons’ residential addresses and their travel history, among other things.
On a bare flick through the database it appears that the Government has published “personal data”, as defined in B.N Srikrishna Committee, and in doing it appears that the Government had transgressed the fiduciary obligation that existed between data principal (“individual”) and data fiduciary (“State Government”) while handling personal data of the individuals. It is pertinent to note that publishing of personal data of individuals who have contracted the disease or individuals with mere travel history contemplates for harassment of such individuals when their personal data can be used by the public to trace their exact place of residence violating privacy of the individuals. Probably had the State Government decided to publish the names it would have been the last nail in the coffin, inviolably breaching privacy.
Want of Data Protection legislation would mean, breach of privacy would have to be interpreted on the touchstones of K.S Puttuswamy v, Union of India (hereafter “K.S Putuswamy Judgment”). The judgment contemplates for negative right against State interference, as well as the positive right to be protected by the State. It is pertinent to bear in mind while interpreting the judgment that privacy as right under the Constitution is “not an elitist construct” and even then the State has no eminent domain over the privacy of an individual. The Supreme Court in the aforesaid judgment was tantamount on the obligation of state and non-state entities acting as data fiduciary in protecting the personal data of the individuals which would go a long way in protecting the privacy of such individuals.
It might be enticing to lean in favour of public health over privacy as held by the Division Bench of Supreme Court while considering conflicting interest of an individual infected with HIV and the public health at large. It is pertinent that we do not jump into the above conclusion without considering principle of proportionality as enumerated in the K.S Puttuswamy v. Union of India (II) (hereafter “Aadhar Judgment”). Justice Sikri in the recent Aadhar Judgment laid down a four-fold test to determine proportionality:
(a) A measure restricting a right must have a legitimate goal (legitimate goal stage).
(b) It must be a suitable means of furthering this goal (suitability or rationale connection stage).
(c) There must not be any less restrictive but equally effective alternative (necessity stage).
(d) The measure must not have a disproportionate impact on the right holder (balancing stage).
The action of the State Government not only has to pass the test of being just, fair and reasonable as enumerated in K.S Puttuswamy Judgment but also has to pass the test of proportionality as laid down subsequently in the Aadhar Judgment. Legislation, be it plenary or subordinate, can be challenged on the grounds of arbitrariness i.e being disproportionate, excessive or unreasonable as upheld by the Supreme Court overturning its decision in McDowells case. Though the measure of the State Government has legitimate goal in preventing spread of the pandemic disease, the executive action seems to be disproportionate and non-necessity.
Firstly, there seems to be a lacuna in law for the State Government in collecting the personal data of the individuals. Secondly, lack of knowledge and consent of individuals serves as a predicament for the executive succeeding judicial review. Thirdly, the decision to share the personal data beyond the realms of public servants concerned would on the face of it seem disproportionate. Fourthly, role will come to be performed by private insurance companies whose business model depends on excluding those at risk of sickness which would exclude the vulnerable constituencies of population from coverage or as a matter of fact charge high premium. Considering the alternatives before the State Government to tackle the situation, publishing personal data does not seem to fall under the ambit being just, fair and reasonable as held by the Apex Court on several instances.
There is usually a strong presumption in favour of the constitutionality of an enactment and the presumption being in favour of the constitutionality of legislation, the burden lies upon the person who attacks the statute to show that there has been a clear transgression of the constitutional principles. It would not be a surprise if a public spirited individual approaches the Court seeking adjudication on such lacuna in law in the regulations in the coming day. The decision to exclude the name of the individuals from the data base presents the State Government with a better case without having to stare at the barrel arguing and defending such an action on its part. Perplexity of the current scenario leaves the Court with testing questions to adjudicate on privacy vis-à-vis public health.