Kerala HC injuncts Sprinklr from misusing COVID-19 data, Kerala Govt ordered to take informed consent from citizens before data collection

The Kerala High Court on Friday issued a slew of directions to ensure that New York-based data analysis company, Sprinklr, does not misuse the sensitive COVID-19 data entrusted to it by the Kerala Government as part of its COVID-19 data management efforts. .Pertinently, the Bench of Justices Devan Ramachandran and TR Ravi also made it clear that the Kerala Government must inform persons from whom the COVID-19 data is collected that the information collected would be shared with Sprinklr or a third party for data analysis. Further, such a person should also given consent for such data collection after being thus informed. .The highlights of the order passed today by the Kerala High Court this evening include the following:Kerala Government should anonymise all data collected from citizens with respect to COVID-19 before allowing Sprinklr access to the same. This must be done with respect to all data collected in future. Sprinklr should be given access only after the data is so anonymised.Sprinklr has been injuncted from committing any act which will be directly or indirectly in breach of the data confidentiality entrusted to them under the contract with the Kerala Government. They shall not disclose/part with the entrusted data to any third party entity anywhere in the world.Sprinklr should not to deal with data entrusted in conflict with the various confidentiality clauses/caveats. They will forthwith entrust back all such data to the Government of Kerala as soon as the contract is completed.As per the Kerala Government's submissions, the Court was informed that no data is presently remaining with Sprinklr. In view of the same, the Kerala High Court ordered that any secondary data lying with Sprinklr is to be entrusted back to the Government of Kerala and that this shall be treated as a peremptory direction.Sprinklr has been injuncted from advertising or representing to any third party that they have access to any data relating to COVID 19 patients or persons vulnerable/susceptible to the disease.Sprinklr has been ordered not to use or exploit any such data for any commercial benefit. Sprinklr shall deal with such information maintaining full confidentiality of the Kerala citizens whose data is collected.Sprinklr is not to use the data collected and not to use the name or official logo of the Government of Kerala.The Kerala Government has been directed to inform every citizen from whom data is taken that such COVID-19 data is likely to be accessed by Sprinklr or a third party. Their specific consent for the same should be obtained in the necessary form before data collection..While issuing these directions today, the Court emphasised that it was doing the same with the singular intent of "ensuring that there is no data epidemic after the COVID-19 epidemic is controlled.".The matter has now been adjourned by a period of three weeks, by which time the respondents in the matter are expected to complete their pleadings. .Read the Order:.While dealing with the matter today, the Bench reiterated time and again that while pursuing the effective containment of COVID-19, data confidentiality rights should not be compromised. ."Life and data confidentiality is more or less equal in our eyes in value."the Bench remarked..The Court explained further that a situation should not arise where the State is able to resolve the COVID-19 crises, only to bring about a data epidemic, where citizens are made to run pillar to post if the confidentiality of their sensitive data is breached. .Whereas the Kerala Goverment, tried to assure the Court that there are restrictions placed on Sprinklr when it comes to the permissible scope of data usage, the Bench added another concern that, "You are now talking about a situation where there is a data breach. They (people whose information is collected) can sue you. Are you not taking a risk for more litigation for a wrong committed by Sprinklr?".With the Central Government taking a stance that it was willing to provide data analysis support using NIC software had the Kerala Government approached them for the same, the Kerala High Court today repeatedly queried why the State Government had opted to go with the Sprinklr contract. .Apart from the fact that Sprinklr was a foreign company, the Court also raised doubts over whether there was a need to engage a third party at all given the number of COVID-19 cases in Kerala. ."With the present numbers, in the present situation, was a third party processor or SAAS provider necessary?", the Bench queried..Apart from these general concerns, the Court also pointed out that the statement filed by the Kerala Government before the High Court did not sufficiently indicate the credentials of Sprinklr to perform the task entrusted to it. .Moreover, the Bench took critical note that, as per the Government's statement, it was Sprinklr that first approached the Kerala Government for entering into the contract, contradicting submissions made today the State had "selected" Sprinklr for the task. ."Is this the way contracts are entered into?" Kerala High Court asked, based on Kerala Government's statement which indicated that Sprinklr had offered their services. "In the next page, you say that it was selected." .Examining the timeline over which the Government was stated to have entered into the Sprinklr deal, the Court was also particularly critical of the decision to enter into the contract without running it by the State's Law Department first. .Pointing out that the Sprinklr contract was one that would fall under Article 299 (1) of the Constitution, the Bench observed that the same could not have been treated so casually. ."You (State of Kerala) had (about) 17 days to negotiate", the Court observed, "Where is the question of emergency? What was the tearing hurry to go ahead with the contract without consulting with the Law Department.".The Additional Advocate General responded that when it comes goods and services with costs less that Rs 15,000, there is no need to go to the law department. The state told the Court that Sprinklr had offered its services pro bono for the first six months. .The High Court, however, was not impressed, pointing out that the submission of the State that there was no need to run the contract through the Legal Department was concerning, more so when the Government's own statement before the High Court was entirely on the legal implications of the contract. .Moreover, the Court also pointed out that there would have to be some payment after the six month period. Therefore, it questioned how the State could term the contract services as a pro-bono. .An allied concern raised was that the Sprinklr deal involved a Standard Form Contract, with the Master Service Agreement recognising New York as the venue for litigation in case any disputes arise. As such, the Court also questioned how the State of Kerala can claim that it had negotiated the contract for its benefit. .Taking note of these, among other, concerns the Court has also recorded that is not happy with the way the State of Kerala has conducted itself in the matter. It added that all these concerns would not have to be argued out before the Court in the coming days. .While dealing with the matter today, the Bench also orally observed that this case should not be treated as adversarial litigation. ."We hope that the state does not treat this as adversarial litigation. The fight against COVID-19 is not over... Today, a child has died. We are all concerned...", the Court orally observed. .While passing its order today, the Court also noted that it does not want to impede the State's battled against COVID-19, now that the State has already entered into the Sprinklr contract. .If the same was quashed altogether, "the COVID-19 fight may be impeded", the Court observed, adding that it will have to strike a balance on the issue so that the data confidentiality rights of persons providing the information are protected. .Therefore, today the Court confined to passing directions to ensure that the data shared with Sprinklr is protected.