No ulterior motive: Kerala High Court clears State in Sprinklr data sharing controversy

The Kerala High Court on Wednesday concluded that there was no malafide intention on the part of the State government in engaging New York-based software company Sprinklr to manage the COVID-19 data of persons who were under quarantine in the State in 2020 [Balu Gopalakrishnan v. State of Kerala & Ors.].

A Division Bench of Chief Justice Soumen Sen and Justice Syam Kumar VM said that there does not appear to have been any violation of the right to privacy, as Sprinklr was merely used as a tool to collect critical patient data in a short window during the pandemic

"We do not find that there is any ulterior motive involved or malafide on the part of the State to collect data and share it with Sprinklr. Moreover, it appears that Sprinklr had only provided the tools and the data was stored by the State," the Court said.

The Court added that it could not ignore the unprecedented circumstances under which the agreement was entered into. It also noted that no data breach had been reported and that the agreement with Sprinklr had been terminated after a short period.

It, therefore, disposed of a petition filed in 2020 that had challenged the government's decision to engage Sprinklr.

The petition in question cited data privacy concerns in sharing sensitive medical data with a private entity.

In 2020, the petitioner argued that information was being sent to Sprinklr without getting the consent of the donor or the person giving information. It was also argued that the issue would not have arisen if the data had been stored on a Government server and thereafter shared with Sprinklr for its management. 

The State, on the other hand, informed the Court that the data was stored in Amazon servers, which had been approved by the Indian Government for such uses. The State also submitted that Sprinklr was used to analyse the data, and that the private entity is barred from using the data for any other purpose.

On April 24, 2020, the Kerala High Court passed an interim order with a slew of directions to ensure Sprinklr would not misuse the data entrusted to it.

The Court also made it clear that the Kerala government must inform and get consent from persons from whom the COVID-19 data is collected before sharing it with Sprinklr or any third party for data analysis.

In May 2020, the State government filed its counter-affidavit confirming that all such data collected was exclusively accessible only by the State government. 

The affidavit added that even though Sprinklr's proposal had included free hosting services, the State government has decided to keep the data in its own account, despite the additional cost involved.

After hearing the petitioner's counsel and the State's counsel, Kerala Advocate General K Gopalakrishna Kurup K, the Court today opined that the State was in a situation where it had to take the fastest route to ensure the well-being of as many citizens as possible during the pandemic.

"One cannot lose sight of the fact that the country was not prepared for an epidemic of the size which the world had not witnessed for centuries. It was sudden and had shattered the entire economy and the health of millions. A stitch in time saves nine is what the State appears to have followed by selecing an entity whose proprietor had its root in the State and had offered to render the service pro bono", the Court observed.

It also noted that the nature of the information shared with Sprinklr in the short time before it was injuncted by the Division Bench in April 2020 was only of the kind that would be essential to keep citizens safe.

It, therefore, closed the petition without passing any new directions.

However, it made absolute the interim order passed in April 2020.