The Kerala High Court today has sought an explanation from Kerala Government on foreign jurisdiction clause in IT contract with US Company- Sprinklr and also in respect of omission to seek sanction from Law Department before finalising data processing deal relating to Covid-19 patients.
A Bench of Js. Devan Ramachandran and Js. T R Ravi directed Government to file statement by tomorrow and listed the matter for 24th April for further consideration.
Js. Ramchandran observed, “We are proud that Kerala has done well in controlling Covid-19. But we also have concerns over data confidentiality. A citizen is not privy to contract between Kerala Government and company. If that company misuses data, State Government is responsible. If there is a breach tomorrow, State Government will have to go to New York. We do not know why State of Kerala chose New York as the jurisdiction.”
Js. Ravi said, ”We need explanation on why contract was not referred to law department?”
Js. Devan said, ”We don’t want Covid-19 pandemic to be substituted with data pandemic.”
Js. Devan also remarked that submission by AAG KK Ravindranath that data collected didn’t constitute sensitive personal information was a dangerous submission. He also sought to know why cloud service platforms which are required to handle huge voluminous data are still being used after number of Covid cases in Kerala have come down.
AAG submitted that 80 lakh persons were still being monitored. AAG also added that data was stored in cloud server of C-DIT, Amazon Web services approved by GOI for storing official data.
Sprinklr deal has safeguards for data protection in accordance with standard practices of ‘Software as a Service’ ie. Saas Models.
Central Government, as Respondent submitted that its policy is to use the Government machinery to collect, store and process data .
Petition by Balu Gopalakrishnan alleged foul play in decision of Pinarayi Vijayan government to choose foreign based private company for storing and analyzing Covid-19 data and questioned overlooking state entities like C-DIT and NIC.
Advocate Jaykar KS said, citizens data was collected without consent and stored in foreign servers.
As per Petitioner, Supreme Court in Puttuswamy’s case declared Right to privacy as a fundamental right and Government introduced Personal Data Protection Bill, 2019 which IT secretary should be aware of while justifying his actions in press conferences. Data is a marketable property and Respondents are duty bound to sell it to highest bidder. The Petitioner also stated that decision to enter into contract with foreign company could not take place without concurrence of Central Government.
Directions were sought for State Government to sever agreement with Sprinklr Corporation and to appoint Government IT company to store and analyse Covid-19 information. Directions to stop uploading Covid-19 information in web servers of Sprinklr have also been sought as interim relief by the Petitioner.
M Sivasankar, IT Secretary in media interviews said that agreement was entered in backdrop of public exigency due to Covid-19.
-India Legal Bureau