The publication of COVID-19 quarantine lists violates the right to privacy
On 19 March, the district administration of Mohali, a satellite city of Chandigarh, published a “quarantine list” on their official website. This list had names of people who had been placed under quarantine as suspected carriers of the novel coronavirus. It also included other personal details, such as residential addresses and phone numbers. The authorities claimed that the identities of the quarantined people were revealed due to “social pressure,” and that outing those under quarantine was necessary to contain community transmission. The deputy commissioner further said that this way “people will get information about such persons while sitting at home and they would be vigilant to avoid contact with them and their family members.” In the following days, several other government authorities, including in Chandigarh, Karnataka, Odisha, Delhi, Nagpur, Ajmer, and Mumbai, prepared such “quarantine lists.” The lists were either published on their publicly accessible websites or eventually leaked through unidentified channels.
The data that was eventually used to curate these quarantine lists was first collected by the government of India, under the aegis of the union ministry of health and family welfare. On 3 March, the MOHFW mandated that all international passengers entering India would have to fill self-declaration forms, submit the forms to health officials and immigration officials, and undergo health screenings at the points of entry. In essence, this form operated as a prerequisite for entry into India and sought personal information, including name, residential address, phone number, port of departure and final destination.
Shockingly, it was this data obtained from incoming passengers that was used to curate the quarantine lists. All these lists included personal details in varying measures, ranging from names, phone numbers, residential addresses and port of journey, and were freely floating around on Whatsapp or Telegram groups, within a few hours. If you were on one of these lists, by that evening, everybody had your personal information, and your neighbours viewed you with suspicion. Needless to say, these quarantine lists ended up operating as target lists—they have led to people facing severe harassment, ostracisation, stigma and anonymous hate-calls.
Till 6 March, incoming passengers were required to fill the form and were advised to isolate themselves if they experienced symptoms within 28 days after return from COVID-19 affected areas. Four days later, passengers from China, Hong Kong, Republic of Korea, Japan, Italy, Thailand, Singapore, Iran, Malaysia, France, Spain and Germany were advised to undergo self-imposed quarantine for a period of 14 days from the date of their arrival. Progressively though, the guidelines were made more stringent. On 11 March, the MOHFW declared that while passengers from these destinations shall be mandatorily quarantined for a minimum period of 14 days, passengers from other destinations could also be quarantined for the same period. Five days later, the categories of passengers who would undergo mandatory quarantine were further expanded. Eventually, on 18 March, the MOHFW published its standard operating procedure which stated that passengers without risk factors would be strictly under “Home Quarantine,” or face penal sanction, while high-risk passengers would be under “Government supervised quarantine” at a paid hotel or a government facility.
Neither the MOHFW guidelines nor the self-declaration form mentioned the purpose for the collection of the personal information. However, one could assume that the aim was to alert people if a co-passenger was subsequently diagnosed with COVID-19, or to check on people who might be experiencing symptoms and were asked to be under home quarantine.
The dissemination of this information in the form of “quarantine lists” has now caused a backlash and people have voiced concerns over the breach of trust and their privacy being compromised. Representatives of different authorities have offered justifications for the dissemination, claiming that this was necessary to contain the spread of COVID-19 in the communities, create social pressure and deter people from violating home-quarantine. For instance, Sanjeev Kumar, the divisional commissioner of Nagpur, justified the move and said that, “We just want people to keep an eye in the neighbourhood and inform us if they see these people socializing.” However, the question remains whether the dissemination of the quarantine lists violates the right to privacy.
Before a violation of privacy can be determined, a preliminary aspect to be addressed is whether the right to privacy is interfered with at all. The answer to this depends on a test enunciated by the Supreme Court in two landmark judgments. On 24 August 2017, a nine-judge bench of the apex court ruled that the right to privacy is a fundamental right guaranteed by the Indian Constitution in KS Puttaswamy vs Union of India. Puttaswamy, a retired judge of the Karnataka High Court, had challenged the government over Aadhaar cards and this judgment came to be known as Puttaswamy I. On 26 September 2018, a five-judge bench declared that the Aadhaar Act of 2016 did not violate the right to privacy. This judgment is commonly referred to as Puttaswamy II.
Under this test, the right to privacy is compromised only if a “reasonable expectation of privacy” existed and was breached. The doctrine of reasonable expectation has both a subjective and an objective element. The former is met if the individual subjectively expected the information to be kept private. The latter is met if the individual’s expectation was objectively reasonable.
The publication of quarantine lists violated the reasonable expectation of privacy of the concerned individuals for at least three reasons. These reasons relate to the nature of the information collected, the context in which it was collected, and the seriousness of the privacy claim.
First, the information collected, and later published, was personal in nature. Phone numbers, residential addresses and email addresses are identifiers that provide direct access to an individual, thus providing an easy means of intrusion. In Puttaswamy I, the Supreme Court took note of the power of data in today’s age and held that the right to privacy implied full control over one’s personal information. The Data Protection Bill introduced in parliament last year, states that “personal data”—such as phone number, house address and email address—shall not be used for any purpose without the concerned individual’s consent. Justice D Kaul’s observations in Puttaswamy I capture this idea perfectly: “An individual has the right to control one's life while submitting personal data for various facilities and services.” In the case of the quarantine lists, the nature of the information collected raises a “reasonable expectation” in the passengers’ minds that the information would be kept confidential.
Second, the context in which the information was collected also points to a reasonable expectation of privacy. The act of filling forms at airports ordinarily implies private communication between the individual and the state, such as in the case of customs’ declarations. But in this case the passengers were not informed that their information could be made public in future. None of the passengers could reasonably foresee that the data would be published anywhere, in any form, much less that it would be uploaded on the official websites, in a curated form.
Third, the privacy claim at stake here is serious. Publication of sensitive private information is likely to expose the person concerned to stigma, harassment, and even racism. According to several news reports, many individuals have complained of repeated anonymous calls and harassment at the hands of media, landlords, neighbours and residents’ associations, sometimes triggering health problems, after their private data was made public.
These factors clearly establish that a reasonable expectation of privacy existed. Hence, the publication of quarantine lists interfered with the right to privacy. Consequently, it’s imperative to examine if this interference was justified.
Puttaswamy I laid down a three-part test to examine if an “interference” is justified: first, whether the action is sanctioned by law; second, whether the action is aimed at achieving a legitimate aim; and third, whether the action is necessary and proportionate for the achievement of that aim.
The publication of the quarantine lists fails the first prong of the test. Neither the self-declaration form nor the quarantine list disclosed any statutory basis. The entire exercise comprised of four different steps: first, the collection of information from incoming passengers by the central government as a prerequisite for immigration; second, the sharing of information by the central government with the state governments; third, the curation of this information into quarantine lists by the state governments; and fourth, the dissemination of this information by the state governments.
In the present case, neither the Disaster-Management Act, 2005 nor the Epidemic Diseases Act, 1897 vest the central or the state government with any express powers that provide a basis for any of these four steps. As such, the collection, collation and dissemination of this personal information is not sanctioned by law.
Even if one were to argue that the central government relied on the residuary powers under section 6 of the disaster-management act, while the state government sources its powers from section 2(1) of the epidemic diseases act, the respective authorities would still have to demonstrate that these measures were “necessary” for dealing with the disaster and preventing the outbreak of the epidemic or its spread.
Next, it is imperative to examine if the publication of the quarantine lists passes the second prong of the test. Justice DY Chandrachud, who spoke for four of the nine judges in Puttaswamy I, held that the court will not “reappreciate or second guess the value judgment of the legislature” except if the value judgment is “manifestly arbitrary.” The Supreme Court has consistently held manifest arbitrariness to imply something done “capriciously, irrationally and/or without adequate determining principle.” Since Puttaswamy I does not give an exhaustive list of aims that would qualify as “legitimate,” the state’s stated purpose has to be analysed for “manifest arbitrariness” in every single case.
The state governments have put forth three different aims to justify the publication of the quarantine lists, namely, deterrence, social pressure and information and safety.
The argument of deterrence is irrational as it militates against the ultimate aim of preventing the spread of COVID-19. The authorities’ rationale appears to be that people will strictly observe the lockdown to avoid the risk of publication of their personal details online. Publication would occur only if they were home quarantined, which would happen only if they or someone in close contact contracted the disease, to avoid which they must obey the lockdown. But this chain of thought misses the critical link between contracting the disease and being home quarantined, which is that the individual must report the symptoms. If reporting leads to the undesirable outcome of publication of one’s personal details online, would individuals not be deterred from reporting? It is irrational to deter individuals when we desperately need them to come forward and cooperate.
The second aim, social pressure, is even more problematic. The rule of law expects the democratically elected state functionaries to use their own wisdom in making decisions. This expectation is further heightened when the state’s actions impact fundamental rights. Rights are a constitutional commitment, and even though everyone agrees that they are not absolute, the least they demand is sincere care and consideration on the part of the state. Any attempt to restrict these rights must hence be carefully thought out. In this framework, external pressure is the last thing that should guide state action impinging on rights; indeed, acting to please the mob amounts to an abdication of constitutional duty.
The third aim, however, would qualify as legitimate. Chandrachud’s observations in Puttaswamy I indicate that preservation of public health and safety is a legitimate state aim. Even globally, it is recognised as a legitimate ground to restrict privacy rights. For instance, Article 8 of the European Convention on Human Rights states that the right to privacy may be restricted “for the protection of health.” Likewise, Article 29 of the Universal Declaration of Human Rights provides that all rights, including the right to privacy, may be restricted for “meeting the just requirements of... the general welfare in a democratic society,” and also for “securing due recognition and respect for the rights ... of others” which would include the right to health recognised in Articles 22 and 25 of the declaration.
Since a legitimate state purpose exists, the publication of quarantine lists would satisfy the second prong of the three-part test. However, the overall validity of the measure will turn on how that valid purpose was pursued.
The third prong of the Puttaswamy test requires the state action to be necessary and proportionate to the legitimate aim being pursued. This raises a few pertinent questions: Did the dissemination of personal information in the form of quarantine lists have any rational nexus with the legitimate goal of securing public health? Was such dissemination required or merely desirable? Did the state adopt the least restrictive measure possible? Did the state strike a fair balance between the public interest at stake and the individual’s right to informational privacy?
In the present case, preservation of public health by reducing the risk of community transmission is a legitimate goal. But what goal would lists published after the imposition of the lockdown serve, when people were already prevented from leaving their homes?
Some observations by Chandrachud, in Puttaswamy I, become relevant at this juncture. Explaining how “anonymity” can be used to protect “privacy”, he observed:
“Privacy involves hiding information whereas anonymity involves hiding what makes it personal. An unauthorised parting of the medical records of an individual which have been furnished to a hospital will amount to an invasion of privacy. On the other hand, the State may assert a legitimate interest in analysing data borne from hospital records to understand and deal with a public health epidemic such as malaria or dengue to obviate a serious impact on the population. If the State preserves the anonymity of the individual it could legitimately assert a valid State interest in the preservation of public health to design appropriate policy interventions on the basis of the data available to it.”
Admittedly, it is important to draw people’s attention to the potential risk of community transmission in their locality. It is equally essential for people under home quarantine to follow the guidelines and not step out. However, all of this could have been achieved in an anonymised manner, without the disclosure of any personal details. The authorities could have provided data on the number of people infected with COVID-19 or under home quarantine in a locality, and the areas that they might have visited, to ensure that others understand the gravity of the situation and regulate their conduct. They could consider putting stickers in the vicinity of houses of people who are quarantined, without disclosing their names or exposing their personal information on a platter. Depending on the locality, these stickers could also be put around common spaces or outside lanes providing information about the number of people quarantined in the particular lane. Instead of expecting neighbours to report each other, and create hostility, ostracisation and stigma, under the garb of “cooperation from community members,” authorities could explore other less restrictive alternatives. The local administrations could organise inspection visits, surprise checks, calls on landlines and video calls, to ensure compliance.
In fact, some state governments have launched mobile applications that provide graphic representations of the number of people who are quarantined around you, route maps and contact tracing. Although such applications themselves have privacy implications for their reliance on surveillance, and features that allow one to report people who are “violating” the quarantine, the anonymised graphic representations appear to be less restrictive than publication of quarantine lists.
Thus, although there is an onus on the state to find the least restrictive measure to achieve the legitimate goal, it has miserably failed to do so in the case of the quarantine lists which unjustifiably infringe the fundamental right to privacy. While the COVID-19 pandemic has led to an extraordinary situation, it is in times like these that the state’s commitment to protection of rights is put to test most rigorously. While combating COVID-19, the state must go the extra mile to ensure that the right to privacy is not quarantined in the process.