Centre for Internet and Society

Pandemic Technology takes its Toll on Data Privacy

Aman Nair and Pallavi Bedi — 2021-06-26T06:52:52Z

The absence of any legal framework has meant these tools are now being used for purposes beyond managing the pandemic.

The article by Aman Nair and Pallavi Bedi was published in the Deccan Herald on June 13, 2021.

People show Arogya Setu App installed in their phones while travelling by special New Delhi-Bilaspur train from New Delhi Railway Station. Credit: PTI File Photo

Jabalpur: A beneficiary shows his certificate on his mobile phone after receiving COVID-19 vaccine dose, at Gyan Ganga College in Jabalpur, Saturday, May 15, 2021. (PTI Photo)

At a time when technology is spawning smart solutions to combat Covid-19 worldwide, India’s digital response to the pandemic has stoked concerns that surveillance could pose threats to the privacy of the personal data collected. Be it apps or drones, there is widespread criticism that digital tools are being misused to share information without knowledge or consent. At the other end of the spectrum, the great urban-rural digital divide is hampering the already sluggish vaccination drive, exposing vulnerable populations to a fast-mutating virus.

Last year, the Centre, states and municipal corporations launched more than 70 apps relating to Covid-19, demonstrating the country’s digital-driven approach to handling the pandemic. Chief among these was the central government’s contact tracing app Aarogya Setu. Launched under the Digital India programme, the app quickly came under scrutiny over data privacy.

As per its privacy policy, Aarogya Setu collects personal details such as name, age, sex, profession and location. As there is no underlying legislation forming its basis, and in the absence of a personal data protection bill, serious privacy concerns regarding the collection, storage and use of personal data have been raised.

The government has attempted to mitigate these concerns with reassurances that the data will be used solely in tracing the spread of the virus. However, recent reports from the Kulgam district of Jammu and Kashmir point to the sharing of application data with police. This demonstrates how easy it is to use personal data for purposes other than which it was collected, and presents a serious threat to citizen privacy.

Though Aarogya Setu was initially launched as ‘consensual’ and ‘voluntary’, it soon became mandatory for individuals to download the app for various purposes such as air and rail travel (this order was subsequently withdrawn) and for government officials. Initially it was also mandatory for the private sector, but this was later watered down to state that employers should, on a ‘best effort basis', ensure that the app is downloaded by all employees having compatible phones. However, the ‘best effort basis’ soon translated into mandatory imposition for certain individuals, especially those working in the ‘gig economy’.

Several states had also launched apps for various purposes ranging from contact tracing of suspected Covid patients to monitoring the movement of quarantined patients. As a report by the Centre for Internet and Society observed, given the attention on Aarogya Setu, most of the apps launched by the state governments escaped scrutiny and public attention.Most of these apps either did not have a privacy policy or the policy was vague and often did not provide important details such as who was collecting the data, the time period for retaining the data and whether personal data could be shared with other departments, most notably, law enforcement.Apart from contact tracing apps, the pandemic also ushered in a wave of other apps and digital tools by the government. These include systems such as drones to check whether people are following Covid-19 norms and facial recognition cameras to report to the police whether someone has broken quarantine. Similar to Aarogya Setu, these tools have also largely been brought about in the absence of a legal and regulatory framework.
The absence of any legal framework has meant these tools are now being used for purposes beyond managing the pandemic.

The government is now planning to use facial recognition technology along with Aadhaar toauthenticate people before giving them vaccine shots.

Aarogya Setu is now linked with the vaccination process. Beneficiaries have been provided an option to register through Aarogya Setu. The pandemic has also provided a means for the government to bring in changes to health policies and introduce the National Health Data Management Policy for the creation of a Unique Health Identity Number for citizens.

Vaccination and digital platforms

The use of digital technology has extended to the vaccination process through the deployment of the Covid Vaccine Intelligence Network (Co-WIN) platform.During the first phase of inoculation, beneficiaries were required to register on the Co-WIN app while in the subsequent phases, registration was to be done on the Co-WIN website. The beneficiary is required to upload a photo identity proof.

While Aadhaar has been identified as one of the seven documents that can be uploaded for this, the Health Ministry has clarified that Aadhaar is not mandatory for registration either through Co-WIN or through Aarogya Setu. However, as per media reports, certain vaccination centres still seem to insist on Aadhaar identity even though beneficiaries may have used another identity proof to register on the Co-WIN website.

It is also pertinent to note that the website did not have a privacy policy till the Delhi High Court issued directions on June 2, 2021. The privacy policy hyperlinked on the Co-WIN app directed the user to the Health Data Policy of the National Health Data Management Policy, 2020.

The vaccination drive has been used as a means to push the health identity project forward as beneficiaries who have opted to provide Aadhaar identity proof have also been provided with a health identity number on their vaccination certificate. It is interesting to note that Co-WIN’s privacy policy now states that if the beneficiary uses Aadhaar as identity proof, it can 'opt' to get a Unique Health Id.However, as a recent report revealed, health identity numbers have already been generated for certain beneficiaries without obtaining consent from them for the purpose.

Have the apps been successful?

One could argue that privacy concerns are a worthwhile tradeoffin order to contain the spread of thepandemic. But it is worth examining how successful these technologies have been. In reality, the use of digital technology at every stage of combating the pandemic has clearly highlighted the extent of our digital divide. As per data from TRAI, there are around 750 million Internet subscribers in India,which is only a little more than half of India’s estimated 1.3 billion citizens — with this gap having a significant impact on the efficacy of the government’s strategies. Aarogya Setu has fallen far short of its goal, of having near universal adoption. It has limited adoption in much of the country. This has severely limited its efficacy in tracing the spread of the virus. Research from Maulana Azad Medical College has cited socio-economic inequalities,educational barriers and the lack of smartphone penetration as being the key causes behind the app’s limited success, pointing back to the digital divide. Moreover, the app has also brought with it a host of associated problems including lateral surveillance and function creep caused by the addition of new features. All of which, along with the previously mentioned privacy concerns, have served to hamper public trust and adoption.

A similar situation is seen in the case of vaccination and the Centre’s Co-WIN web portal. The need for registration, first on the Co-WIN app and later on the Co-WIN web portal, has disproportionately affected those who either have no or limited digital access. Many of them belong to vulnerable groups such as migrant and informal sector workers (mainly from disadvantaged castes), LGBTQIA + individuals, sex workers and both urban and rural poor. These issues have also been acknowledged by the Supreme Court, which raised serious concerns about the government being able to achieve its stated object of universal vaccination.

As the inoculation exercise opened up for the 18-45 age group, it increasingly favoured the urban population who possessed the technological and digital literacy to either create or access a host of tools. One need to only look at the wave of automated CO-WIN bots that arose as soon as the vaccination process was expanded to see how these dynamics manifested.

Ultimately, the digital-driven approach that the governments have adopted has resulted in a number of issues — most notably, data privacy and exclusion. Going forward, government strategies must actively account for these factors and ensure that citize rights are adequately protected.

For more details visit https://cis-india.org/internet-governance/blog/deccan-herald-aman-nair-and-pallavi-bedi-june-13-2021-pandemic-technology-takes-its-toll-on-data-privacy

India- EU FTA: A Note on the Copyright Issues

nehaa — 2013-07-03T06:47:08Z

In this blog post, Nehaa Chaudhari gives us an overview of some of the provisions of the Free Trade Agreement (FTA) and the copyright issues identified therein.

Click to download the India-EU FTA: A Note on Copyright Issues (PDF, 205 Kb)

Against the backdrop of ongoing negotiations dating back to 2007, and, more recently, with parties being unable to make substantial progress on the Indo-EU FTA[1] this note presents an overview on some of the provisions of the FTA and the copyright issues identified therein. This note deals with the issues on two levels- first to examine the impact of intellectual property right provisions in FTAs in general and second to apply these generic principles to the Indo- EU FTA specifically.

Introduction

Investment agreements, of which bilateral investment treaties are a part, and investment chapters in various FTAs often result in an increase in the effective levels of intellectual property protection in one of the countries that is a part to the agreement. This can be done either explicitly, where ‘investment’ may be defined to include IP, or implicitly, for instance, through an expropriation provision.[2] This has concurrently witnessed the growing realization that the promotion of these increased IP standards is not suited to the need of developing countries. Therefore, it has been observed[3]that there is now an attempt by the developed countries to use FTAs as a forum to push for higher standards of IP protection in developing countries, and to restrict the scope of the flexibilities offered by TRIPS, most notably in the sectors of protection of plant varieties, patents and access to medicine, farmers rights and access to information.[4]This approach is inherently problematic, because it then infringes on the developing countries’ ability to achieve their developmental objectives.

Dismantling the Arguments In Favour of Increased IP Protection

A prevalent view of thought is that in order to increase Foreign Direct Investment (FDI), developing countries would have to increase their IP protection. This section of the paper seeks to argue that this might not necessarily be the case.

An illustration of the aforesaid proposition may be Heald’s criticism[5] levied on Mansfield’s paper[6] arguing that there was a direct correlation between the level of intellectual property protection in a country and the foreign direct investment into that country. Further, a study[7] conducted under the aegis of the United Nations has suggested that there was a ‘considerable incentive’ for countries to use the flexibilities provided under TRIPS to maximise net benefits for their development; stating that while in countries with a capacity to innovate stronger IPR protection can reap some benefits in terms of greater innovation at home and a greater diffusion of technology, the same cannot be said about nations without such a capacity, and may in fact impose additional costs.[8]

Specifically in the area of copyright, it has been observed that increased copyright protection can hamper the growth and development of knowledge based industries. Sanya Smith argues that those who control copyright have a ‘significant advantage’ in the knowledge based economy, and says that in the current scenario where ownership of copyright is largely in the hands of industrialized nations, this places developing nations, and smaller economies at a significant disadvantage.[9] She also goes on to argue that increasing copyright protection alone does not seem to be sufficient to stimulate industries, and there may other factors involved. Additionally, copyright could also significantly increase the cost of creative industries.[10] More fundamentally however, access to information and knowledge are amongst the most affected areas as a result of tightening of copyright laws, leaving students, academicians, researchers, scientists and persons with print disability significantly disadvantaged.

Implications of the Copyright Provisions in the Proposed Indo- EU FTA

Based on the general discussion earlier, this section of the paper seeks to examine the proposed and long debated Indo- EU FTA for the concerns enumerated earlier. As things currently stand, both parties have failed to reach a consensus on various substantial differences, and a ministerial meet originally scheduled for June seems unlikely to take place.[11]

It has been observed[12] that the Indo- EU FTA[13] includes various provisions that preserve the flexibilities offered under the TRIPS framework. This is extremely critical from the perspective of developing countries, given that access to knowledge is an extremely important ideal to be preserved. For instance, as noted by Knowledge Ecology International[14]the proposed FTA includes Articles 7 (Objectives) and 8 (Principles) of the TRIPS[15] by reference. Further, the language of Article 13 under the proposed FTA explicitly recognizes the importance of the Doha Declaration, which is a positive step.[16] It has been said however, that stronger language where the parties ‘affirmed’ their obligations under the Declaration could have been used.[17] However, this does not take away from the fact that many of the provisions of the proposed FTA are extremely problematic, as will be discussed in the forthcoming parts of this paper.

Problematic Provisions

The main concern that has emerged from this FTA is the fact that some of its provisions dealing with IPR go beyond the mandate as under the TRIPS Agreement. For instance, as pointed out by Shamnaad Basheer to Intellectual Property Watch, various provisions now provide for intermediary liability, which isn’t present in TRIPS. He also adds however, that if the initial stand of the government that India would not go TRIPS plus continues to hold, the government should indeed adopt a strong stance and not cave in to the said provisions.[18] An overview of some of the problematic provisions has been presented hereafter:

International Obligations

As per the proposed treaty, protection granted by the parties should be in accordance with the Berne Convention, the Rome Convention and the WIPO Copyright and Performance and Phonograms Treaties. Snehashish Ghosh in his blog post[19] writes that the EU stipulates compliance with Articles 1 through 22 of the Rome Convention for the Protection of Performers, Producers of Phonograms and Broadcasting Organizations (1961), Articles 1 through 14 of the WIPO Copyright Treaty – WCT (Geneva, 1996), Articles 1 through 23 of the WIPO Performance and Phonograms Treaty – WPPT (Geneva, 1996). It is critical to note that the Rome Convention is not in force in India[20], and that India is not a party to either the WCT[21] or the WPPT[22], and therefore, this provision would have the effect of substantially surpassing all obligations that India has at the moment under multilateral international agreements.

Technical Protection Measures (TPMs) and Digital Rights Management (DRM)

A TPM, understood simply, is a lock in a digital format, placed on digital material to prevent access to or copying of the material in question. The problem with such measures is that they can prevent even those forms of copying which are legal (for instance, the copying of a movie on which copyright has expired could be prevented), creating a potentially infinite monopoly over the product in question. India, in its negotiations with the EU, has agreed to sweeping language under this provision, where TPMs and DRM measures are broadly defined. The Agreement further provides for limitations on TPM protections only to persons who have “legal access to the protected work or subject matter”.[23]

Copyright Expansion

There are various provisions under the proposed FTA that have the effect of copyright expansion. To begin with, the duration of protection for photographic works is not expressly mentioned in the proposed agreement.[24] Snehashish Ghosh concludes that the term of photographic works is unclear in the proposed FTA. He writes that the proposed FTA makes it mandatory for the parties to comply with the Berne Convention, and all literary and artistic work under the proposed FTA is to be construed as the same as the Berne Convention[25]. Photographic works are included under literary and artistic works under the Berne Convention, and the rights of an author in case of photographic works are protected for a minimum period of 25 years. However, the proposed FTA extends the period of protection to beyond that prescribed by the Berne Convention and states that protection is given to literary and artistic works (as defined in the Berne Convention) for a period of the duration of the life of the author plus fifty years after this death. It further states that works for which the period of protection is not calculated from the death of the author, and which have not been lawfully made available to the public within at least 50 years from their creation, the protection shall terminate.[26]

Article 7.6 (proposed by the EU), limits the resale rights of a downstream purchaser. It has been noted by Knowledge Ecology International[27] that this seems to give the author of an original work of art a right in perpetuity, to receive a royalty for the resale of the piece of art, where such right cannot be waived or transferred by the author of the work. Therefore, a situation would arise where each time a person who has purchased the work wants to resell the same, he would have to pay royalties to the original author.[28] The observations further go on to note that royalties are not limited, and the amount has to be determined by national legislation. Further complicating the situation is the fact that the provision does not cease to apply after a given number of re-sales, and continues to the death of the author (but might not into the 50 year protection post the death of the author).[29]

Exceptions and limitations for copyright have been covered under Article 7.9(1) of the proposed FTA, and they may be created “only” in accordance with the three step test, which is essentially that (a) the exceptions and limitations must apply in certain special cases; (b) must not be in conflict with the normal course of exploitation of the subject matter in question and (c) must not unreasonably prejudice the legitimate interests of the right holders.[30] It has been observed that this test is more restrictive than TRIPS, Berne Convention, Rome Convention or the WCT.[31]

On the plus side, temporary copies have been excluded from copyright protection, as per Article 7.9(2) of the proposed FTA, which would ensure the proper functioning of technology.

Persons with Disabilities

There is nothing that deals with the import/export or cross border exchange of files/documents/books etc. for persons with disabilities.

Cross Border Measures

Cross Border Measures have been dealt with under Article 30 of the proposed FTA. It is interesting to note that under this Article the EU has proposed the application of border measures to exports as well. This is contrary to the position laid down in the TRIPS Agreement, which has this requirement only for importing infringing goods.[32] Further, the EU also seeks to expand the applicability of such measures to include those goods which also infringe designs or geographical indications. Additionally, Article 30 also leaves out certain TRIPS safeguards, for instance, one that requires the right holder to provide adequate evidence for a prima facie case of infringement.[33]

Intermediary Liability

It has been suggested that the EU, under the garb of protecting intermediate service providers from liability for infringement by users, is purporting to place a greater burden on the providers in question, of policing user activity.[34] For instance under Article 35.1.1 of the proposed FTA, while service providers are not under any general obligation to seek facts or circumstances that could indicate illegal activity, they may be obligated to promptly inform competent authorities of these alleged illegal activities undertaken/information provided by recipients of their service. [35] Otherwise, the providers may also be required to communicate to the authorities, on their request, information that would enable the identification of their service with whom they have storage agreements, as per Article 35.1.2.[36] It has been rightly identified by Glover Wright, that such provisions would only serve to increase tensions between the users and their service providers, with relations dictated by concerns about liability, and barriers in the sending, receiving and storing of information freely. It would be a tricky question for intermediate service providers to check what would constitute ‘knowledge’ and how they were to best safeguard themselves from liability.[37] Therefore, the author is inclined to agree with Wright’s submission that India needs to reject all provisions of liability of intermediate service providers as discussed above.

IP Enforcement

There exist, as regards the enforcement of rights, many problematic provisions in the proposed FTA. For starters, the EU has proposed that interlocutory injunctions may also be issued under the same conditions against an intermediary whose services are being used by a third party to infringe intellectual property rights.[38] This may be found under Article 22.1 of the proposed FTA, and is inherently problematic for being a provision far beyond the mandate as laid down by TRIPS.

The EU is also pushing for the use of very explicit language as regards seizing movable and immovable property of the alleged infringer as a precautionary measure. This also extends to the blocking of the bank accounts and other assets of the said infringer, and to this end, competent authorities may even order the communication of bank, financial or commercial documents, or access to the said information.[39] It is critical to note that such a provision is greatly problematic as being rather vague in its approach, and very readily compromising privacy for ‘alleged’ acts of infringement.

It is further critical to note that while Article 20 states that courts should have the power to grant ex parte order to collect evidence that is allegedly infringing, there are no safeguards provided for protection of a bona fide defendant whose premises might have been raided wrongly. It is submitted that provisions that safeguard the interests of defendants are of prime importance, especially in the Indian set up, where courts are as it is rather generous in their granting of ex parte orders.

Concluding Observations

While India may stand to benefit from the proposed FTA with the EU, there remain significant IP related issues that need to be ironed out before India comes to any consensus about the agreement and ratifies the same. On the basis of the discussion over the course of this paper, it may be seen that the provisions on intellectual property rights are problematic on various levels, particularly in the areas of expansion of copyright, the inclusion of TRIPS plus provisions, cross border measures, TPMs, liability of service providers and enforcement mechanisms.

Discussions in the first half of this paper have demonstrated that increased IP protections do not necessarily translate into increased FDI and may in fact stifle innovation. Further, the warning to developing countries against adopting IPR standards fixed by developed nations has been sounded many times over, and is one that needs to be heeded to very closely for developing nations to achieve their developmental objectives.

India has over a period of time established an IP regime that is consumer friendly. In adopting the proposed FTA in its current form, she risks endangering this regime that has thus far been instrumental in proliferating emerging technologies in the county.[40] Given that India has already acceded to international standards for IPRs as a result of being a member of the WTO and being TRIPS compliant, there is no cogent reason to be made out that warrants the accession to an FTA with TRIPS plus provisions. India ought to continue to push back strongly on these fronts, bearing in mind that its stance could very well set the tone for other such agreements in South Asia. From the way things stand at the moment, it is indeed a matter of some relief that the ratification of this proposed FTA still appears to be at a considerable distance.

[1].Hereafter referred to as the FTA.

[2]. Sanya Reid Smith, Intellectual Property in Free Trade Agreements, for the UNDP Regional Trade Workshop (17-18 December, Penang, Malaysia), available at http://bit.ly/11W8dqy (last accessed 04 June, 2013).

[3]. Id.

[4]. Id at 5.

[5]. Supra note 2, citing PJ Heald, Information Economics and Policy 16 (2004) 57-65

[6]. Edwin Mansfield, Intellectual Property Protection, Foreign Direct Investment and Technology Transfer, International Finance Corporation: Discussion Paper No. 19, available at http://bit.ly/18V4D5v (last accessed 05 June, 2013)

[7]. See generally- Rod Falvey et. al., The Role of Intellectual Property Rights in Technology Transfer and Economic Growth: Theory and Evidence, United Nations Industrial Development Organization: Discussion Paper (2006), available at http://bit.ly/11JBR4o (last accessed 05 June, 2013).

[8]. Id.

[9]. Supra note 2 at 23.

[10]. Supra note 2 at 23.

[11]. PTI, India – EU FTA Talks Fail to Bridge Gaps, available at http://bit.ly/19LJaeP (last accessed 05 June, 2013).

[12]. Krista Cox, Quick Reaction to the EU/India (BTIA) Negotiating Text, available at http://keionline.org/node/1693 (last accessed 04 June, 2013).

[13]. Hereafter referred to as the FTA

[14]. KEI Staff, More Notes on the India EU FTA (BTIA), available at http://keionline.org/node/1692 (last accessed 05 June, 2013).

[15]. See http://bit.ly/13XhCfZ for more details, and for the bare text of the Articles. (last accessed 05 June, 2013).

[16]. Supra note 14.

[17]. Supra note 12.

[18]. Patralekha Chatterjee, Leaked IP Chapter of India- EU FTA Shows TRIPS-PLUS Pitfalls for India, Expert Says, available at http://bit.ly/Y7w70e (last accessed 05 June, 2013).

[19]. Snehashish Ghosh, Analysis of Copyright Expansion in the India-EU FTA (July 2010), available at http://bit.ly/ysitEC (last accessed 03 June, 2013).

[20]. For the status of Contracting Parties, see http://bit.ly/UITpsX (last accessed 05 June, 2013).

[21]. For the status of Contracting Parties, see http://bit.ly/f92xL2 (last accessed 05 June, 2013).

[22]. For the status of Contracting Parties, see http://bit.ly/fEsUAF (last accessed 05 June, 2013).

[23]. Supra note 14.

[24]. Supra note 19.

[25]. Supra note 19.

[26]. Supra note 19.

[27]. Supra note 12.

[28]. Supra note 12.

[29]. Supra note 12.

[30]. Supra note 12.

[31]. Supra note 14.

[32]. Supra note 12.

[33]. Supra note 12.

[34]. See Article 35 of the Proposed FTA.

[35]. Glover Wright, A Guide to the Proposed India-European Union Free Trade Agreement, available at http://bit.ly/16Dfuga (last accessed 05 June, 2013) at 12- 14.

[36]. Id.

[37]. Id.

[38]. Thiru, EU-India FTA: EU Pushes for IP Enforcement- IP Chapter Draft Text Under Negotiation (2013), available at http://keionline.org/node/1681 (last accessed 05 June, 2013).

[39]. See Article 22.3 of the proposed FTA.

[40]. Supra note 35.

For more details visit https://cis-india.org/a2k/blogs/india-eu-fta-copyright-issues