Private and Controversial: When Public Health and Privacy Meet in India

For my father, Bir Singh Parsheera

The stars shine brighter in your company

Contents

Foreword

Preface

1. Introduction: When Privacy Meets Public Health

Smriti Parsheera

PART I

The Current State of the World

2. India’s Legal Framework on Public Health and Privacy

Smriti Parsheera and Justice (Retd) B.N. Srikrishna

3. COVID-19 Data Infrastructure in India: Politics of

Knowing and Governing the Pandemic

Bidisha Chaudhuri and Meera Muthukrishnan

4. COVID-19 Surveillance in India: A Bridge Too Far?

Vrinda Bhandari

PART II

India’s Public Health Machinery

5. On Health Data Architecture Design

Prashant Agrawal, Subodh Sharma, Ambuj Sagar, Subhashis Banerjee

6. Privacy Considerations of Community Health Workers

Vijayaprasad Gopichandran

7. Data Protection in Public Healthcare: An Assessment

of Three Government Schemes in India

K.P. Krishnan, Rishab Bailey, Gaurav Jain

8. Trust: The Cornerstone of Health Interventions

Olinda Timms

PART III

Locating the ‘Public’ in Public Health

9. Regulating the Womb: Reproductive Health,

Bodily Integrity and Autonomy in Contemporary India

Anindita Majumdar

10. Confidentiality and HIV/AIDS: The Need for

Humaneness and Precision in the Law

Vivek Divan and Shivangi Rai

11. Decisional Privacy and Decisional Autonomy:

A Rights-Based Paradigm for Mental Healthcare in India

Arjun Kapoor

PART IV

The Governance of Health Data

12. State Legibility of Personal Health Data in India

Faiza Rahman and Ajay Shah

13. Health-Tracking Technologies: Privacy and Public Health

Smitha Krishna Prasad

14. Data Stewardship: Solutions for Sharing of Health Data

Astha Kapoor

15. Artificial Intelligence and Healthcare

Rahul Matthan and Prakhar Pipraiya

Appendix 1

Notes

Index

Acknowledgements

About the Book

About the Author

Copyright

Foreword

PUBLIC health is the joint responsibility of the public and the body politic that governs. By public is meant the individual constituents of the community. It is only when each of the players play the role effectively that the health of the community is preserved and protected against ravages by disease and death, the two major concerns of any society. The roles of the players often create tensions and conflicts that may appear to be mutually irreconcilable, but tensions are inevitable in a vibrant democratic polity to ensure its viability.

In a democratic set up individuals consensually surrender some parts of their rights, even fundamental rights, in favour of the state so that the state is empowered to act on behalf of all citizens to protect the rights of individuals against erosion by external forces. Epidemics and wars epitomize such situations. In each such situation, the individual’s right to freedom and dignified life is threatened both at the micro and macro level and the response can only be collective if it must be effective. This dilemma of the apparent conflict of collective as against individual rights is the subject of critical analyses in the essays in this anthology.

Healthcare and privacy throw up two extremities of the conflict that appear to be internecine. If the state must live up to its responsibility of protecting the health of citizens, it needs to adopt suitable policies and implement them. No public policy can be formulated unless it is based on analysis of large volume of data which alone can generate a reasonable prognosis that could enable the state to formulate and effectuate appropriate responses. The requisite data, however, resides with the individuals and they may be reluctant to transfer them to the state because of trust deficit. The state might take recourse to legal compulsion to acquire such data. This is a catch-22 situation that requires careful balancing of two apparently conflicting rights. The state’s action needs to be proportionately nuanced to avoid overreaction and shun unwanted-intrusions into privacy.

This anthology of essays critically examines several dimensions of the dilemma from different perspectives. What data sets represent, how they are collected and preserved with integrity, how they are analysed to draw conclusions that drive policy responses and the legal implications of each of the steps have been examined by the learned authors who have proffered their views and possible methods of making the exercise harmonious. In view of the sensitivity of the data, how the task of collection of the data of principals can be accomplished without offending their privacy rights is a tightrope walk. Varied ramifications of this act have been presented in these essays. The situation is not a trade-off of one against the other, but a zero-sum game where the rights and liabilities of both players balance each other for advancement of the community’s interests.

The topics considered by the essays cover a wide range from constitutional and legal issues, tracking and contact tracing, collection and preservation of health data, trust and confidentiality, decisional autonomy, and technical issues like the consequence of emphasis on digitalization and recourse to artificial intelligence to resolve some of the problems encountered.

Kudos to the authors of the papers for throwing light on different aspects of the problem to lead to greater debates and analyses of the complex facets of collection of health data. The editor Ms Smriti Parsheera has done an excellent job that ensures that the pros and cons of the connected issues are put forward with clarity for consideration of the discerning readers.

My best wishes for greater empowerment to the pens of the authors and the editor of the book.

Justice (Retd) B.N. Srikrishna

Mumbai, India

28 February 2022

Preface

‘If we had but the gift of second sight to transmute abstract figures into flesh and blood, so that as we walk along the street we could say That man would be dead of typhoid fever, That woman would have succumbed to tuberculosis, That rosy infant would be in its coffin, – then only should we have a faint conception of the meaning of the silent victories of public health.’

– Charles-Edward Amory Winslow, 1923

IT is often said that a well-functioning public health intervention tends to be invisible. Its success lies in the fact that, when available, one does not question the logic or necessity of things like clean air, safe drinking water, sanitation, basic nutrition and building safety. Rather, it is the absence of these necessities that tends to draw attention and gives rise to public health concerns. Privacy follows a similar pattern. We rarely pause to acknowledge the role that it plays in shaping our meaningful existence, through control over our personal spaces, thoughts, relationships and actions. Much like the problems of public health, privacy issues generally come to the fore in response to perceived threat events – a data breach, an amended privacy policy or the announcement of a new data-intensive government programme.

This collection of essays is an attempt to break this cycle of invisibility. It focuses on bringing out the complex interactions between the fields of public health and privacy, in emergencies and normal times, across populations and for specific groups. Its genesis lies in a research grant received from the Thakur Family Foundation in December 2020 for studying the privacy issues in the system supporting public health in India. In the months that followed I reached out individuals with deep knowledge on issues of public health and data governance, and their interaction with the domains of medicine, law, economics, technology, public administration and public policy, and invited them to be a part of this project. In October 2021 we convened in a hybrid format for an author’s workshop in New Delhi. The workshop gave us the opportunity to present, discuss and critique the essays in the company of other domain experts. We hope that the reader will find this knowledge and rigour reflected in the pages that follow.

Like everything else around us, this anthology is a product of its times. It comes against the backdrop of one of the most significant public health emergencies of our times. Discussions about the COVID-19 crisis and its impact on human lives, rights, interaction between citizens and the state, and trust in the health system, therefore, form an integral part of the collection. India’s evolving policy landscape on privacy and data governance forms another recurring theme across the chapters. When we started this project, the Justice B.N. Srikrishna – led Committee of Experts had submitted its recommendations on data protection to the government and a bill based on the same had been introduced in Parliament. In the months that followed, a joint parliamentary committee offered further recommendations on the bill and the government ultimately decided to withdraw the existing bill with the promise to introduce a new draft. As we went to press, the government had just put out a new draft, titled the Digital Personal Data Protection Bill, 2022, for public comments. The contents of this draft bill are not reflected in these essays that had already been finalized by then. But much of what we discuss here relates to the first principles of privacy and data protection, which remain as relevant to the new draft as they were to the versions before it.

In parallel, India has witnessed a massive push towards the digitalization of health data, notably under the new health data architecture created the Ayushman Bharat Digital Mission. The essays evaluate these policy developments from multiple lenses, like the role of health data in shaping state legibility, India’s artificial intelligence story, the rise of health tracking technologies and future of data sharing arrangements.

In addition to a diversity of disciplines, the contributors represent a diversity of viewpoints. As the editor of the volume, I found myself nodding in agreement on most of the ideas presented by the authors but also disagreeing on some counts. Each reader might find themselves in a similar position. And that is precisely the objective. The book’s aim is to trigger a more meaningful conversation around what happens when public health and privacy meet in the Indian context, the tensions that it creates, and where the balance should lie. Agreements, disagreements and other heterogeneous viewpoints are all signs that the need for this conversation is acknowledged and that the debate is moving forward.

1

Introduction: When Privacy Meets Public Health

Smriti Parsheera

EVERYDAY interactions between the individual, community and the state are full of interdependencies and tensions. How should the state achieve its vaccination goals while ensuring meaningful consent? What limits can the government impose on an individual’s food and drink choices? What should be the bounds of confidentiality governing the conduct of doctors and community health workers? How does the individual’s right to control their health information interact with the state’s need to know, plan and implement for better public health outcomes? The answer to each of these questions bears significant implications for the autonomy, liberty and dignity of individuals as well as the achievement of public health objectives.

Developments surrounding the management of the COVID-19 crisis help drive home many of these points. In a bid to contain the pandemic, governments resorted to measures such as contact tracing, travel restrictions, mandatory quarantine and door-to-door collection of health data. The legitimacy of the public health objective of tackling a pandemic like COVID is hard to question. But so is the impact of actions taken in the process on the liberty and privacy of individuals. A deeper investigation into the legality and proportionality of each intervention, and how it balances against the citizen’s fundamental right to privacy, therefore, becomes imperative.

To be clear, the relationship between privacy and public health is not always one of strife. For instance, maintaining the confidentiality of a person’s mental health records or their HIV status is both respectful of their privacy and helps counter the associated stigma. Ensuring privacy under these circumstances serves to build trust in the system, furthering the public health goals of early detection and management.

To take another example, travellers on overnight trains in India would be familiar with morning scenes of rows of people defecating along the sides of railway tracks. For the passenger this may be a source of discomfort or annoyance. Indeed, this is also how the law treats open defecators, who often find themselves charged under provisions on nuisance and trespass of railway property.¹ But at the heart of this illustration lies an enormous public health problem. The World Health Organization (WHO) describes open defecation as a vicious cycle of poverty and disease, which contributes to over 432,000 diarrhoeal deaths annually.² In recent years, India has made significant progress on this front, driven by the Swachh Bharat Mission. But the claims of being open defecation free are still far from being met.

At the same time, open defecation is also a matter of privacy, on at least two counts. Its first intersection with privacy is in the context of human dignity. This relates to the dignity of urban slum dwellers who may have no choice but to relieve themselves in the open, in the sight of passing strangers. It also concerns the dignity of rural women who routinely encounter violence, harassment, shame, and menstrual hygiene issues due to the lack of toilet facilities.³ The second privacy argument is linked to a person’s decisional autonomy, another important facet of the right to privacy. Stretching the idea of personal autonomy to its limit, one could claim that they should enjoy the freedom to defecate in any environment of their choice. As per a 2014 study, the revealed preferences of many Indians did in fact convey a view of open defecation as a more ‘pleasurable, comfortable or convenient’ experience.⁴ Yet, a balancing of this choice against the health, hygiene and environmental threats of open defecation makes it easy to argue for social, and even legal, restraints on voluntary defecation choices.

The same public health intervention can, therefore, have multiple effects, some which restrain while others that complement the right to privacy. These effects may also vary across different subgroups, leading to the important question of who is the ‘public’ in the pursuit of public health? And what happens when the interests of different publics collide among themselves or with the priorities set by the state?

The essays in this volume touch upon a range of such issues that lie at the intersection of privacy and public health. But before introducing the chapters, it seems pertinent to spend some time setting out the context of what lies ahead. I, therefore, begin with a brief introduction to concepts of ‘public health’ and ‘privacy’. Given the richness of these topics, each one deserves, and indeed has, many volumes dedicated to it. The modest goal here is to provide sufficient background to help one appreciate the interconnections between public health and privacy and the relevance of studying these interconnections at this point of time.

What is Public Health?

In his classic definition from 1920, American public health expert, Charles-Edward Amory Winslow, described it as ‘the science and the art of preventing disease, prolonging life, and promoting physical health and efficiency through organized community efforts’.⁵ What makes public health a science? The ‘scientific core of public health’ lies in epidemiology – the systematic study of health risks and patterns in the population and discovery of solutions based on that study.⁶ The development of COVID-19 vaccines and that of smallpox, polio, measles and meningitis before that are all examples of epidemiology’s scientific successes. However, even the most well-designed scientific interventions may fail unless the community is willing to engage with them through behavioural modifications. Public health is, therefore, also an art whose value is determined both by the skill of the practitioner and the level of engagement by the public.

Drawing upon the wisdom and context of his times, Winslow had identified four key public health interventions: sanitation of the environment, control of community infections, education about personal hygiene; and organization of medical services to aid early diagnosis. Winslow’s formulation continues to hold water a century later, especially in terms of the focus on preventive actions and collective efforts. But the priorities of the field have also evolved in some ways.

Many parallels have been drawn between the current COVID pandemic and the ‘Spanish flu’ or influenza pandemic of 1918, the most disruptive pandemic of the previous century. India happened to be one of the worst-affected countries, with estimates of twelve to eighteen million people having lost their lives to the influenza pandemic.⁷ As per historical data, cholera, plague, smallpox and malaria were some of the other major killers of that era.⁸ All of these diseases can be traced to unsanitary conditions, contaminated food and water, or transmission through contact with infected persons. This resulted in two major priorities for public health, globally: first, the prioritization of sanitation, clean water, sewage and waste disposal, and personal hygiene; and second, the containment of infectious diseases and subsequently their prevention through vaccinations. Over the years, the global community has managed to achieve significant success on both these fronts.

Despite continuing disparities between the developed and developing world and the COVID setback, an average person now lives much longer than their ancestors did a few decades ago. Compared to a life expectancy of twenty-one years in 1920, a person born in 2020’s India is likely to live closer to seventy years.⁹ This longevity comes with an increased likelihood of suffering from, and dying of, a different set of causes than the ones described above. Over 70 per cent of global deaths are now attributed to non-communicable diseases like heart and lung problems, cancer and diabetes.¹⁰ The factors responsible for this include dietary and lifestyle choices, such as smoking, lack of physical activity and unhealthy food, as well as environmental, genetic and socio-economic conditions. The intensity of risk factors (as also the related causes of death), however, varies across regions and population groups. As per the Global Burden of Disease study of 2019, child and maternal malnutrition, followed by air pollution and high blood pressure are the three most significant risk factors driving death and disability in India.¹¹ In contrast, smoking was the leading factor for several other countries, like Australia, Japan, China and the US.

The varying risk factors illustrate how public health outcomes end up being influenced by country contexts and the actions of a range of different stakeholders. At the centre of this maze are the members of the community. Depending on the issue at hand, the size of this community may vary from the residents living on a small street to the entire population of a country. The policy actors responsible for making and implementing public health decisions can be equally diverse. For instance, India has over fifty health-related programmes at the central level itself, divided into the categories of reproductive, maternal and childcare; nutritional programmes; communicable diseases; non-communicable diseases; and programmes for the overall strengthening of the health system.

In their chapter on the evaluation of public health schemes in India, K.P. Krishnan, Rishab Bailey and Gaurav Jain selected three of these programmes – on tuberculosis elimination, safe motherhood and government-financed health insurance – for a more detailed study. As can be expected, they find significant variations in the technical and administrative design, implementation safeguards and personal data interactions under the schemes. Notably, the authors observe that the more recent initiatives seemed to pay closer attention to issues of data protection, probably on account of the greater reliance on digital technologies under programmes like the Pradhan Mantri Jan Aarogya Yojana. This illustrates how seemingly extrinsic factors, like the extent of digitalization in the society and growing privacy awareness, can have a bearing on policy priorities in public health programmes.

In this case, all three schemes happen to be administered by the health ministry. But this may very well not have been the case. Many public health actions fall outside the control of the health department, lying instead in domains like environmental protection, urban management, road safety and child welfare – all of which are handled by different ministries.¹² To take an example, the Smart Cities Mission is an initiative being led by the Ministry of Housing and Urban Affairs in the central government. Under this, 100 cities across the country have been selected to implement model solutions in areas such as solid waste management, water treatment, sustainable environment and crime monitoring. Each smart city is supposed to set up a special purpose vehicle with nominees from the central government, state government and urban local bodies. The footprint of the Smart Cities Mission, therefore, cuts across multiple domains and levels of the government. Many of its interventions relate directly to issues of public health, although it is not labelled as a public health project.

In addition to institutions and high-level decision makers, numerous street-level bureaucrats also play a critical role in the functioning of the public health machinery. Michael Lipsky first used this term in 1980 to describe front-line public workers who interact directly with citizens, while enjoying a substantial level of discretion in their actions.¹³ Examples in the COVID context include the constable on the street who gets to decide how strictly to apply the lockdown rules and upon whom. It also includes the receptionist at the government testing facility who can put a person’s name on the RT-PCR (real-time reverse transcription polymerase chain reaction) testing list or send them for a rapid test. Each of these individuals is acting within the scope of the directions issued by the state but also reshaping those bounds based on their own incentives, uncertainties, pressures and threats.¹⁴

The chapter by Vijayaprasad Gopichandran focuses on the role of community health workers, who are arguably the most important cadre of street-level officials in India’s public health set-up. Community workers like the Accredited Social Health Activists (ASHAs) and the Anganwadi workers serve as a critical link between the community and the state, discharging the functions of data collection, communication, health education, advocacy and support. While doing so, they often negotiate complex issues of trust, confidentiality and stigma involving the community, and concerns for their own livelihood, safety and privacy. The interviews conducted by Gopichandran with community workers are particularly illuminating in highlighting the socially constructed nature of privacy for young, rural women. Traditional notions of privacy are intrinsically linked to the safety and privacy of one’s home. But Gopichandran’s conversations with community workers revealed how for a young woman trying to have a conversation about her sexual health, the home can become a particularly confining space. In contrast, the noise and chaos offered by a village fair creates a sense of privacy that is necessary for the conversation with the community health worker.

While the discussion so far has focused on the state, its functionaries and members of the community, it would be remiss to not highlight the role of private actors in this equation. A large part of what is called public health law focuses on reshaping the behaviour of private actors like hospitals, car and drug manufacturers, tobacco companies, employers and polluting industries through the use of incentives and prohibitions. In addition to these large actors from the old economy, who continue to remain relevant, a new breed of technology sector players have also entered the mix. This includes a host of entities involved in the processing of health-related data for purposes such as consumer targeting, development of AI (artificial intelligence) algorithms and the operation of smart devices.

In her chapter on health-tracking technologies, Smitha Krishna Prasad sets out the vast landscape of apps, devices and other artifacts that interact with the personal health information of users. Some of these, like smart watches, period trackers and calorie counters, are explicitly in the domain of health tracking while other smart devices like thermostats and air quality monitors present a more indirect, but no less relevant, link between privacy and public health. Prasad also focuses on the role of corporate employers in pushing the use of health-monitoring technologies. While this is ostensibly meant to serve the goals of employee wellness, it can also create unfair trade-offs in terms of the employees’ healthcare and insurance entitlements.

The constitution of the WHO, adopted in 1946, draws a clear link between the concepts of health and well-being. It defines health to mean not just the absence of disease or infirmity but a state of complete physical, mental and social well-being. By extension, public health experts have also started to focus on mental health and psychological well-being as part of their work.¹⁵ For instance, current wisdom tells us that a healthy workplace is not just limited to preventing unhygienic working conditions and safety from occupational hazards. Rather, it captures a broader sense of well-being, which includes mental health and work–life balance. For many, this balance has been upended by the blurred boundaries between home and work in the COVID-19 context. This is accompanied by growing surveillance at the workspace, with employers resorting to intrusive digital surveillance tools, ranging from CCTV monitoring to logging of keystroke activities, and from automatic webcam access to taking screenshots of the employee’s computer.¹⁶ This is likely to have long-term effects on public health that are intrinsically linked to the underlying privacy concerns posed by such technologies. This is only a small illustration in a much larger landscape of datafication and digitalization in the health space, a trend that has become all the more evident in the current context.

Vrinda Bhandari’s chapter presents a comprehensive mapping of the different types of physical and digital surveillance measures adopted by the state and by certain private actors to deal with the COVID situation. She classifies these based on the underlying functions of symptom tracking, mobility and density mapping, quarantine enforcement, contact tracing, travel passes, and vaccination. Similar to the experience globally, Bhandari notes that India’s response to the pandemic has largely been a tech-centric one. But this has been done without a legal framework on data protection or sufficient focus on the utility, reliability, accuracy and security of many of the interventions. India’s legal response to the pandemic has hinged on its classification as a disaster. But Bhandari notes that the ‘long tail’ of the pandemic makes it very different from other types of disasters that are often of a finite and limited duration. The use of extraordinary technological measures to deal with the crises, therefore, comes with the fear of certain types of surveillance being normalized in the long run.

Bidisha Chaudhuri and Meera Muthukrishnan present a fascinating take on understanding the pandemic in terms of the politics of how COVID-related data sets were being constructed, controlled and used. While there appears to be a general consensus on the importance of evidence-based decision making in public health, this is complicated by the fact that the evidence in question often tends to be incomplete and ambiguous.¹⁷ A purported reliance on data was at the core of many important decisions in the COVID context, such as when should lockdowns be imposed and which areas need urgent supplies of oxygen. Chaudhuri and Muthukrishnan undertake a systematic review of the dashboards maintained by state agencies as well as some prominent private ones and find several gaps and inconsistencies in these data practices. This becomes their basis to question the uncritical reliance on databases as a means of getting to ‘know’ the pandemic.

The ‘Public’ in Public Health

Public health is often described as the health of the population. But the term ‘population’ here is not limited to the geographic notion of a population. In the words of Kindig and Stoddart, population health refers to ‘the health outcomes of a group of individuals, including the distribution of such outcomes within the group’.¹⁸ As per this definition, a population could indeed be demarcated based on geographical factors, but also based on other factors like gender, ethnicity, clinical conditions, disability status and nature of employment. Accordingly, public health interventions could be focused on preserving or enhancing the health outcomes for any of these specific population groups. This would, for instance, include measures taken by the government to protect front-line health workers, such as through priority in vaccinations, health insurance facilities and amendments to the Epidemic Diseases Act to criminalize attacks against them. Similarly, there are several other occupation-specific laws in the country, like those for beedi and cigar workers, miners and plantation workers, that put in place requirements of cleanliness, ventilation, rest periods and medical examinations for these populations.

This collection contains three essays that explore the relationship between public health and privacy in the context of specific population groups. The first group, covered by Anindita Majumdar in her essay on the regulation of the womb, is that of childbearing women. More specifically, women who find themselves negotiating their reproductive health choices against the incentives of medical practitioners and priorities set by the state. Majumdar selects three sites of inquiry – surrogacy, hysterectomies and caesarean sections – to demonstrate how bodily integrity and autonomy of women play out in these spaces. One of the key points that she drives home is the role that caste, class and religion continue to play in shaping the outcomes faced by the reproductive body. To turn back to the definition of population health, this illustrates how the distribution of outcomes within a group is not uniform and tends to be shaped by numerous economic, clinical, social and political factors.

The chapter by Vivek Divan and Shivangi Rai focuses on the rights of persons living with HIV/AIDS. The authors make a strong case for a rights-based approach to HIV/AIDS, especially in the context of patient confidentiality, as being both respectful of the right to privacy and serving the goals of public health. They highlight how the legal framework in India has evolved in terms of balancing the patient’s right to confidentiality with the duty of notification to their partner. While the HIV and AIDS (Prevention and Control) Act of 2017 has put to rest the legal controversy on this issue through a strong confidentiality framework, there remains a gap in the law as it stands and as it is practised. Divan and Rai demonstrate this with an example of the rules applicable to nursing homes in the state of Maharashtra. The rules single out HIV patients in terms of disclosure requirements, by requiring ‘details of those found positive and negative’ as opposed to only the total numbers for other notified diseases.

Persons with disability constitute yet another important population group from a public health perspective. Arjun Kapoor’s essay looks at issues of decisional autonomy and legal capacity faced by persons with mental illness. The state and society often treat this population group as ‘incomplete beings’, invalidating their ability to make decisions about their own contractual and property matters, family life and medical treatment. Kapoor presents a critique of this approach, rooting his arguments in the legal and moral foundations of decisional autonomy, including its interpretation by constitutional courts in India. While international standards and the legal framework in India offer sufficient safeguards for decisional, bodily and informational privacy in the mental health context, we are yet to create the frameworks necessary to operationalize these rights. Kapoor highlights improvements in community-based measures, better staffing and training of professionals, and understanding the incentives of families and caregivers as some of the necessary steps for realizing the decisional autonomy of persons with mental illness.

Finally, the mainstreaming of the internet and other new technologies also has an impact on how a population or community can be construed. For instance, users of Facebook, content creators on TikTok and fans of the popular video game Minecraft could all be regarded as different population groups. In her chapter on data stewardship, Astha Kapoor dwells upon the meaning of public interest, a term that often comes up in policy documents, in the context of the sharing and use of health data. She focuses on three main developments, the Personal Data Protection Bill, 2019 (PDP Bill), which has now been withdrawn, the Health Data Management Policy put out by the National Health Authority, and the recommendations of the Non-Personal Data Committee. Kapoor notes that amidst this ‘rigmarole of regulation and policy’ we are still missing a clear set of principles to guide data sharing. Equally lacking is a bottom-up approach that places communities and individuals at the core of decision making about their data.

Privacy, Data and Beyond

The term privacy has already made numerous appearances in this essay. It is a basic human right recognized under the Universal Declaration of Human Rights. In 2017, a nine-judge bench of the Indian Supreme Court affirmed that it also constitutes a fundamental right under the Indian Constitution.¹⁹ In what is popularly referred to as the Puttaswamy verdict, the court recognized the interlinkages between a person’s privacy and their right to life, liberty, dignity and various other freedoms. This means that an individual can challenge any state action that violates their privacy. The Supreme Court in Puttaswamy offered several useful illustrations of the different facets of privacy. Several of these, such as the protection of personal intimacies, ability to make vital personal decisions and the preservation of one’s family life, can have a direct bearing on issues of public health. Public health interventions that restrain individual autonomy, cause physical or mental intrusions, or lead to a loss of control over one’s health information could therefore be challenged on the grounds of privacy. It is then the court’s responsibility to ascertain if the intervention by the state was lawful, legitimate and proportionate in nature, given the specific circumstances of the case.

Government orders linking the opening up of the economy and delivery of services to the COVID vaccination status of the public presents a live example of such a tension. The question is, can the state directly or indirectly coerce citizens to take the vaccine? A number of high courts in India, followed by the Supreme Court, answered this question in the negative.²⁰ In the first such decision, the Meghalaya High Court was looking into orders issued by the state’s district administrations barring shopkeepers, taxi drivers and other vendors from resuming their businesses unless they were vaccinated. The court observed that the mandatory or forceful vaccination orders were neither permitted under the principles of equity and good conscience, nor would they withhold scrutiny against the rights to privacy and livelihood.²¹

Another way to look at this issue is through the lens of the intervention ladder proposed by the Nuffield Council on Bioethics.²² Similar to the concept of proportionality adopted by courts, the intervention ladder sets out an eight-step model where each step makes a slightly more intrusive inroad into individual freedom and liberty (see Table 1.1). These steps range from the mildest policy response of doing nothing to guiding choices through defaults, incentives and disincentives, and finally to the most intrusive approach of complete elimination of choice. In the above scenario, the High Court of Meghalaya frowned upon interventions that restrict the livelihood of persons who are not vaccinated but applauded information-based measures, such as a public notice informing potential customers about the vaccination status of an establishment’s staff. In Table 1, these could be said to fall under the ambit of steps 6 and 2, respectively, which illustrate the difference in the extent of intrusiveness involved.

Table 1.1: The intervention ladder of public health

Source: Nuffield Council on Bioethics, 2007

There are numerous other situations where courts and policymakers have faced the need to weigh the interests of privacy and public health. The next essay in this collection, co-authored by Justice B.N. Srikrishna and me, provides examples from contexts such as confidentiality of a person’s HIV status, prohibition on consumption of alcohol and the right to passive euthanasia. We highlight the pivotal role of the Puttaswamy verdict in reshaping how future courts might look at some of these issues. At the same time, we also highlight that a case-by-case review of state actions through the Puttaswamy lens cannot remain the primary privacy safeguard, especially when it comes to the protection of sensitive health data.

In the last decade or so, a number of countries have moved forward with the adoption of comprehensive data protection laws, the General Data Protection Regulation in Europe being an oft-cited example. These laws typically set out the individual’s rights to exercise control over the collection and use of their personal data and the responsibilities of state and non-state actors carrying out such data processing. In India, the draft PDP Bill, prepared based on the recommendations of an expert committee headed by Justice Srikrishna, was under review by a joint parliamentary committee for almost two years. The committee submitted its report to the parliament in December 2021 suggesting several amendments to the draft bill. The government’s recent decision to withdraw the draft bill, however, takes us back to the drawing board