The government on Monday released a fresh protocol with regards to the usage of Aarogya Setu, Indian government's digital platform to track covid-19 patients. In a lastest development it has been clearly indicated that the personal data of the app’s user, which includes contacts and location, must be permanently deleted after 180 days “from the date on which it is collected”, and data can only be used for health purposes. The move comes as the government has faced criticism of the violation of privacy by digital rights activists as the app has evolved from a contract-tracing app when it was launched in April to take on a larger role of providing e-passes, telemedicine, as well as e-pharma facilities; critics have raised concerns over the government making it mandatory for a host of activities, especially in the movement of individuals.
Last week, a French hacker pointed at vulnerabilities on the app by showing that details of millions of Indians using it could be accessed within a 100-km radius. The app only provides data for a radius of 10 kilometres only for phones in India. The new protocol also allows an individual to request for deleting demographic data, which must be abided by in 30 days. The new norms, which lay emphasis on anonymisation of data collected by the app, mention that the data can be shared with the “Government of India”, and all the agencies that are granted access to the data must use it only for the purpose for which it has been shared and delete it after 180 days. Recently, the Congress raised security concerns about the application by taking up a technical note by hacker Elliot Alderson. The hacker claimed that through the app he was able to access information about people who were infected by coronavirus and felt unwell, among other data points, including people in sensitive offices like the PMO or Parliament. The Aarogya Setu has already crossed 9 crore downloads and is en route to enter the 100-million club.