Revised Transcript – Pavan Duggal, Cyber Law Expert

PD - My book has come up 'Post cyber order post Covid 19' . What is happening
is world is seeing some dramatic and irreversible changes taking place during
corona virus  time. Right now there is no denying that Covid 19 is biggest public
health emergency of our times but under the garb of this lot of changes are
happening that are going to directly impact cyber space for ex Governments are
getting more and more powerful which effectively means they are putting on their
kitty huge amounts of power which they would have otherwise not put though it is
under the garb of fighting Covid 19. Lets take the case of Hungrary. The hungary
Prime- Minister has gone ahead and has released a decree which says he and
his partner will rule indefinately fighting Corona virus . Similar things are
happening in other parts of the world as well. So with increasing state power
coming in with increase in cyber security breach is coming in and with cyber
crime touching sky rocketing figures we are now going to enter into a new age in
cyber space once covid 19 is going to come to an end and we will see this new
age as what is known as cyber world order where things will be dramatically
completely changed and different. This will be the age where your liberties, would
be at stake, the governments would be increasingly very powerful and the way
we are using internet today may not be the way we will be able to use internet . 

PD - There will be immense amount of restrictions for ex. Covid 19 apps that are
coming across different parts of the world. These apps are being generated in
order to create more awareness about Covid 19 , informing what is the location
of nearest Covid 19 patient but under the garb of this there is massive
surveillance  going across . There is violation of your privacy as most of thse
apps dont have crystal clear guidelines as to who has got access to these apps
as these apps are gathering sensitive personal data because it deals with the
health and medical record of the people concerned and once these kind of
powers are going to be given to government trying to get liberties back will be a
big challenge, so we will increasingly see a lot of these Covid 19 legislation
coming up in different parts of the world . Its begun with Hungary, already seeing
in other legislation in France, Hongkong, Singapore so the purpose of this
legislature is increasingly to enhance state power and to continue imagining this
state power not only till time Covid 19 is brought to an end but also to fight
subsequent to the second wave of covid 19 infection. Thus, it is likely to continue
for quite some time so different cyber security laws are being passed across the
world . One of the African countries has now passed a new law on cyber crime in
this corona virus times which is very very broad. Similarly fake news is being
sought to be regulated in a massive manner, though intentions are not normal
but it is coming to a new cyber world order that we would be leading now . So i
have tried to identify what this new cyber order is , what could be its potential
ramifications, impact on cyber-security, cyber crime, cyber law, emerging
technologies and enjoyment of people liberties and rights in the digital eco
system per se. 
SK - Governments becoming more and more powerful , but cyber would only be
a tool to do that ,desire to that dosen't come out of cyber 
The decision to that is coming out of political exigencies. Due to these rapid
development happening on the ground they are going to have an impact on
cyber space.
SK - So there is a new world order not particularly a cyber order and technology
then becomes a tool to enforce it. 
PD - There is a new world order but you are talking about political order, I am
focusing only on cyber space . This new world order is going to create a new
cyber world order where enjoyment of liberties will be potentially compromised . 
SK - Suggestions, what should be done 
PD - People have to be aware and prepared for this new change. Currently, none
of the people have the ability to stop these changes happening 
SK- Would you say this is inevitable?
PD - No denying the fact this will happen. People right now are so much fearful of
the public health emergency aspect of Corona Virus they have not started
looking at the holistic picture as such. Holistically, things are changing ,
enjoyment of rights would be curtailed, data is going to be far more shared now
for ex Social media providers coerced into sharing information under the ground
of Covid 19. So countries seem to have a legitimate sovereign ground to seeking
information and this information is all about mapping people, surveillance.
Though its on ground of Covid 19 but ultimately for ex. AArogya Raksha Setu
App. The app is complete contravention of what Supreme Court says . Yes
government has logical legitimate grounds to say that its a public order issue and
thus for strengthening sovereignty of the country we have come up with app.
Government can argue this an app on voluntary basis but what it is not telling
people is consent of people is not free and fair consent. If you haven't disclosed
people complete parameters how are you going to deal with this information then
even if they give the consent to such kind of App being downloaded consent is
not deemed to be fair, free and well informed. So there are going to be
ramifications. People are too busy in the fear aspects of corona virus they are not
looking at the ramifications, I see a spring board of new litigation coming up after
corona virus comes up where all these things are likely to be potentially
challenged in courts of law. 
SK - Not as a lawyer but as a citizen what do you suggest that contact tracing
app not required. 
PD - We have to realise these are exceptional times and app can be could be
one response but there needs to be appropriate checks and balances not only
the Indian app but globally as well.
SK - What will be those checks and balances in India.
PD - Checks and balances 1.) Understand peculiar landscape in India . India
does not have a data protection law , Does not have a privacy law, does not have
a cyber security law . Thus when we have these trinity of lack of laws
government has to ensure that your apps comply with existing jurisdiction of the
land . You cant say this is public health emergency i am going to put jurisdictions
of supreme court in waste basket and will do what i have to do to fight menace.
Powers are there to fight the menace but clearly you will have to start ensuring
there are appropriate checks and balances, complying with broad parameters on
protection of privacy . This app is a government app, circulated by the states and
once when there is violation of privacy we are going to see huge volume of
petitions which would challenge legalities of this app or constitutional validity
more so in the light of judgement of the Supreme Court in Justice Putthaswamy
Vs Union of India. These challenges are going to be there but lets put checks
and balances. One of the biggest challenges is when i look at the term and
conditions is there is no clarity as to who all will have access to data , appropriate
restrictions on the access of data and usage of data as this kind of data would
extremely be used to discriminate those people who have either become
infectious with Covid 19 or have been instrumental in spreading infection. We
already have principles of Equality that have been defined under fundamental
rights. Those would have to be seen right now . Right now we are all doing a
knee jerk reaction. Lets quickly do it as other countries are doing it what we don't
realise is in South Korea there is distinctive interception and monitoring regime
and app that is being put up is an extension in that regime. We do have a right of
interception and monitoring under Section 69 of the IT act but it can be only used
under certain exceptional circumstances . You can say Covid 19 is ultimately
impacting sovereignty and security of country i am not too sure but it can be a
good argument to be put forward for the court to decide ,so in the absence of
actual framework it is also not clear how the said app is currently complying with
parametres of the IT act and also also rules and regulations. So a lot of work
needs to be done. In doing knee jerk reactions the objectives cannot be doubted
but long term legal ramifications and  exposures  to new set of litigation when
Covid 19 comes to an end must be kept in mind so as to come to a more
balanced and reasonable approach.
SK - If we have to give a recommendation then what would it be?
PD- Recommendation would be 1) while we are coming up with such apps
please ensure apps are compliant with the IT act 2000. 2) App complies with rule
of IT rules of 2011 which are IT intermediary guidelines rules 2011 and IT
reasonably security practices and procedures and sensitive Personal data or
intrusion rules 2011 , these are initial study points 3) App needs to look at the
judgement of  Supreme court in the right to privacy because when this app is not
being offered by private entry but by state then exposure to state for  violation to
privacy will stand up 4) We should be allied by the fact that there is no law
passed by the Parliament that allows such collection of data or such kind of
activity impacts or deprives people of the privacy because that's the mandate
under article 21 of the constitution of India.
SK - If private party is doing then there is no problem?
PD - If its a private party then it is a different ball game altogether then private
party only at best be sued for damage by way of compensations . Private party
will continue to be an intermediary under section 21w of the IT act and would
continue to mandate with exercise of due diligence under obligations under law,
but with Government floating this app the state is entity against which right to
privacy is guaranteed under constitution and that opens up a new vista of writ
jurisdictions and litigation in coming times. There needs to be checks and
balances , there must be adequate clear stipulations to the effect which all
authorities can and cannot access to the data . Please appreciate this app is not
by the ministry of health,this app is by the ministry of Electronics and Information
Technology so effectively the relevant ministry dealing with this information is not
health ministry but is the IT ministry so there are going to legal challenges there ,
so it is not that these are exceptional challenges so  we have to throw all the laws
in the waste basket , we will have to still ensure broad and substantial
compliance to the parameters in order to minimise exposure of the state to
potential legal consequences in that regard. Nobody can argue against the app
and its efficacy, problem is just that it is voluntary does not change the fact to its
ability to not comply with law of land . So a lot of things would have to be done in
order to not just go ahead and assault people hesitancy but also define as to
which all agencies within data can access to data and what happens to data
once Covid 19 comes to a close. Will this data ever be destroyed if so what will
be the processes in this regard as government will say at close of Covid 19 that i
have this data and i still need this data as i want to prevent second wave of
infections of Covid 19, so there are distinctive challenges which must be
appropriately addressed.
SK - Have you seen revised privacy policy yet
PD - I haven't gone through it yet but revised privacy policy would have to studied
in detail. My information based on what i had seen of the app day before. 
SK - Under the policy the data would be there for 30 days and then it would be
deleted on the device and the government side 45 days  , so now the issue is not
so much how long the data is going to be alive , thats not the issue people are
fighting?
PD - Its not the question of deletion, its the question of Access, if your data is
accessible to other people in 45 days then mere deletion on your device or
mobile is of no consequence so important issue is of access not of deletion,  so
who is having access to app on those 45 days , conditions of access, data
copied, where all it can be copied what are cyber security ramifications being
undertaken , reasonable security practices as this app is going to be a target of
many hackers and cyber criminals who would want to increasingly exploit
vulnerability of app and then go ahead and steal data and sell that for
consideration . This is premium data that is selling for premium on dark net so its
going to be a child's play for any normal hacker to go ahead so therefore focus
has to on preserving cyber security,defining access rights and copying rights and
details pertaining to handling and processing such kind of medical data. 

Recommendations –
 Firstly to Understand peculiar landscape in India . India does not have a
data protection, privacy law & cyber security law . Thus when we don’t
have these trinity of lack of laws government has to ensure that your apps
comply with existing jurisdiction of the land .

 Need to disclose complete information to the people regarding what would

happen to their data, who would get access to it etc. 

 Look at the law of equality, fundamental rights of citizens those have to be

seen exceptionally right now instead of a knee jerk reaction and coming
out with a map as all other countries are coming out with one.

 Objectives cannot be doubted but long term legal ramifications and 

exposures  to new set of litigation when Covid 19 comes to an end must be
kept in mind so as to come to a more balanced and reasonable approach.

 While we are coming up with such apps please ensure apps are compliant
with the Information technology  act 2000. 

 Ensure App complies with rule of IT rules of 2011, which are IT

intermediary guidelines rules 2011 and IT reasonably security practices
and procedures and sensitive Personal data or intrusion rules 2011

 App needs to look at the judgement of  Supreme court in the right to
privacy since this app is not being offered by private entry but by state thus
exposure to state for  violation to privacy will stand up.

 We should be allied by the fact that there is no law passed by the

Parliament that allows such collection of data or such kind of activity that
impacts or deprives people of the privacy because that's the mandate
under article 21 of the constitution of India.

 There must be adequate clear stipulations to the effect which all authorities
can and cannot access to the data 
 Ensure broad and substantial compliance to the parameters in order to
minimise exposure of the state to potential legal consequences

  Focus has to on preserving cyber security,defining access rights and

copying rights and details pertaining to handling and processing such kind
of medical data.