This document is a representation submitted to the Prime Minister of India and other government ministers expressing concerns about the mandatory use of the Aarogya Setu contact tracing app by gig workers. It notes that while the app was initially promoted as voluntary, some companies are now requiring its use by delivery workers. It argues the app violates privacy principles, lacks proper legal framework and safeguards, and could enable function creep and mass surveillance. The representation urges the government to issue advisories clarifying the app should not be mandatory for workers and to provide protective equipment and financial relief for gig workers during the pandemic.

1. By Email
To:
Shri Narendra Modi
Prime Minister
Government of India
Email: connect@mygov.nic.in
CC:
Shri Ravi Shankar Prasad
Minister of Electronics and IT
Government of India
Email: ravis@sansad.nic.in
Shri Santosh Kumar Gangwar
Minister of Labour & Employment
Government of India
Email: molegangwar@yahoo.com
Shri Amit Shah
Minister of Home Affairs
Government of India
Email: contact@amitshah.co.in
amitshah.mp@sansad.nic.in
amitshah.bjp@gmail.com
Shri Nitin Gadkari
Minister of Road Transport & Highways
Government of India
Email: nitin.gadkari@nic.in
1 May 2020
Subject: Representation to protect privacy, autonomy and dignity of workers
during COVID-19 outbreak
Dear sir,
1. We, the undersigned organizations, collectives and individuals write this representation to
your offices to express serious concern about violation of privacy of workers through
mandated use of the Aarogya Setu mobile app. We acknowledge the severity of the
COVID-19 crisis which has gripped the country and maintain that it is especially during
such public health emergencies that we must ensure the privacy and dignity of essential
frontline workers is protected.
2. During the ongoing COVID-19 crisis, the government has embraced the use of technology
for health surveillance and it launched a mobile app called Aarogya Setu for self-

2. assessment and contact tracing on 02 April 2020. While the government initially claimed
that the use of Aarogya Setu would be purely voluntary, downloading the app was soon
made mandatory for all Central Armed Police Forces personnel and employees of Prasar
Bharati. However, as per news reports, army personnel have been instructed not to use the
Aarogya Setu app at office premises, operational areas and sensitive locations due to data
security concerns.
3. In addition to government employees, gig and platform workers employed by private
companies like Zomato and Urban Company (formerly known as Urban Clap) are also now
being forced to use the Aarogya Setu app and share sensitive personal information like
health and location data with the government without adequate privacy protections. At
present, the Aarogya Setu app is operating in a legal vacuum and its Privacy Policy and
Terms of Service do not comply with data protection principles of purpose limitation, data
minimization, storage limitation, accuracy, integrity and confidentiality, and transparency
and fairness in processing.
4. So far, some companies, notably Zomato and Urban Company, have mandated use of
Aarogya Setu for their delivery workers. As lockdown restrictions are gradually eased and
other food delivery services, e-commerce platforms and ride hailing apps resume
operations, they may take the decision to mandate use of Aarogya Setu for their workers.
In the near future, mandatory use of Aarogya Setu may also extend beyond the gig economy
and undermine the rights and interests of workers in the traditional economy such as factory
workers.
5. While many delivery personnel and drivers share location data with their companies as part
of routine business operations, the privacy risks posed by the Aarogya Setu app are much
higher for two reasons. First, the Aarogya Setu app will collect sensitive health data in
addition to location data. Second, while location data was previously only shared with the
employer, it will now also be available to government agencies through the Aarogya Setu
app. Therefore, the intrusion on the privacy of gig and platform workers is significantly
greater than ordinary workplace surveillance. In any case, companies already have access
to data about the location of workers and their interactions with customers, and contact
tracing is possible even without the Aarogya Setu app.
6. It is pertinent to note that the Central Government has not mandated private companies to
use Aarogya Setu and it remains a voluntary measure, however, in effect it is being made
mandatory by such entities. A news report titled ‘Draft e-com SOP: COO responsible for
meeting norms, staff to download Aarogya Setu app’ published by the Economic Times on
19 April 2020 suggests that the Government had privately circulated a Draft Standard
Operating Procedure for E-commerce with stakeholder companies which mandates use of
Aarogya Setu by all workers. The Draft Standard Operating Procedure also holds the Chief

3. Operating Officer of the company responsible for any failure to abide by these guidelines.
Therefore, mandating use of Aarogya Setu appears to be a liability reducing measure by
private companies and it amounts to the government indirectly mandating use of the app
after publicly assuring citizens that it would not do so.
7. The Aarogya Setu app has been heavily criticized for failing to adhere to internationally
recognized data protection principles endorsed by the Hon’ble Supreme Court in the
landmark judgement in K.S. Puttaswamy v. Union of India (2017 10 SCC 1). In
Puttaswamy (Privacy), the Court recognized that privacy was a fundamental right
guaranteed under the Constitution of India. The Court further noted in the age of Big Data,
collection and processing of personal data of individuals can reveal a lot about their
lifestyle, choices and preferences. The Court acknowledged that in certain circumstances,
the use of such technologies may be justified if the government was pursuing a legitimate
goal. However, even in such circumstances, these technologies must be deployed in a
necessary and proportionate manner.
8. In order to satisfy the proportionality standard adopted in Puttaswamy (Privacy), the use
of any privacy infringing technology must satisfy five criteria. First, it must have a
legislative basis. Second, it must pursue a legitimate aim. Third, it should be a rational
method to achieve the intended aim. Fourth, there must not be any less restrictive
alternatives which can also achieve the intended aim. Finally, the benefits must outweigh
the harm caused to the right holder. In the present case, Aarogya Setu fails the very first
prong of the proportionality standard because it does not have a legislative framework to
govern its functioning and to ensure adequate procedural safeguards. In the absence of a
legislative guarantee containing a sunset clause, sensitive personal data about health and
movement of gig workers collected by the Aarogya Setu app could be misused for profiling
and mass surveillance even after the COVID-19 outbreak is over.
9. In the specific context of health data, the judgement in Puttaswamy (Privacy) emphasized
on the need for a data protection legislation to ensure that personal data was not used to
discriminate against individuals on the basis of their health status. The Court further went
on to note that the government may collect and process health data of individuals during
epidemics to design appropriate policy interventions but such data must be anonymized.
10. The Information Technology (Reasonable Security Practices and Procedures and Sensitive
Personal Data or Information) Rules 2011 issued under Section 43A of the Information
Technology Act, 2000 similarly classify health data as “sensitive personal data” and
specify that health data can be collected and processed by body corporates only with the
consent of the individual [Rule 5(1)]. The Rules also impose various obligations on body
corporates relating purpose limitation [Rule 5(2) and 5(5)], notice [Rule 5(3)], storage

4. limitation [Rule 5(4)], right to access and correction [Rule 5(6)] and right to opt-out [Rule
5(7)].
11. The proposed Digital Information Security in Healthcare Act also lays down stringent
safeguards to preserve the confidentiality of digital health data and associated personally
identifiable information. The draft legislation recognizes that individuals must consent to
collection and sharing of their health data and it outlines specific purposes for which health
data can be utilized by different entities. Pertinently, the proposed Act permits use of digital
health data for epidemic control only after it has been anonymized or de-identified and it
prohibits employers from accessing the health data of workers under any circumstances.
Therefore, even though India does not have a comprehensive data protection legislation at
present, the importance of protecting health data of individuals has been recognized by the
judiciary and the government.
12. In addition to lacking legislative basis, the Aarogya Setu app deviates from international
best practices for contact tracing apps and fails to comply with data protection standards
for the following reasons:
a. Lack of Consent: The use of Aarogya Setu cannot be considered voluntary anymore
as it has been made mandatory for delivery workers. Therefore, there is no scope
for delivery workers to refuse consent or opt-out.
b. Lack of Data Minimization: Registration for the Aarogya Setu app requires sharing
large amount of personal data: name, phone number, age, sex, profession, countries
visited in the last 30 days and smoking habits. This is inconsistent with the principle
of data minimization.
c. Lack of Transparency: While it is claimed that personal data collected by Aarogya
Setu is aggregated and anonymized, there is no publicly available information about
what processes and techniques are followed for aggregation and anonymization.
This is relevant because there is high risk of re-identification unless personal data
is properly anonymized. Therefore, the app must be subjected to thorough security
testing by governmental and independent agencies.
d. Lack of Algorithmic Accountability: The Terms of Service for Aarogya Setu exempt
the government from any liability arising out of misidentification of an individual’s
COVID-19 status. Therefore, individuals are left at the mercy of opaque algorithms
which perform risk assessment and do not have any remedy in case of false
positives. If gig and platform workers were falsely identified as high risk

5. individuals by Aarogya Setu’s algorithm, they would be required to self- isolate
and lose their income and freedom of movement.
e. Unauthorized Data Sharing and Risk of Function Creep: There is no prohibition on
sharing of personal data collected by the Aarogya Setu app with third parties. The
government is allowed to share this personal information with “other necessary
and relevant persons” for “necessary medical and administrative interventions.”
The Privacy Policy for Aarogya Setu fails to specify which government
departments will have access to personal data collected by the app. Therefore,
sensitive personal data collected for contact tracing may also be used by law
enforcement agencies for punitive purposes.
f. Risk of external transfer and integration with other databases: Personal data
collected by the Aarogya Setu may be transferred to an external cloud-based server
and there is no guarantee that it will only be stored locally on the individual’s
device. Reports suggest that the data collected by Aarogya Setu is being integrated
with other databases maintained by the Indian Council for Medical Research and
Integrated Disease Surveillance Programme. This is worrisome because it is
difficult to delete such integrated datasets and secondary inferences at a later stage.
13. Classified as independent contractors, gig and platform workers do not enjoy the same level
of income and job security as legally recognized employees. They are particularly
vulnerable during the COVID-19 crisis when finding alternative employment is practically
impossible and they lack bargaining power vis a vis companies or the government.
Therefore, they should not be forced to download the Aarogya Setu app which lacks
transparency and accountability in its present form.
14. The International Labour Organization’s guidance on applicable labour standards during
the COVID-19 pandemic dated 23 March 2020 also clearly states that governments must
put in place measures to protect the privacy of the workers. It also instructs governments
to ensure that health surveillance is not used for discriminatory purposes or in any other
manner prejudicial to their interests.
15. In addition to these privacy concerns, there is also a need for governmental intervention to
provide income security to gig and platform workers who have been unable to work during
the lockdown or have witnessed a significant drop in their earnings due to low demand.
Gig and platform workers are paid per delivery and they are not guaranteed a stable income.
As a consequence, despite toiling for long hours during these difficult times, many gig and
platform workers are still struggling to make ends meet because there are not enough
deliveries for everyone. Further, personal protective equipment and medical insurance

6. should be provided to gig and platform workers who are at risk of contracting COVID-19
due to exposure to many customers every day.
16. In collaboration with gig workers’ unions, Tandem Research and Centre of Internet &
Society have developed a comprehensive charter of recommendations for COVID-19 relief
measures to protect the socio-economic well-being and health of gig workers, and we urge
your Ministry to address these issues of financial relief and occupational health safety as
well.
17. Considering the damaging impact of the Aarogya Setu app and COVID-19 lockdown on
the privacy, autonomy and dignity of workers, we urge your office to undertake the below
mentioned measures in collaboration with the private sector.
a. Take cognizance of privacy concerns associated with Aarogya Setu and issue an
advisory clarifying that use of the app should not be made mandatory for workers
in the gig economy and also the traditional economy.
b. In addition to (a), to ensure greater safety, rely on certain methods of risk mitigation
such as working with companies to provide daily temperature checks and personal
protective equipment to all gig and platform workers who continue working during
the COVID-19 pandemic.
c. Further, devise the right incentive structures both for companies and workers to
ensure that gig and platform workers are able to sustain themselves during the
lockdown and those displaying symptoms of COVID-19 are not forced to work to
ensure their livelihood. This includes provisions for medical insurance and
financial relief to all gig and platform workers who have been unable to work
during the lockdown or have witnessed a significant decrease in earnings due to
low demand.
Kind Regards,
Access Now
ADF India
All India Central Council of Trade Unions
All India Union of Forest Working People
Amnesty India
Asia Dalit Rights Forum
Association for Progressive Communications

7. Association for Protection of Democratic Rights
Bachchao Project
Chennai Metropolitan Construction and Unorganised Workers Union
Common Cause
Delhi Solidarity Group
Digital Empowerment Foundation
Feminism in India
Forum Against Oppression of Women, Bombay
Foundation for Media Professionals
Free Software Community of India
Human Rights Law Network
Indian Delivery Lions Organization
Indian Federation of App Transport Workers
Indian Journalists Union
Indian Social Action Forum
Indic Project
Internet Democracy Project
Jan Swasthya Abhiyan, Mumbai
Jharkhand Nagrik Prayas
LABIA - A Queer Feminist LBT Collective
Medianama
Metacept
Mazdoor Kisan Shakti Sangathan
National Alliance of People’s Movements
National Adivasi Alliance
National Fishworkers' Forum
Pakistan-India Peoples' Forum for Peace & Democracy, India Chapter
Point of View
Pothe Ebar Namo Sathi
Project Constitutionalism
People’s Union of Civil Liberties
People’s Union for Democratic Rights
Red Dot Foundation

8. Socialist Party of India
Swathanthra Malayalam Computing
Tandem Research
United Christian Forum
Abha Bhaiya One Billion Rising
Abhinav Anand Student
Akram Parvez Technical Art Director
Ammu Abraham PUCL Maharashtra
Anand Patwardhan Film Maker
Ankur Sarin Faculty, IIM Ahmedabad
Anuradha Kapoor Feminist Activist
Arun PS Policy Researcher
Ashish Ghosh Retired Teacher, University of Delhi
Asis Kumar Das Social Activist
Avani Chokshi Advocate
Basawa Prasad Kunale Advocate
Brijesh Kumar Former Secretary, Ministry of Electronics & Information Technology
Brinda Adige Ananya Mahila Okkutta
Ch Narendra Senior Journalist
Chayanika Shah Queer Feminist Writer and Researcher
Chitra R Educator
Darshan R Software Engineer
Deepak Mukarji Founder Member, United Christian Front
Dr Shakeel Physician
Dr. Mira Shiva Public Health Physician
Dr.Mohan Rao
Former Professor, Centre of Social Medicine and Community Health,
JNU
Dr.Tusharkanti Dey
Community Health Adviser (Retired), All India Institute of Hygiene
& Public Health
Felix Padel Anthropologist and Author
Gautam Bhatia Advocate
Geeta Seshu Free Speech Collective
Gurbir Singh President, Mumbai Press Club

9. Gurshabad Grover Technology and Law Researcher
Harsh Kapoor South Asia Citizens Web
Indira Unninayar Advocate
Irfan Engineer Director, Centre for Study of Society and Secularism
Janaki Srinivasan IIIT-Bangalore
Japleen Pasricha Feminist Activist and Entrepreneur
John Dayal Former President, All India Catholic Union
Kalyani Menon Sen Feminist Learning Partnerships
Kannan Gopinathan Former IAS Officer and Activist
KP Sasi Filmmaker
Kunal Majumdar Committee to Protect Journalists
Leo Saldanha Researcher
Madhu Bhaduri Retired IFS Officer
Madhu HS Chartered Accountant
Maitreyi Krishnan Advocate
Manoj Mitta Journalist and President, FMP
Mary Mathai Former Chemist and Homemaker
Meena Gupta Retired Civil Servant
Megha Garg Gandhi Fellow
Nachiket Udupa Activist
Nadika N Writer and Researcher
Nidhi Agarwal Activist
Nikhil Naren Advocate and Author
Oishik Sircar Associate Professor, Jindal Global Law School
Padmini Ray Murray Design Beku
Pamela Philipose Journalist
Paranjoy Guha Thakurta Journalist and Filmmaker
Prabha Nagaraja TARSHI
Pradeep Esteves Context India
Prajval Shastri Astrophysicist
Prof. Sandeep Kumar
Shukla
Professor, Department of Computer Science and Engineering, IIT
Kanpur
R Ramanujam Professor, Institute of Mathematical Sciences, Chennai

10. Rahim Contractor Civil Engineer
Rajinder Chaudhary
Former Professor, Department of Economics, M. D. University,
Rohtak
Rashi Balachandran Human Centred Designer
Reetika Khera Associate Professor, IIM Ahmedabad
Revati Laul Journalist and Director, FMP
Rishab Bailey Technology and Law Researcher
Ritu Dewan
Director and Professor, Department of Economics, University of
Mumbai
Rupsa Mallik CREA
Salma Francis Vision for Oasis Waves Society (VOWS)
Sandeep Pillai Software Professional
Sandhya Gokhale Forum Against Oppression of Women, Mumbai
Sanjay Kak Filmmaker
Satyavir Singh Former Principal Commissioner, Customs and Central Excise
Saurabh Bhattacharjee
Assistant Professor, West Bengal National University of Juridical
Sciences
Sebastian Poomattam Lawyer and Priest
Sharanya Nayak Activist
Shivaji Sarkar National Union of Journalists
Shreya Munoth Advocate
Soma Basu Journalist and Media Researcher
Sonakshi Yadav Student
Sreechand Tavva Independent Technology Consultant
Srikanth L Cashless Consumer
Srikanth. KS Independent Researcher
Srinivas Kodali Free Software Movement of India
Srinivasan G Software Professional
Subhashis Banerjee Professor, Dept of Computer Science and Engineering, IIT Delhi
Subodh Lal
IPoS (Retd.) Former Deputy Director General, Ministry of
Communications, Government of India
Subodh S Gupta Public Health Professional
Subodh Sharma Professor, Dept of Computer Science and Engineering, IIT Delhi
Sudhanshu Pathania Ph.D Scholar, NALSAR

11. Sujata Patel Distinguished Professor, Savitribai Phule Pune University
Sukla Sen Peace Activist
Sulakshana Nandi Public Health Researcher
Sundar Burra Retired IAS Officer
Sunep Imsong Technologist
Sunila Singh Women's Rights Activist
Swati Punia Lawyer
Tara Murali Architect
Tarunima Prabhakar Project and Research Lead, Tattle Civic Technologies
Teesta Setalvad Citizens for Justice and Peace
Ujjwal Singh Professor, Department of Political Science, University of Delhi
Vandana Mahajan Independent Feminist
Vickram Crishna Independent Researcher
Vinay K Sreenivasa Advocate
Virginia Saldanha Activist
Xavier Dias Editor, Khaan Kaneej Aur Adhikaar
Zafar Iqbal Former Civil Servant, Consultant and Advocate