The Covid-19 pandemic has caught all of us unawares. While the Governments and medical agencies are doing their best to contain the pandemic, the situation has worsened in the last few days due to the multiplier effect by the coronavirus passing on from infected persons to other persons.

In this backdrop, it has been observed that lists of home quarantined people and infected patients are also being disseminated in public by certain Government authorities or municipal corporations clearly identifying such persons along with their personal details like address, mobile number, quarantine date etc. These cases of infected persons or such lists of patients/ suspected patients are further being circulated on social media accounts and groups like WhatsApp, Facebook etc. and has led to revealing of the identity of patients and making them “viral”. This naming and shaming at the hands of society of the suspected or infected person is proving to be a hindrance in containing the pandemic, i.e. people are associating stigma with this virus. Due to this, it has surfaced that many persons who have tested positive for coronavirus have refused to be admitted to hospital for further treatment.

Circulation of personally identifiable information and the resultant naming and shaming is highly unfortunate. Not only does this behaviour lead to blatant and unjustified discrimination, it also reeks of major data protection lapses and serious ethical concerns. Health data is considered to be sensitive personal data primarily because of (a) the risk of significant harm that may be caused to the individual upon mishandling/ misuse of such data; (b) the expectation of confidentiality attached to such data; or (c) a significant and apparent class of individuals may suffer significant harm from the processing of such category of personal data. Thus, a higher degree of care is required to be employed when dealing which such data.

While it is appreciated that the authorities have a requirement to prepare lists that reflect the statistics related to suspected and detected cases of covid-19 so as to monitor the situation and also make necessary medical arrangements, supplanting such lists with personal data of individuals in in gross violation of personal data protection and confidentiality norms.

The rationale or purpose of drawing up such lists should be borne in mind and accordingly, these lists should omit any details like name, phone number, address etc. For example, instead of giving personal details, name of the locality, society etc. where the patient resides can be released for public awareness. Moreover, statistics can be maintained by merely keeping a count of patients while assigning them some sort of pseudonymous identities. These are some solutions which are easy to incorporate in the current scenario.

Let us all not forget that once this pandemic is at rest, we will resume our normal lives and hopefully many of these patients would have been completely cured. At such a time, if an employer were to discriminate against them for having had contracted coronavirus or a neighbour/ grocery store were to refuse to associate with/ cater to such persons, life would be very difficult for them. They may also witness a case where relatives, acquaintances, friends would subject them to ridicule and shun them away, thus leaving them unable to lead normal lives.

We must understand that the COVID-19 pandemic is unprecedented. The provisions of current legislation of the Information Technology Act, 2000 and Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 are not properly equipped to deal with the current situation.  In these circumstances, absence of a legislation specifically focussing on personal data protection (the Personal Data Protection Bill, 2019) is being felt at this hour for respecting individual privacy.

*Tripti Dhar, Partner and Gajendra Maheshwari, Managing Partner at Reina Legal