THREAD: We filed RTIs on behalf of @no2uid asking the Ministry of Health and Family Welfare questions about how your personal data will be protected while you're using CO-WIN, the COVID-19 vaccination registration platform.

We got answers... kind of. Here's the new info.

1/n

Just like with Aarogya Setu, many Indians are worried that about the potential CO-WIN has to leak your data or threaten your privacy in the name of dealing with a pandemic. So, we asked the MOHFW some questions about data protection under the Right to Information Act.
2/n

In the responses we received, MOHFW said that it cannot provide us with a privacy policy on CO-WIN (?!).

Thankfully it was clarified that Aadhaar is not mandatory for registration on Aarogya Setu or CO-WIN, and that physical vaccine certificates will be provided to everyone.
3/n

The data it says it will collect will be your name, gender, date of birth, photo ID, and number.

National, State, and District level admins will have access to use the app, but there is not much further clarity on this point.

But most importantly...
4/n

The responses (or rather lack of them) related to your data privacy and protection are completely vague. We received no clear answers on which Ministries/Depts will have access to your personal data, the permissions provided, etc. This is a failure in terms of transparency.
5/n

THREAD: Almost a year into the launch of Aarogya Setu, there is still little to no public data on its benefits. Yet, many of its flaws are well documented. Now it's going to be used for vaccine rollouts despite meager progress in public

Experts have been warning us about Aarogya Setu's capacity for surveillance. Post integration with COWIN, it will likely become a permanent part of our health data landscape. We've written to the NIC with key concerns, because here's what we've learnt in 1 year:
2/n

To justify violation of privacy, necessity and proportionality have to be proven. Aarogya Setu has disregarded these principles - we know because we analysed its Data Protocol, which MeitY released after public pressure. It fails to satisfy the basic threshold of legality.
3/n

A lack of transparency has pervaded the ecosystem. RTIs on Aarogya Setu failed to receive adequate answers. In fact, we had to send a legal notice because CIC refused to let RTI activist Saurav Das attend his own show cause hearing regarding critical info about Aarogya Setu.
4/n

Issues have been raised about the non open-source nature of the app. Even when the source code was released, it was the code for an earlier version of the app that was made available. The server-side code of the app was not available at all.
5/n

It's done: The IT Rules, 2021, are officially in play. We cannot stress this enough - this fundamentally changes the Indian internet. Please RT this thread on the Rules and how they bring government control over digital media like never before.
https://t.co/S7K9wnIkvI
1/n

IT Rules affect social media, OTT, and news platforms. The latter 2 have been brought under the Rules for the first time. The Rules make platforms legally liable for not complying with government regulation, hence making user experience fall in line with the same.
2/n

Social media platforms with 50 lakh+ users will now be regulated as Significant Social Media Intermediaries (SSMIs) with different obligations than Social Media Intermediaries (SMIs). Government discretion in compliance can lead to discrimination which disempowers small SMIs.
3/n

SMIs are now more answerable to law enforcement, with lesser breathing space around compliance deadlines.

Content takedown after receiving orders: 36hrs
Providing info to law enforcement: 72hrs
Requests to remove sexual content: 24hrs
Redressal by grievance officers: 15 days
4/n

The data retention period for SMIs has been doubled to 6 months for investigative purposes. Data will be preserved even if accounts are deleted. We are challenging this in the Supreme Court because such data retention in the absence of a data protection law is dangerous.
5/n