The Kerala HC on Friday passed a number of directions to address the issue of data confidentiality over the controversial Sprinklr deal which dealt with processing data of the COVID-19 patients in the state.
The interim order was passed by a bench comprising Justices Devan Ramachandran and T R Ravi after a four-hour long hearing via videoconferencing on Zoom.
The following directions with regards to the Sprinklr deal have been passed:
- Govt of Kerala directed to anonymize all data that have been collected and collated so far, and allow Sprinklr to access data only after such anonymization is completed.
- Sprinklr restrained from committing any act which will be in breach of confidentiality of data entrusted with them by Kerala Govt under the impugned contract.
- Sprinklr shall not directly or indirectly deal with the data entrusted to them by the Kerala Govt in conflict with the confidentiality clauses in the contract, and will return the data as soon as their contractual obligations are over.
- Sprinklr restrained from exploiting directly or indirectly any data entrusted with it for commercial purposes.
- Sprinklr further injuncted from using the name or logo of Government of Kerala for its promotional acts.
- Government has to take informed consent from individuals that their data will be processed by a third-party foreign company
Taking note of the submission that Sprinklr has already transferred all data to the control of the Government, Sprinklr was further directed to immediately delete any secondary or residual data with the company.
The Court also recorded the statement of K Ravindranath, Additional Advocate General, that the State Government would approach the Central Government for availing the services of central agencies to substitute the services of Sprinklr Inc.
The case will be next listed after three weeks.
While expressing reservations over many aspects of the deal, the bench said that it did not want to interfere so as not to upset the COVID-19 control measures adopted by the State.
It stated, “State has taken the view that without Sprinklr they cannot fight COVID-19. So, we do not want to interfere now. That will be interpreted as Court interfering with COVID-19 control measures. We have many serious reservations about statement filed by the State. We dont know how the company was selected and what are their credentials. Normally, we would have interfered. But we do not want to interfere with COVID-19 battle. So, a balance has to be drawn”
The Court also observed its concerns as to why the law department was not consulted before finalizing the Sprinklr deal despite having several legal issues, “What is worrying is that the IT Secretary took a decision without consulting the law department even though many legal issues were involved. Merely because there is an emergency, you cannot create more problems. The cure cannot be worse than the problem”.
Replying to the government’s stand that law department sanction was not necessary as per rules of procedure for purchase orders costing less than Rupees 15,000, Justice Devan Ramachandran remarked:
“If there is a breach, costs will be unimaginable. Can a head of department enter into a contract on his own under Article 299? This is throwing up a lot of legal issues, and no law dept sanction was taken!”.
The bench was hearing a bunch of petitions challenging the IT contract between the Government of Kerala and US-based tech company Sprinklr Inc for analyzing and processing data of COVID-19 patients.
While asking questions to the State, the bench remarked that it only wanted clarifications on points of concern.
“Today’s proceedings are not incriminatory or recriminatory. That is, we are not finding fault with you or blaming you. Court is fully with you in fight against COVID. But we are concerned about data security”.
The State Government roped in the services of Mumbai-based cyber lawyer Advocate N S Nappinai to explain the aspects of the deal to the bench. She submitted that the concerns over data confidentiality are baseless. She highlighted that while the data was under the control of the State Government the Master Service Agreement clauses clearly defined the purpose of data collection and prohibited Sprinklr from using the data for other purposes. It was also pointed that as the agreement was for six months there is no question of retention of data after the period of the agreement.
Clarifying any doubts regarding the foreign jurisdiction clause it was stated that since the data was residing in India the company would be liable for any breach under the Information Technology Act 2000.
When the bench asked about the credentials of Sprinklr, Nappinai referred to the fact that they were providing dashboard services to World Health Organization.
Not satisfied with the that submission, Justice Devan remarked “We are aware of the difference between dashboard services and SaaS. Anybody can do that. A dashboard person cannot operate SaaS”.
The judge also asked if it was necessary to use “Big Data Tools” in Kerala as the data of 5 Lakh persons did not qualify for the same.
Nappania submitted that what is ‘big data’ is a matter of perception.
While quizzing the Additional Advocate General about the credentials of Sprinkrlthe bench asked, “Why were the credentials of Sprinklr not given in Statement?”.
The AAG submitted that in 2018 there was a global conclave, and there were deliberations with Sprinklr since then.
Justice Devan further asked, “Are you saying that in that conclave only Sprinklr was there and no other company. Why this company particularly, were there no other data analytical tool companies in the company?”
AAG says he will file additional statement on that.
The bench also rejected the state stance that there was no time to enter into legal consultation and routine protocols due to the emergency situation.
The bench also took note of the fact that Central Government’s agencies are capable of providing the same services as Sprinklr.
While the Central Govt added that the lack of law department sanction was a matter of concern, ASG P Vijayakumar, said “Surrender of jurisdiction to New York will cause prejudice to the individuals. It is not correct to say that citizens will have remedy in India, said ASG P Vijayakumar”.
