The Kerala High Court on Tuesday took a critical view of the government’s argument regarding Sprinklr, which has been at the centre of controversy over the past few weeks for an app used by the state government. The app by US-based Sprinklr company stores and processes information regarding COVID-19 patients and those under quarantine. Opposition Leader Ramesh Chennithala had raised concerns regarding privacy and accused the government of giving away citizens’ data to a foreign firm.
When the state government counsel argued that the data collected was not sensitive, a Bench of Justices Devan Ramachandran and TR Ravi said, “That is a dangerous submission. The medical data is certainly covered... (as sensitive data).”
“We do not want you to upload data unless you can tell us that data is confidential from [Sprinklr] also. Cannot accept the submission that the data collected is not sensitive. If Kerala government thinks the information is not sensitive, something is amiss,” the Bench reportedly observed.
The court was hearing a petition moved by Balu Gopalakrishnan, a Kerala-based lawyer. The petitioner has questioned why the government chose a private company over national entities like C-DIT and NIC.
While the government has maintained that data is owned by the state, Congress leader Chennithala had termed it a breach of citizens' right to privacy since the data was stored in the server of a foreign company.
The state’s counsel argued that the data was now being handled by The Centre for Development of Imaging Technology(C-Dit) and its server account with Amazon, an entity approved by the government. However, the data was initially stored in the company’s Amazon web server in Mumbai.
The Bench stated that it was concerned about data remaining confidential during the pandemic. Lauding the state for its handling of the COVID-19 crisis, it said, “We are only concerned with data remaining confidential. How will you guarantee us that? Every day you are putting in information... Why do you require a SAAS (Software as a Service), when the numbers are so low?”
Software as a service, a component of cloud computing, is a distribution model for software wherein data is hosted on third-party applications. This data is available to users on-demand.
Additional Advocate General K K Ravindranath informed the court that information relating to 80 lakh people was being screened by the government for COVID-19.
Dispute jurisdiction New York
The Kerala High Court sought clarification on the dispute jurisdiction between Kerala and Sprinklr being the state of New York in the USA.
The Bench said, “We are not against you at this time. But we are asking to clarify some things. The responsibility of data confidentiality is on the state government. We do not know why the state of Kerala chose New York as the jurisdiction. A citizen is not privy to the contract between the Kerala government and the company. If that company misuses the data, the state government is responsible? If there is a breach tomorrow, the state government will have to go to New York.”
The Kerala government was directed to provide a clarification by April 24, when the case is heard next.
Kerala’s Information Technology Secretary M Sivasankar, on Saturday said that he had taken the call to ink the deal with Sprinklr.
“No one else has any responsibility in this, I took the decision and I signed the purchase order, that is my call,” Sivasankar said to the media.
He also said that he did not find it necessary to take legal opinion before entering into a contract with Sprinklr company.
“If that is wrong, let that be checked. A case regarding this is in the court anyways, let a decision come,” he said.
Referring to this statement made by the IT Secretary, Justice Ravi said, "We need an explanation on why the contract was not referred to the law department?".
Following allegations by the opposition, the Information Technology Department of the Kerala government released agreements signed with the company. However, the two letters of affirmation between the company and the government had changed significantly in it’s tone.
While a letter on April 11 gave rights to Sprinklr during the term of this Agreement a royalty-free, non-exclusive, non- transferable, worldwide right and license: (i) to copy, cache, store, reproduce, perform, display, use, distribute, transmit and generally make available the Customer Content in electronic form via the Internet, this paragraph was completely left out in the April 12 letter.