HYDERABAD: It has come to the fore that Indian users of ‘T Covid-19’, Telangana’s official app for Coronavirus, do not have rights over deletion of personal data, withdrawal of consent, rectifying data and so on, all of which are available for residents of European countries that come under the ambit of General Data Protection Regulation (GDPR).
Officials said that this was because India still does not have a proper data protection law. T Covid-19’s privacy policy statement, which has been drafted by one of the app’s collaborators Quantela, said that residents of the European Economic Area (EEA) — an international agreement that extends certain facilities of the European Union (EU) to non- EU countries — were liable to certain rights, thanks to the GDPR of the European Union.
According to the GDPR, organisations that offer goods and services in the EU or the EEA must include rights such as ‘withdrawal of consent’, where one can withdraw his or her consent in places where consent is the only legal basis. Users from the EEA also have the right to access and obtain a copy of the personal information that the T Covid-19 possesses, right to update personal information, right to delete it, to restrict the use of it, to transfer information to a third party, to object to its use, and finally, to complain to an appropriate authority if there is any grievance in the way Quantela collects, uses or shares data.
What about Indians?
“Indian citizens cannot request for their data to be rectified, or claim the ‘right to be forgotten’ as the country’s Data Protection Bill is still pending in Parliament. Their data, however, is secured and confidential,” IT Secretary Jayesh Ranjan told Express. The Personal Data Protection Bill was introduced in the Lok Sabha in December 2019 and was referred to the Standing Committee to examine it in detail. However, security researchers are not convinced by the reasoning. Independent security researcher Srinivas Kodali said, “The fact that European citizens get more rights than Indian citizens is appalling. The absence of a data protection law doesn’t mean they can’t give us the basic protection that is being offered to others.”