A judgment of the Orissa High Court on 16.07.2020 has brought into focus the challenges involved in formulating a balanced privacy policy in relation to the identities of COVID-19 patients. The tension between confidentiality of personal medical information and disclosure of identities for protecting public health is not easy to resolve. It is vital to avoid the pitfalls of extreme inclinations and the judgement of the Orissa High Court reflects this understanding. The petitioner had prayed that the government should be prohibited from disclosing the identity of COVID-19 patients without any exception. The court applied the triple test prescribed in the case of K.S. Puttaswamy v Union of India to assess if the provisions in the Odisha COVID-19 Regulations, 2020 facilitating the identity disclosure of COVID-19 patients constitute constitutionally permissible restrictions on the right to privacy. The court ruled in favour of the state and refused to issue an absolute prohibition as requested by the petitioner. While the court found the framework of disclosure under the regulations to be reasonable, it missed a clear opportunity to establish a threshold of proportionality in relation to specific disclosures by the state.
The myth of an elite right
In 2015, during the hearing of Puttaswamy case, the Attorney General had sought to impress upon the court that privacy is essentially an elitist concern. He stressed that it is only the upper middle class and upper class in India which is concerned about the right to privacy and that for the millions of poor people in India, existential concerns are of greater importance. While the argument has been rebutted at the thematic level by the court and also by others, the COVID-19 pandemic has exposed the sheer absurdity of this proposition.
The stigma and fear associated with COVID-19 has resulted in numerous instances of discrimination, abuse and ostracization of those who have been infected with the disease and also their family members. There have been fights in villages and there has been sickening discrimination in the big cities. Beyond theoretical abstractions, the significance of privacy and the consequences of its breach have acquired tangible physical ramifications. The stigmatization of the COVID-19 disease has transformed the discourse of privacy from descriptive platitudes to the lived experiences of the society across all strata.
Central Government Advisory
Taking cognizance of the privacy concerns, the Ministry of Health Family Welfare of the Government of India has issued an advisory for citizens urging them to respect and protect the privacy of COVID-19 patients. It is important to note that the ‘advisory’ exclusively talks about the conduct ‘expected’ from citizens and does not create any kind of enforceable obligation. It also does not lay down any kind of guidelines for central government employees dealing with patient information.
Odisha COVID-19 Regulations, 2020
As ‘health’ is in the State list, the primary responsibility of framing regulation for handling of patient data is in the domain of state governments.
The Odisha COVID-19 Regulations 2020 notified on 03.04.2020 very categorically engages with the issue of privacy and prescribes a highly limited channel of communication for disclosure of any information related to COVID-19 patients. It singularly identifies a Medical Superintendent or a person duly authorized by her to communicate with the media on issues pertaining to COVID-19 patients. They are required to maintain utmost confidentiality about details of patients including their name, address and other personal information. Disclosure may be made with prior approval of the State Government only on the specified grounds of public health and safety.
Ruling of the High Court
The Orissa High Court applied the triple test laid down in the Puttaswamy judgment to assess the constitutional permissibility of the Odisha government’s regulation. In broad terms, the test requires three independent but interconnected conditions to be satisfied. Firstly, there must be a law that requires disclosure of information under certain circumstances, which means that in the absence of such law, the act of disclosure would be illegal. Secondly, such law should be for the purpose of achieving a legitimate aim of the state. The term ‘legitimate’ is significance as it opens the door for scrutinizing the constitutional permissibility of the state’s objectives. Thirdly, the degree of interference should be proportionate to the need for such interference. Thus, the non-interference with of privacy is the general rule and interference the exception. The triple test exists for the purpose of determining the limits within which that exception must function where the right to privacy cannot be claimed.
The court found the Odisha government’s regulations to be reasonable and refused to issue a writ of mandamusdirecting a blanket ban on the government from disclosing identities of COVID-19 patients. The court stressed on the need to balance the right to privacy with the public interest to control the pandemic. He noted that the regulations do not permit indiscriminate disclosure of identities and the regulations and thus cannot be struck down.
Significant Concerns
The judgement does not address two critical issues. Firstly, as alleged by the petitioner and as admitted by the state government, the Bhubaneswar Municipal Corporation disclosed the identity of a COVID-19 patient on 02.04.2020. The government claimed that it was done solely for the purpose of facilitating contact tracing and to safeguard the public. The regulation in force on 02.04.2020 was the Odisha COVID-19 Regulations notified on 18.03.2020 which mandated that the personal details of a COVID-19 patient cannot be disclosed under any circumstances. The regulations notified on 18.03.2020 did not have the exceptions of public health and safety which were included in the regulations notified on 03.04.2020. Thus, the disclosure by the Bhubaneswar Municipal Corporation on 02.04.2020 was not authorized by the applicable law on the date. There is no serious scrutiny of this lapse and no assessment of the need for disclosure in this particular case when the identities have not been revealed in other cases.
Secondly, the government claimed in the court that there should be no bar on disclosure of personal details of frontline COVID warriors for the purpose of honoring them during their funeral. While this may not be objectionable, the grounds of public health and safety do not apply in this situation. Nothing stops the government from providing for this exception in its regulations. However, until it does so, the disclosure cannot be said to be sanctioned by law as mandated by the Puttaswamy judgement. Sentimentality of an action cannot substitute lack of legality.
The fact that the court failed to address these issues in an otherwise balanced judgement indicates the challenges involved in positioning the priorities of privacy amidst a pandemic which is constantly evolving. Of greater concern will be the response of courts when specific acts of disclosure under the regulations are challenged for being disproportionate. By not examining if the disclosure by Bhubaneswar Municipal Corporation was proportional, the court has missed the chance of establishing a clear threshold in this respect.
