Kerala High Court on Friday hurled a battery of posers to the government on why Sprinklr Inc. was chosen, without even looking for other public or private entities within the country that could have done the same job with equal efficiency, what prompted Kerala's IT secretary to enter into such a deal bypassing the Law Department and what negotiations were held to address concerns of a data breach.
Nonetheless, the two-judge High Court bench of Justice Devan Ramachandran and Justice R Ravi stopped short of asking the Kerala Government to call off the deal with Sprinklr. “We are not here to suggest alternatives. That is for Kerala government to decide,” Justice Ramachandran said.
The Court, however, passed certain directions to ensure that public data was not misused. One, it asked the government to anonymise all the data that had been collected. This directive is a follow up of the Centre's submission, through the additional solicitor general, that data could be shared only after it was anonymised.
Kerala's counsel said it was viable. In the statement submitted by the Kerala Government on April 23 also it was said that the data was handed over in encrypted form.
It was submitted by both the government and Sprinklr's counsels that three other directions - that Sprinklr should be restrained from committing any act that will lead to a breach of confidentiality, that the company should not directly or even indirectly deal with the data handed over by the Kerala government and also that Sprinklr should be prohibited from using the data for commercial purposes - were already complied with.
The government said the data had been transferred to C-DIT's Amazon Web Server in Mumbai. Kerala's counsel said the data was secure in a storage medium that was acceptable under central government regulations.
Sprinklr has also been asked to desist from using the name or logo of Kerala Government in its promotional activities. Earlier, Sprinklr had come out with a promotional that hinted that it was behind Kerala's successful COVID-19 containment model. The promotional also had IT secretary M Shivshankar speaking about the problems Kerala was facing. His bit was subsequently taken out of the ad.
Informed consent
The Court has also asked Kerala Government to get the informed consent of the public before uploading the data. The Court wants people to know that their details would be processed by a third party company based in America.
Justice Ramachandran observed that there was one complaint about the government keeping the public in the dark about the use of their data. An individual had complained that if he had known that the data would be shared with a third party he would not have passed on information about his daughter.
The government but took the stand that there was nothing wrong in not informing individuals that their information would be processed by a third party. “There is no need to disclose that fact,” Kerala's counsel said.
The court then asked whether an individual could refuse to offer personal details on the ground that it would be processed by a non-government third party. The Kerala counsel said it was possible. But she qualified this by saying that the government had not given away any data for anyone to refuse to give any information.
Data privacy
Nonetheless, she conceded that Sprinklr had access to the data for a short period for analysing and processing. “How can you be sure that no breach has taken place as of today,” Justice Ramachandran asked. She said the data was stored in the Amazon Web Services cloud of government-run C-DIT.
“The statement by the government that a standard contract was accepted is worrying us,” he said. The Court wanted to know whether any discussions were held to address the concerns of Kerala. When the Kerala counsel said it had happened, Justice Ramachandran confronted her with the government's statement that it did not have the time to follow established norms before taking Sprinklr on board. “Even a day's delay would have been fatal,” the government statement said.
IT secretary's haste
The Court also expressed its disapproval of the IT secretary's action. “Merely because there is an emergency, you cannot create more problems. The cure cannot be worse than the problem,” Justice Ramachandran said. “If there is a breach, costs will be unimaginable. Can a Head of the Department enter into a contract on his own under Article 299,” he said.
Pinarayi Vijayan on the court's order
Reacting to the directive, Chief Minister Pinarayi Vijayan said the court has not ordered to scrap the deal. "So the government would go ahead with it.
The court has not heeded the opposition's demand to scrap the agreement," he said in Thiruvananthapuram on Friday.
Vijayan said he could make a detailed comment only after getting the court order.
