New protocol tightens data practices for Indian contact tracing app

Any user of India's Aaorgya Setu contact tracing app can now request deletion of the data they've entered according to the Aaorgya Seta Emergency Data Access and Knowledge Sharing Protocol, 2020, which specifies the definition, collection, processing, and storage of the data the app collects. The protocol will be applicable for the next six months, and also increases the amount of time the data will be retained from 60 days to 180. IT ministry officials said the protocol was needed after a French hacker found vulnerabilities in the app that made it possible to access the details of any of its millions of its users within a 10km radius, among other criticisms. The protocol also allows data to be shared with central and state governments in "de-identified" form, but requires the National Informatics Centre to maintain a list of agencies with which it's been shared, the people who have access, and the categories of data.

Writer:  Amrita Madhukalya
Publication: Hindustan Times