Aarogya Setu data safe, stored for limited period: IT Minister Ravi Shankar Prasad

Responding to several concerns over India’s coronavirus contact tracing app Aarogya Setu, Communications and Information Technology Minister Ravi Shankar Prasad said that the app is completely safe.

The minister stated that all the data stored in the servers is secure and will be deleted once the COVID-19 crisis is over. “This app is completely safe and secure—data is secured for a very limited purpose and for a very limited period of time,” Prasad said as per a report by The Economic Times.

He further added that the data is encrypted and there was no need for panic over its safety. Prasad insisted that the app’s only purpose is to track the coronavirus outbreak and protect the people.

“This helps avoid your contact with a person who is inflicted and the whole purpose of this app is to protect you,” Prasad said.

A government official quoted in the report said that most of the data would be deleted in 30 days and information pertaining to COVID-positive people would be deleted in 60 days. The official reiterated Prasad’s statement of deleting all data once the coronavirus crisis was over. 

The same can be read in the privacy policy of the app (read here) that says:

All personal information collected under Clauses 1(b), 1(c) and 1(d) will be retained on the mobile device for a period of 30 days from the date of collection after which, if it has not already been uploaded to the Server, will be purged from the App. All information collected under Clauses 1(b), 1(c) and 1(d) and uploaded to the Server will, to the extent that such information relates to people who have not tested positive for COVID-19, will be purged from the Server 45 days after being uploaded. All information collected under Clauses 1(b), 1(c) and 1(d) of persons who have tested positive for COVID-19 will be purged from the Server 60 days after such persons have been declared cured of COVID-19.

“Let us make this absolutely clear that the data is not shared with anyone. All data is anonymised, your personal information is encrypted. It creates an anonymous device ID. All future interactions happen with the anonymised device id, and then for most people data remains on the phone only,” the official said.

Security researcher and ethical hacker Elliot Alderson raised concerns over the app after Rahul Gandhi called Aarogya Setu a sophisticated surveillance tool. Aarogya Setu’s team denied any such concerns which put the privacy of 90 million Indians at risk.

The government recently made it mandatory for all employees (including the private sector) to download the COVID-19 contact tracing app while holding heads of respective organisations liable for any negligence.