The Centre has mandated that all public and private-sector employees use the contact-tracing app Aarogya Setu as part of the efforts to fight the Covid-19 pandemic, brushing away concerns related to data protection, privacy and the absence of consent.

The government-backed app, a Bluetooth and GPS-based system developed by the country’s National Informatics Centre, was launched last month. It alerts users who may have come in contact with people later found to be positive for Covid-19 or deemed to be at high risk.

“Use of Aarogya Setu shall be made mandatory for all employees, both private and public,” a home ministry notification said late on Friday.

It will be the responsibility of the heads of companies and organisations “to ensure 100 per cent coverage of this app among the employees”, it said.

In containment zones, the order goes beyond government and private employees and covers everyone. “The local authority shall ensure 100 per cent coverage of Aarogya Setu app among the residents of the containment zone,” the order said.

Officials at the Union technology ministry and a lawyer who had framed the privacy policy for Aarogya Setu said the app needs to be on at least 200 million phones for it to be effective in the country of 1.3 billion people.

The app has been downloaded around 83 million times in total in a country with a smartphone user base of about 500 million, according to the technology ministry.

However, the app’s compulsory use is raising concerns among privacy advocates, who say it is unclear how the data will be used and who stress that India lacks privacy laws to govern the app.

“Such a move should be backed by a dedicated law that provides strong data protection cover and is under the oversight of an independent body,” said Udbhav Tiwari, public policy adviser for Internet company Mozilla.

Congress leader Rahul Gandhi has described the app as a “sophisticated surveillance system”, expressing fear it might be used to track citizens without their consent.

AIMIM chief and MP Asaduddin Owaisi has aired similar apprehensions.

New Delhi says the app will not infringe on privacy as all the data are collected anonymously.

The app can help authorities identify virus hotspots and better target health efforts, the tech ministry had told Reuters in late April, adding that information on the app was used “only for administering necessary medical interventions”.

Aarogya Setu app (Pic: Government of Uttar Pradesh)

Information and broadcasting minister Prakash Javadekar on Saturday tried to allay the privacy concerns.

“The Aarogya Setu app is one of the best scientific means to tackle the pandemic. There should be no concern over privacy-related issues,” he said. “Actually, there is no (private) information. If you have a cough, cold or (have) tested positive, then only you have to fill up the information.”

Javadekar asserted the app would continue to be used for a year or two till the country had won the battle against Covid-19. “The lockdown will be over soon but this app will be a permanent help till we win the war against the pandemic,” he said.

Javadekar was responding primarily to Owaisi, who had tweeted: “The central govt is fighting Covid-19 with taali, thaali, bijli & a very shady app. New Delhi’s Sultans have issued a farmaan that people have no choice in the matter. They MUST share their private data with govt (& whoever the govt wants?)”

Rahul tweeted: “The Aarogya Setu app is a sophisticated surveillance system, outsourced to a private operator, with no institutional oversight -- raising serious data security & privacy concerns. Technology can help keep us safe; but fear must not be leveraged to track citizens without their consent.”

Rahul’s tweet attracted more than 15,000 likes within the first 30 minutes, reflecting the extent of popular concern about the app.

The Congress had earlier promised to come up with a detailed response on Sunday to the government's move to make the app mandatory for public and private-sector employees who resume work after May 3.

Delhi Metro has indicated that those without the app would not be allowed entry.

Aarogya Setu asks users their name, age, health details, profession and GPS location. Some reports have suggested these details will enable the government to pinpoint a user's address and location and that the entire data will be recorded on a central cloud server, which is not required for contact-tracing.

An article in the Congress-backed National Herald has quoted a person named Anivar Aravind, who had purportedly analysed all contact-tracing apps, as saying: “Aarogya Setu is nothing but a surveillance app. In the name of contact-tracing, Aarogya Setu collects registration details, GPS locations, nearby device data and this can be used to identify your social graph. The app collects too much information on registration and none of this data is required for contact-tracing.”