Kerala High Court on Friday refused to interfere with a deal the state had struck with Sprinklr for tracking the spread patterns of Covid-19 but directed the government to take the informed consent of people while collecting their health data and restrained the US-based company from misusing the information.

The bench of Justices Devan Ramachandran and T.R. Ravi considered a slew of petitions and, in an interim order, directed the state to ensure the data collected was anonymised to maintain absolute privacy.

The court expressed its reservations about the way the deal had been finalised with Sprinklr without a proper legal opinion but said it did not want to interfere at this juncture.

“The state has taken a view that it cannot fight Covid-19 without Sprinklr. So we do not want to interfere now,” Justice Ramachandran observed.

The controversy relates to Kerala’s IT department procuring a smart tool from Sprinklr that helps structure data collated from social media, email and phone calls to track the possible spread patterns of the pandemic and identify vulnerable populations.

The government says the company, owned by a Malayali, had offered the software free at a time when developing it would have taken much longer.

Kerala reported three new Covid-19 cases on Friday, taking the total number to 450, including 116 still in hospital, while a four-month-old baby became the third casualty in the state. The infant passed away at the Government Medical College in Kozhikode. Fifteen patients recovered on Friday.

Earlier this week, a lawyer had approached the court for a directive to stop uploading the data, before several others, including leader of the Opposition Ramesh Chennithala of the Congress and state BJP president K. Surendran, filed independent petitions.

Cyber law lawyer N.S. Nappinai, who appeared for the state government, said the concerns over data privacy were baseless.

The master service agreement and the non-disclosure agreement signed by Sprinklr, she submitted, had a clause that clearly defined the purpose of data collection and data privacy.

Nappinai said the contract was valid for six months and there was no question of the company retaining the data after that.

The government had in a statement earlier on Wednesday informed the court that Sprinklr’s servers had no data now related to Covid cases in the state.

The bench restrained Sprinklr from any kind of commercial exploitation of the data or using the name or the logo of the state government for publicity. It also ordered Sprinklr to return any residual data it might have.

The court expressed reservations about Wednesday’s statement that had argued that there was no need for a legal opinion since it was a zero-cost deal. “We have reservations about the statement filed by the government,” Justice Ramachandran observed.

The judge warned that the cost of a breach would be unimaginable. “Can a head of the department enter into a contract under Article 299? This is throwing up a lot of issues,” the judge said.

Justice Ramachandran, however, said the court was not blaming the government and backed it in its fight against the pandemic.

Chief minister Pinarayi Vijayan later said the court order was significant because it did not agree with the Opposition’s petition against the deal with Sprinklr. “This order is clear that the Opposition’s allegations were wrong. The court did not order to cancel the deal to use the services of Sprinklr,” Vijayan told a media briefing.

Chennithala, however, claimed victory. “The order acknowledged my contentions against misuse of data, using the state logo and name for commercial purposes, and consent before taking people’s data among others,” he said.

The matter would be heard again after three weeks.