An analysis of privacy policies of public COVID‐19 apps: Evidence from India

• Published date: 01 December 2022
• Author: Sourya Joyee De,Rashmi Shukla
• Date: 01 December 2022
• DOI: http://doi.org/10.1002/pa.2801

PRACTITIONER PAPER

An analysis of privacy policies of public COVID-19 apps:

Evidence from India

Sourya Joyee De

1

| Rashmi Shukla

2

1

IT & Systems, Indian Institute of Management

Raipur, Raipur, Chhattisgarh, India

2

Economic Environment and General

Management, Indian Institute of Management

Raipur, Raipur, Chhattisgarh, India

Correspondence

Sourya Joyee De, IT & Systems, Indian

Institute of Management Raipur, Atal Nagar,

Kurru (Abhanpur), Raipur, Chhattisgarh

493 661, India.

Email: souryajoyee@iimraipur.ac.in

Governments around the world are utilizing their digital ecosystems to respond to

the COVID-19 pandemic. To increase awareness among the beneficiaries about pri-

vacy risks, they must proactively publish the data handling practices for their digital

initiatives through appropriate privacy policies. This study analyzes the privacy poli-

cies of public COVID-support mobile applications (apps) in the context of India. We

found a total of 63 government initiated COVID-support apps in India out of which

38% were found to have an app-specific privacy policy. These policies were analyzed

further to assess their coverage of key principles, such as “Purpose,”“Data

Categories,”and “Data Retention,”derived from legal requirements. We also ana-

lyzed the extent of the specificity of policies with a high coverage. In India, only one

nation-wide app stood out to have both considerable coverage of key principles as

well as a high level of specificity. Other national/regional apps fail to display the

desired levels of coverage and/or specificity. The broader policy recommendations of

this study are that the government should better address privacy concerns regarding

its existing and future disaster management apps as well as its other digital initiatives

by (a) establishing and enforcing a comprehensive legislative framework for data pro-

tection and (b) increasing privacy awareness among the beneficiaries.

KEYWORDS

COVID-19, data protection, digital ecosystem, government digital initiatives, mobile

applications, privacy, privacy policy

1|INTRODUCTION

On March 12, 2020, the World Health Organization (WHO) declared

COVID-19 as a pandemic (WHO, 2020). It stressed that early detec-

tion, testing, putting infected persons under quarantine, social distanc-

ing as well as tracing every contact of infected individuals are

essential to contain the disease transmission (UN News, 2020). Owing

to the highly infectious nature of the disease, contact tracing has been

considered to play a very important role in controlling the spread of

COVID-19. Digital contact tracing is faster, more efficient, and accu-

rate than its highly labor-intensive traditional counterpart

(Rowe, 2020). To this end, countries around the world have deployed

national level mobile applications such as COVIDSafe (Australia),

TraceTogether (Singapore), Aarogya Setu (India), Bluezone (Vietnam),

Corona-Warn-App (Germany), and TousAntiCovid (France). Over time,

many other types of support apps have been released to serve various

needs of the citizens during this pandemic. These include providing

information related to the risk-status of a person, infection status of a

region, number of fatalities and important services like helplines and

teleconsultation, obtaining e-passes for interstate traveling, and vacci-

nation registration and related information. Amidst fresh waves of the

infection and the emergence of more virulent strains of the virus

(Harris & Moss, 2021), the role of these apps remains critical.

To fulfill their functions, COVID-support apps collect and process

a lot of personal data (such as name, phone number, and gender),

some of which are highly sensitive (such as location, health and con-

tact traces). In the absence of appropriate data protection measures,

such data processing activities can lead to a variety of privacy harms

Received: 15 April 2021 Revised: 23 July 2021 Accepted: 24 November 2021

DOI: 10.1002/pa.2801

J Public Affairs. 2022;22(Suppl. 1):e2801. wileyonlinelibrary.com/journal/pa © 2021 John Wiley & Sons Ltd. 1of15

https://doi.org/10.1002/pa.2801