Recently, the Kerala High Court in Balu Gopalakrishnan v. State of Kerala^[1], had an opportunity to adjudicate on issues surrounding data anonymization and transfer of sensitive health data of COVID-19 patients outside India. These proceedings were initiated by the petitioner due to concerns arising out of an agreement entered into between the State Government of Kerala (‘Kerala State’) with a US based company Sprinklr Inc. (‘Sprinklr’), which involved sharing and transfer of Covid-19 patient data (sensitive personal information) outside India, for analytical purposes, for better handling of the pandemic.

After hearing contentions of both the sides, the Kerala High Court issued an interim Order dated April 24, 2020 mandating (i) Kerala State to anonymize all sensitive data prior to sharing it with Sprinklr; (ii) Kerala State to ensure that adequate consent in accordance with applicable law is taken from the relevant data subjects; (iii) Sprinklr to preserve confidentiality of patient data as per the terms of the contract and not to share it with any third party; and (iv) Sprinklr to return the data to Kerala State once the contract terminates; and (iv) Sprinkler to not advertise or represent to any third party that it has access to any data regarding COVID – 19 patients.

[1] WP(C)9498/2020.