Devan Ramachandran, J.1. These writ petitions, filed by the petitioners ad vindictam publicam, calls into focus, inter alia along with other issues, certain confidentiality concerns quad hoc a contract (hereinafter “the contract” or “impugned contract” for short) entered into by the Government of Kerala with a Company by name Sprinklr Inc. (hereinafter called Sprinklr for convenience) – which is stated to be a “modern digital communication infrastructure” provider – to make available an online digital software/platform to process and analyse data with regard to patients and those vulnerable and susceptible to the Corona Virus Disease - 2019 (COVID-19 hereinafter) in the State of Kerala.2. Prefatorily, data confidentiality is, in its ultimate sense, about protecting data from unlawful, unauthorised as also from unintentional access and disclosure.3. Hence, the authorisations to view, share and use data forms the hypostasis of all confidentiality requirements.4. Imperative criteria as to whom the data can be disclosed; whether there are sufficient safeguards to ensure that the data remains confidential; how it is to be dealt with after processing/analysis and its conditions, thus become vitally important.5. The corner-stone of managing data confidentiality is, to a large extent, determined by the control over access to it and the modus and the manner in which it is dealt with.6. The afore observations have been made by us because the petitioners primarily allege that the contract in question has little or no safeguards against the commercial and unauthorised exploitation of the data entrusted to Sprinklr for processing by the Government of Kerala. The petitioners also project an apprehension – based on certain terms of the contract, a copy of which has been appended to some of these writ petitions as an exhibit – that, in the event of breach of data confidentiality or any other dispute, the Government of Kerala will obtain no legal recourse through any courts in Kerala – or for that matter in India – since it postulates that the jurisdiction with respect to such is exclusively vested in the courts in New York, United States of America.7. We have heard the learned counsel for the petitioners in the respective writ petitions; learned Additional Advocate General, Shri K.K.Ravindranath and Smt.Nappinai N.S. learned counsel for the Government of Kerala; and Shri P.Vijayakumar, learned Assistant Solicitor General of India, along with Shri Jayasankar V.Nair, appearing for the Union of India.8. The learned Additional Advocate General Shri Ravindranath, assisted by Shri V.Manu, Senior Government Pleader, commenced his submissions by informing us that a statement has been filed on behalf of the State of Kerala explaining the background, circumstances and reasons why the contract had to be entered into. He further asserted that since the “worst case projections” with respect to the spread of COVID-19, coupled with “the possibility of a sudden spike in cases”, led the Government to anticipate that the tracking and tracing of over 80 lakhs citizens would be necessary, it was felt essential that the assistance of a “scalable Information Technology system” was to be commissioned. He explained that the “Government owned/controlled entities like CDIT and Information Kerala Mission are not technically equipped to manage large volume of data” and that since “there are no viable alternatives within the Government frame works”, it was forced to requisition the assistance of Sprinklr, which “showed interest in working with the Government to tackle the issue”.9. He added to the above, saying that the Government had adequate inputs with themselves as regards the credentials and capacity of Sprinklr to take on this challenge; and further that they have promised to offer their services free and gratuitously to the Government for a period of six months.10. Smt.N.S.Nappinai, learned counsel on behalf of the IT Department of the State of Kerala, then proceeded to submit that the Government firmly believes that confidentiality of the data of the citizens is guaranteed as per the terms of the contract and further that the Government takes full responsibility for its protection. She made elaborate submissions before us, edificed on technical norms and inputs, as to how the data is protected and maintaining that the State is firm in their assurance that there has been and could never have been breach of data in the past. She, however, concedes that an audit with respect to such issues are available with the Government only for the period from 4.4.2020 and that the balance audit, with respect to the period commencing from the date of contract till then, is yet to be completed. She, nevertheless, asserts that the available protectional systems on the Amazon Cloud Service makes it impossible for Sprinklr or anyone else to breach confidentiality or to deal with the data surreptitiously or maliciously. Smt.Nappinai concluded by affirming that Sprinklr is not in possession of any data at present and that they have re-transmitted all such to the Government of Kerala, which is presently in its full custody and control.11. On the issue of jurisdiction for dispute resolution as per the contract being in the Courts of New York, the learned Additional Advocate General ShriK.K.Ravindranath, as also Smt.Nappinai, submitted that this was part of the “standard form contract” of Sprinklr, which the Government had to accept on account of the urgency and the extraordinary circumstances faced by them; but that “the data resides in India” and therefore, that the breach of its confidentiality would expose Sprinklr to action in India, both at the hands of individual citizens and the State. They, however, expressly admitted that the “mandate of the New York jurisdiction” binds the Government of Kerala with respect to the breach of the terms of the contract.12. In response, the various counsel appearing for the petitioners in these writ petitions, as also for persons who have made applications for impleadment in them, argued that the impugned contract has been entered into by the Government of Kerala without proper thought and without adverting to the applicable Rules of Procedure and established protocols; and further that it is in conflict with the mandate of Article 299 (1) of the Constitution of India. They further submitted – with great vehemence – that the Government of Kerala, by ceding to the jurisdiction of courts outside India, has rendered recourse to law, both for the citizens and itself, illusory in the event of breach of the contract by Sprinklr. They thus accuse that the contract has been entered into with questionable and confutative intent and that it is vitiated by corruption; consequently seeking investigation into it by high powered agencies.13. Of course, various allegations on facts have also been impelled in support of the prayers sought by the petitioners.14. The learned Assistant Solicitor General of India, Shri P.Vijayakumar, assisted by Shri Jaisankar V. Nair, learned Central Government Counsel, submitted that a statement on behalf of the Government of India has been placed on record and that their singular concern is that the confidentiality of the data of the citizens of the State of Kerala be never breached. He predicated that the Government of Kerala ought to have ensured, at the time when the contract was entered into, that the citizens had recourse to proper legal remedy through Courts in Kerala and therefore, that the acceptance of the standard form of contract, allowing jurisdiction only to the Courts in New York, is not acceptable to the Government of India. He then went on to submit that the original contract between the Government of Kerala and Sprinklr, which is called the “Master Services Agreement” (hereinafter referred to as the MSA), did not have sufficient confidentiality clauses and that agreements to supplement it were entered into by the parties only subsequently. He thus submits that the integrity of the data which has already been accessed by Sprinklr cannot be now guaranteed and axiomatically that the factum of the agreement admittedly not having been vetted by the Law Department assumes great significance.15. The learned Assistant Solicitor General added to the above by saying that the terms of the contract are critical, but that it does not inspire confidence since the credentials and the capacity of Sprinklr does not appear to have been – at least going by the statement filed by the State of Kerala before this Court now – properly assessed, verified or satisfied. He further submitted that there was no requirement for the State of Kerala to have gone in search of entities outside India when there are several Companies in India equally or more competent; and that had they approached the Government of India, they would have been able to give the same or better support to them, as are now been stated to be offered by Sprinklr, through the National Informatics Centre (NIC).16. The learned Assistant Solicitor General then appraised us that the Ministry of Electronics and Information Technology (MeitY) is firm in their resolve that sensitive personal data of Indian citizens should always be in the control of the State and should necessarily be stored in the State Data Centres or in the National Data Centres. He then said that the Government of Kerala has to ensure that the data is collected only for the purposes for which it is required; that they should anonymise all such before it is shared with any third party service providers for a due cause; and that such personal data should be confirmed to have been purged after completion of the purposes for which it has been collected.17. We must record at this juncture that after we heard the learned Assistant Solicitor General of India on the afore lines, the learned Additional Advocate General conceded that there is no impediment in the Government of Kerala approaching the Government of India for obtaining the assistance of NIC and that they will consider making such a request in due course, so that a viable alternative can be obtained to substitute the services of Sprinklr, particularly after the period of the contract is over. He added that this is also because the services of Sprinklr is free only for six months from the date of contract and the Government of Kerala will certainly have to search alternatives at that point of time.18. As regards the submissions of the learned Assistant Solicitor General regarding anonymisation of the data, the learned Additional Advocate General confirmed that the Government of Kerala will only provide anonymised data to Sprinklr and that all the available data, including the ones to be now obtained, will be so done before any further access is given.19. We have carefully examined the pleadings and materials on record – in particular the statements filed by the Government of India and the Government of Kerala in response to the averments in W.P.(C)No. 84/2020.20. At the outset, we must say that we are not willing, at this stage, to speak affirmatively on the various allegations made by the petitioners, since we are of the view that it will require a comprehensive assessment of all factors, for which the respondents certainly must obtain necessary opportunity to complete their pleadings.21. Further, since, as we have already noticed above, the Government of Kerala adopts the unequivocal position that they cannot continue the fight against COVID-19 without the assistance of the software provided by Sprinklr, we do not think it will be prudent on our part, when our country and the whole world is fighting the pandemic, to issue any orders that would create a perception of impeding such effort.22. Therefore, as at present, we deem it apposite to confine our focus on ensuring that there is no breach of confidentiality of the data collected by the State and processed by Sprinklr, and since we are not in a position to conclusively persuade ourselves that the terms of the impugned contract would effectively ensure it, we feel it requisite to issue the following directions as an interim measure; also so as to enable this Court to obtain an overall control over the conduct of the parties in terms of the contract with respect to data confidentiality.23. We are also guided to do so, impelled by the singular intent to ensure that there is no “data epidemic” after the COVID-19 epidemic is controlled.24. Resultantly:(a) We hereby direct the Government of Kerala and its concerned Departments to anonymise all the data that have been collected and collated from the citizens of the State with respect to the COVID-19 epidemic, as also with respect to all data to be collected in the future and to allow Sprinklr to have further access to any such data only after the process of anonymisation is completed.(b) The Government of Kerala is directed to inform every citizen, from whom data is to be taken in future, that such data is likely to be accessed by Sprinklr or other third party service providers and their specific consent to such effect shall be obtained in the necessary forms or formats.c. We hereby injunct Sprinklr from committing any act which will be, directly or indirectly, in breach of confidentiality of the data entrusted to them for analysis/processing by the Government of Kerala under the impugned contract/s; and that they shall not disclose or part with any such data to any third party/person/entity – of whatever nature or compositio

n – anywhere in the world.d. We further order that Sprinklr shall not, directly or indirectly, deal with the data or any part of it entrusted to them by the Government of Kerala under the impugned contract/s, in conflict with the various confidentiality clauses/caveats therein; and that they will forthwith entrust back all such data to the Government of Kerala as soon as their contractual obligation, as regards its analysis/processing, is completed as per the requirements under the impugned contract/s.e. Since the Government of Kerala has taken the position before us that, according to them, no data is available with Sprinklr as of now, any residual or secondary data available with the latter shall be immediately entrusted back by them to the Government and this shall be treated as a peremptory order.f. As a necessary corollary to the above directions, we further injunct Sprinklr from advertising or representing or holding over to any third party/person/entity – of whatever nature or composition – that they are in possession or have access to any data regarding COVID-19 patients or persons vulnerable/susceptible to it; and that they shall not use or exploit any such data, or the name and the official logo of the Government of Kerala, directly or indirectly, for any commercial benefit and will deal with such in full confidence to the citizens of Kerala.List these matters on 18.5.2020 for further consideration, within which time, we direct the respondents to complete their pleadings.