Data retention limits for epidemic tracking systems

Introduction

Data retention limits refer to legal and administrative restrictions on how long personal information may be stored by government authorities, healthcare institutions and other organisations. Epidemic tracking systems collect information about infected individuals, suspected cases, vaccination status, travel history, contact networks and geographical movements to control the spread of infectious diseases.

Although these systems help authorities identify disease outbreaks and implement public health measures, excessive retention of personal information can create serious privacy risks. Long-term storage of location histories, medical records and contact information may expose individuals to surveillance, discrimination and unauthorised disclosure.

Therefore, epidemic tracking systems must follow appropriate retention periods, purpose limitations, deletion procedures and security safeguards. The objective is to balance public health requirements with individual privacy and constitutional rights.

Legal framework in India

1. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, establishes India's framework for processing digital personal data.

Section 4 provides that personal data may be processed for a lawful purpose. Section 6 establishes requirements for consent, while Section 8 specifies obligations of data fiduciaries.

Section 8 also requires erasure of personal data when the data principal withdraws consent or when the specified purpose is no longer served, unless retention is necessary for compliance with applicable law.

This principle is important for epidemic tracking applications because personal information should not be stored indefinitely after its public health purpose has ended.

The Act also contains provisions concerning certain legitimate uses and exemptions. Its application must be considered alongside the relevant commencement notifications and rules.

2. Epidemic diseases act, 1897

The Epidemic Diseases Act, 1897, empowers state governments and the Central Government to take special measures and prescribe regulations to prevent the spread of dangerous epidemic diseases.

Section 2 provides powers to state governments, while Section 2A provides relevant powers to the Central Government.

Although the Act supports epidemic control, it does not establish a general retention period for personal information collected through digital tracking systems. Data collection and storage must therefore also comply with other applicable legal requirements.

3. Disaster management act, 2005

The Disaster Management Act, 2005, establishes institutional mechanisms for disaster prevention, preparedness and response.

During public health emergencies, authorities may use information systems to coordinate relief measures, monitor affected populations and manage emergency operations.

However, emergency data collection should remain connected to legitimate statutory purposes. Emergency powers should not automatically justify indefinite retention of identifiable personal information.

4. Information technology act, 2000

The Information Technology Act, 2000, provides a framework for electronic records, cybersecurity and confidentiality.

Section 43 addresses unauthorised access and damage to computer systems. Section 66 covers specified computer-related offences, while Section 72 concerns breach of confidentiality and privacy by persons obtaining access through powers conferred under the Act.

These provisions may become relevant when epidemic tracking databases are accessed or disclosed without authorisation.

Important principles governing data retention

1. Purpose limitation

Information should be retained only for clearly identified epidemic management purposes, such as contact tracing, disease surveillance and public health planning.

Once the relevant purpose is achieved, continued storage of identifiable information requires an appropriate legal justification.

2. Necessity and proportionality

Authorities should retain only information necessary to achieve legitimate public health objectives.

For example, a contact-tracing system may require temporary location records but may not need to preserve identifiable movement histories permanently.

3. Defined retention periods

Organisations should establish retention schedules according to the nature of the data, disease characteristics, applicable regulations and public health requirements.

Different categories of information may require different retention periods.

4. Secure deletion and anonymization

After the retention period expires, identifiable information should be securely deleted unless continued retention is legally required.

Where long-term epidemiological research is necessary, appropriately anonymised or aggregated information may be retained. However, pseudonymised information should not automatically be treated as anonymous because re-identification may remain possible.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment established that restrictions on privacy must satisfy legality, legitimate state purpose and proportionality.

Relevance: Epidemic tracking systems may collect sensitive health and location information. Authorities must ensure that such collection and retention are legally justified, necessary and proportionate to public health objectives.

2. K.S. Puttaswamy v. Union of India (Aadhaar case, 2018)

The Supreme Court examined the constitutional validity of the Aadhaar framework and considered the collection, storage and use of personal and biometric information.

The judgment emphasised the importance of proportionality and safeguards against excessive collection and misuse.

Relevance: The decision supports limiting the collection and retention of identifiable information in epidemic tracking systems. Public authorities should avoid retaining personal information beyond legitimate requirements.

3. Internet and Mobile Association of India v. Reserve Bank of India (2020)

The Supreme Court examined the proportionality of restrictions imposed by the Reserve Bank of India on cryptocurrency-related banking services.

The Court emphasised that regulatory measures affecting rights and economic activities must satisfy constitutional proportionality.

Relevance: Although the case did not concern epidemic tracking, its proportionality analysis provides a broader legal principle for evaluating restrictive digital regulatory measures, including excessive information retention.

4. Digital Rights Ireland Ltd. v. Minister for Communications (2014)

The Court of Justice of the European Union invalidated the EU Data Retention Directive because its broad and indiscriminate retention requirements disproportionately interfered with fundamental privacy rights.

Relevance: The decision demonstrates that retaining large amounts of personal information without adequate necessity and safeguards may violate privacy protections. It is particularly relevant to epidemic tracking databases containing movement and communication-related information.

5. Anuradha Bhasin v. Union of India (2020)

The Supreme Court examined restrictions on internet and communication services in Jammu and Kashmir.

The Court emphasised that restrictions affecting fundamental rights must satisfy constitutional requirements, including proportionality and periodic review.

Relevance: Digital epidemic tracking measures should also remain subject to legal scrutiny and periodic assessment. Public health objectives should not become a justification for unnecessary or indefinite surveillance.

Compliance measures for epidemic tracking authorities

Government departments, healthcare institutions and technology providers should adopt the following safeguards:

Establish written data retention and deletion policies.

Collect only information necessary for epidemic management.

Define separate retention periods for different data categories.

Restrict access to authorised public health personnel.

Encrypt personal and location information.

Maintain audit records of access and disclosure.

Delete or appropriately anonymise information after its purpose ends.

Conduct periodic privacy and cybersecurity assessments.

Establish procedures for handling data breaches.

Review emergency data collection measures when the public health situation changes.

Challenges in implementation

Determining an appropriate retention period is difficult because different diseases have different incubation periods, transmission patterns and monitoring requirements. Researchers may also need historical information for epidemiological studies.

Another challenge is balancing individual privacy with the need to preserve information for future public health emergencies. Authorities should address this issue through clearly defined retention schedules, restricted research access and appropriate anonymisation rather than unlimited storage of identifiable records.

Conclusion

Data retention limits are essential for protecting privacy and preventing excessive surveillance through epidemic tracking systems. India's Digital Personal Data Protection Act, 2023, Epidemic Diseases Act, 1897, and Disaster Management Act, 2005, provide relevant legal foundations for managing information during public health emergencies. Judicial decisions such as Puttaswamy, Anuradha Bhasin and Digital Rights Ireland establish important principles of privacy, necessity and proportionality. Public authorities should therefore adopt purpose-based retention schedules, secure deletion procedures and periodic reviews to ensure that epidemic tracking remains effective without unnecessarily compromising individual privacy.