JUDGMENT : Soumen Sen, C.J. 1. Although the Covid-19 pandemic situation has come to an end, the series of litigations filed during the pandemic situation has been kept alive to ensure that right to privacy of persons whose data was sought to be shared with a third-party entity, namely the Sprinklr Inc., has not been compromised. 2. These matters were heard last substantially on 24 April 2020. 3. Elaborate submissions have been made on behalf of the parties. However, having regard to the exhaustive and elaborate order passed in these writ petitions by the Division Bench presided over by Mr. Justice Devan Ramachandran on 24.04.2020, at a point of time when the issues seems to have been live, our task has been now easier. 4. We are now required to assess the situation that prevailed during the Covid-19 pandemic as on 02.04.2020, when the Principal Secretary to the Electronics and Information Technology Department, Government of Kerala, entered into an agreement with Sprinklr Inc.. The efficacy of such agreement seems to have been diluted by the order passed by the Division Bench presided over by Mr.Justice Devan Ramachandran on 24.04.2020, in which in paragraph No.24, the following directions were passed: “24. Resultantly: (a) We hereby direct the Government of Kerala and its concerned Departments to anonymise all the data that have been collected and collated from the citizens of the State with respect to the COVID-19 epidemic, as also with respect to all data to be collected in the future and to allow Sprinklr to have further access to any such data only after the process of anonymisation is completed. (b) The Government of Kerala is directed to inform every citizen, from whom data is to be taken in future, that such data is likely to be accessed by Sprinklr or other third party service providers and their specific consent to such effect shall be obtained in the necessary forms or formats. (c) We hereby injunct Sprinklr from committing any act which will be, directly or indirectly, in breach of confidentiality of the data entrusted to them for analysis/processing by the Government of Kerala under the impugned contract/s; and that they shall not disclose or part with any such data to any third party/person/entity – of whatever nature or composition – anywhere in the world. (d) We further order that Sprinklr shall not, directly or indirectly, deal with the data or any part of it entrusted to them by the Government of Kerala under the impugned contract/s, in conflict with the various confidentiality clauses/caveats therein; and that they will forthwith entrust back all such data to the Government of Kerala as soon as their contractual obligation, as regards its analysis/processing, is completed as per the requirements under the impugned contract/s. (e) Since the Government of Kerala has taken the position before us that, according to them, no data is available with Sprinklr as of now, any residual or secondary data available with the latter shall be immediately entrusted back by them to the Government and this shall be treated as a peremptory order. (f) As a necessary corollary to the above directions, we further injunct Sprinklr from advertising or representing or holding over to any third party/person/entity – of whatever nature or composition – that they are in possession or have access to any data regarding COVID-19 patients or persons vulnerable/susceptible to it; and that they shall not use or exploit any such data, or the name and the official logo of the Government of Kerala, directly or indirectly, for any commercial benefit and will deal with such in full confidence to the citizens of Kerala. List these matters on 18.5.2020 for further consideration, within which time, we direct the respondents to complete their pleadings.” 5. The said directions appear to have been passed before the State could apprise the court of the fact that it may not have acted imprudently in entering into the agreement with Sprinklr in sharing data informations of individuals which, inter alia, include: “a) Data related to international travelers b) Data related to domestic travelers c) Data related to health workers or people who have contact with patients d) Vulnerable people data-either self reported or reported by relatives. e) Data collected by field worker.” 6. It has not been contested at the time of hearing that the directions of the Division Bench had not been complied with. The learned counsel appearing for the parties are unanimous that the aforesaid directions have been complied with. e) Data collected by field worker.” 6. It has not been contested at the time of hearing that the directions of the Division Bench had not been complied with. The learned counsel appearing for the parties are unanimous that the aforesaid directions have been complied with. However, the learned Senior Counsel who are appearing for the petitioners have submitted that the manner in which the said agreement was entered into had the risk and possibility of exposing personal data to a third-party and had been hurriedly done without even caring for data protection or obtaining a Cabinet approval. 7. It is submitted that while entering into the said agreement, Article 299 of the Constitution of India was not followed and although the Petitioners presently are unable to disclose any instance of data theft by Sprinklr Inc., the possibility of such data being shared with a third-party cannot be ruled out. It is thus contended that admittedly, there has been a gross negligence on the part of the State for which some compensation has to be awarded and that a message should be sent to the State that, in future, it should be more cautious while sharing such data with third-parties. 8. Another apprehension expressed, which cannot be ignored, is the jurisdictional clause which gives an exclusive right to the Courts in United States where the Sprinklr Inc. has its office, in case of any dispute between the parties arising out of the agreement. While prudence required the State to be more cautious, vigilant and circumspect in entering into such an agreement, what appears to be of a more serious concern is that the said jurisdiction clause makes it difficult and onerous for individuals to pursue their claims in the event of any data theft, especially if the State neglects to pursue such claims on their behalf. In spite of such apprehension and many loose ends, one cannot disregard the circumstances under which the said agreement was entered into. Fortunately, no instance of data theft has surfaced till now. 9. In spite of such apprehension and many loose ends, one cannot disregard the circumstances under which the said agreement was entered into. Fortunately, no instance of data theft has surfaced till now. 9. The circumstances under which the Principal Secretary to the Electronics and Information Technology Department, Government of Kerala, entered into the agreement are sought to be justified by the State in paragraph No.95 of the counter affidavit, by trying to draw a clear distinction between the agreement entered into by the Principal Secretary and an agreement entered into by the State with a third-party. However, it is contended that the nature of the agreement is such that it does not attract the provisions of Article 299 of the Constitution of India , as it does not involve any financial implication. We are not accepting the said submission, as of the clearly refers to “all contracts” and it does not make any distinction between a contract entered into involving financial implication or for any other consideration. Although the license agreement does not specify any license fee and makes it clear that the State, described as customer, had no obligation to pay to Sprinklr, it also provides that at the conclusion of “scoping and implementation”, Sprinklr will provide customer with the pricing for the service rendered to the customer and at its sole discretion determine what amount, if any, shall be paid to Sprinklr for the services rendered. Even if no price to be paid is mentioned, it cannot be overlooked that Sprinklr could have used such data for commercial purpose. This however has not happened. If the State is able to justify its entering into the contract having regard to the prevailing circumstances and if this Court is satisfied that the situation was such and critical that an immediate decision was required to be taken by the State, the doctrine of necessity would broadly apply in such situation to prevent loss of public life. 10. The decision of the Principal Secretary, Electronics and Information Technology Department, to enter into such an agreement with Sprinklr Inc. has to be assessed on the basis of the situations prevailing during that period. The affidavit filed by the State, affirmed on 05.08.2025, has in detail described the documents under which such agreement was entered into. 10. The decision of the Principal Secretary, Electronics and Information Technology Department, to enter into such an agreement with Sprinklr Inc. has to be assessed on the basis of the situations prevailing during that period. The affidavit filed by the State, affirmed on 05.08.2025, has in detail described the documents under which such agreement was entered into. It is a fact that the entire world at that time was facing unprecedented crisis because of Covid-19 pandemic and the medical fraternity and the scientific community were not at all equipped to address such issues. There was also no human anti body identified and even the most advanced countries of the world were facing difficulties to contain the spread of the virus. The State of Kerala was the first in the country affected with Covid-19 pandemic. Covid-19 virus is of highly contagious nature. It is estimated that each affected person transmits the virus to 2 to 3 people with whom he comes into contact. There has been an instance in the State wherein 13 persons got infected from a single point contact. Though the mortality among young patients is low, the mortality is as high as 2 to 3% in the case of old people above 70, if the patient has other co-morbidity conditions like Blood Pressure, Diabetes, etc. It was thus a call of the day for the State Administration to take immediate steps to ensure proper identification of persons affected, their primary and secondary contacts and those who were likely to be affected, their primary and secondary contacts and those who were likely to be affected and ensured their continuous and rigorous observation. In order to enable tracking and tracing of the persons who visited or arrived from Covid affected countries, regions, the Government formulated a two pronged strategy of isolating the primary and secondary contacts, keeping the identified patients in home isolation/hospitals and putting the vulnerable under reverse quarantine. The Government developed an Information Technology system, named “Corona Tracker”, to collect the data of persons under isolation through the Health Centres under the Department of Health. The first case of Covid-19 in India was reported on 30.01.2020, originating from China. The disease was spreading at a fast pace all over the world. The Government developed an Information Technology system, named “Corona Tracker”, to collect the data of persons under isolation through the Health Centres under the Department of Health. The first case of Covid-19 in India was reported on 30.01.2020, originating from China. The disease was spreading at a fast pace all over the world. It was assessed by the Crisis Management Group of the Government that there was a possibility of a sudden spike in the numbers in the State of Kerala. The risk of spread was very high in the State, with a high density of population and exposed to the whole world on account of the presence of expatriate Keralites all over and also on account of being a tourist destination. To assist such processes where large volume of data would be required to be analysed and to establish a constant channel of communication with the persons affected and to collide the unstructured data, it was decided to use the support of a scalable Information Technology System/SaaS. The Government owned entities like the Centre for Development of Imaging Technology (C-DIT) and Information Kerala Mission were not technically equipped to manage such large volume of data and hence there were no viable alternatives within the Government framework. It was at that stage that the Sprinklr expressed its interest in working with the Government to tackle the emergent situation. Sprinklr had the experience of creating user experiences for corporates and had the technology capabilities that enabled fast implementation. It is a data analytics company with capability of processing large volumes of data and its product capabilities will help the State of Kerala in: ? Enriching the identified vulnerable population (to be reverse quarantined) data ? Establishing effective communication channel with reverse quarantined people ? Engaging with the reverse quarantined (suggesting precautions, answering questions, etc.) and monitoring their health ? Reporting geospatially on the health of reverse quarantined in the State ? Identifying vulnerable, requiring focussed attention based on insights and engaging with them. The types of data collected and shared with Sprinklr have already been indicated above. 11. The Court may absolve the State from not adhering to the principles which it ought to have followed in a normal situation. One cannot lose sight of the fact that the country was not prepared for an epidemic of such kind, which the world had not witnessed for many centuries. 11. The Court may absolve the State from not adhering to the principles which it ought to have followed in a normal situation. One cannot lose sight of the fact that the country was not prepared for an epidemic of such kind, which the world had not witnessed for many centuries. It was sudden and had shattered the entire economy, including the health of millions. It seems what the State appears to have followed by selecting an entity whose proprietor has his roots in the State and had offered to render services pro bono. It is not in dispute that the service rendered was out of gratis and not a single penny was charged. It does not affect the State coffer at all. 12. Mr.T.Asafali, learned Senior Advocate appearing on behalf of the petitioner in W.P(C)No.9540/2020 has mainly referred to clauses 2.5 and 11.6, which clearly restrict the Sprinklr to share any information. The apprehension that in case any such information is shared what would have been the consequence and pursuing such a claim in a foreign jurisdiction in case of breach, is a matter well taken and appreciated. However, no such situation has arisen so far and hence the matter appears to be academic at this stage. 13. Mr.T.Asafali, learned Senior Advocate has referred to the Committee Report dated ‘Nil’ prepared by Sri.M.Madhavan Nambiar and Dr.Gulshan Rai. The said report has recorded the explanation offered by Mr.M.Sivasankar IAS, Principal Secretary, Electronics & Information Technology Department and the other officers of the IT Department for choosing Sprinklr Inc. as a one stop solution for all data needs for managing Covid-19 pandemic. The reasons furnished and recorded in the said report are as follows: ? “The technical group of the IT Department did an evaluation of the product and it was found that the product would serve the purpose. ? The product was offered free of cost. ? Ease of deployment.” 14. There is an observation in the said report that the Sprinklr Inc. had set up their Data Analytic Platform on the computer systems hired by them on the cloud system of Amazon Web Services (AWS) at Mumbai. ? The product was offered free of cost. ? Ease of deployment.” 14. There is an observation in the said report that the Sprinklr Inc. had set up their Data Analytic Platform on the computer systems hired by them on the cloud system of Amazon Web Services (AWS) at Mumbai. Mr.T.Asafali, learned Senior Advocate submits that the Committee is of the view that the analysis of log reflects outbound data of the range varying few Megabytes to Gigabytes during the period to some private IP addresses which belonged to AWS thereby indicating data transfer to some other accounts at AWS. The details of these IP’s could have been provided only by either AWS or Sprinklr Inc. Mr.Asafali has also referred to the findings and recommendations of the said Committee which inter alia records that the matter was directly handled by the then Principal Secretary, IT, who followed an ad hoc and unstructured approach. The learned Senior Advocate has also questioned the creation of a further Inquiry Committee consisting of three members, who have a reviewed the report filed by the earlier Committee. It was submitted that the said report was obtained to nullify the observations and recommendations of the earlier Committee. 15. However, we have read the two reports carefully and in respect of the observations made by the second report, which also appears to be quite exhaustive, the said Committee has arrived at a different finding that there has been no data theft or breach of confidentiality. The Sprinklr activities continued only for less than a month and by 20.04.2020, the entire data has already been transferred to the State Data Centre managed by C-DIT and instruction was also given to destroy data if any remained with Sprinklr forthwith. Sprinklr reported compliance with the same. There is no evidence, as of now, to prove that the interest of the State was adversely affected due to the engagement of Sprinklr. However, the Committee has found that there was lapses in executing the said contract with Sprinklr Inc. Sprinklr reported compliance with the same. There is no evidence, as of now, to prove that the interest of the State was adversely affected due to the engagement of Sprinklr. However, the Committee has found that there was lapses in executing the said contract with Sprinklr Inc. and the relevant provisions of the Rules of Procedure for the Government of Kerala, the Kerala Secretariat Office Manual and Secretariat Instructions have not been followed by the then Principal Secretary while engaging Sprinklr for data analysis, nor the Law Department or the Finance Department were consulted so as to ascertain and confirm regarding execution of agreements and in understanding whether the service offered was cost free. 16. Mr.K.Ramkumar, learned Senior Advocate instructed by Mr.T.Ramprasad Unni, learned counsel for the Petitioner in W.P(C)No.9911 of 2020 has referred to paragraph No.1464 in the decision of the Hon’ble Supreme Court in K.S.Puttaswamy (AADHAAR-5J) v. Union of India & anr., (2019) 1 SCC 1 and has submitted that without the Cabinet approval or a valid Act, any such action cannot be validated post facto, as it is essential for the constitutional courts to preserve the right to privacy. The paragraph relied upon by the learned Senior Advocate forms part of the dissenting opinion in AADHAAR-5J (supra). The majority view in paragraph No.368 has addressed the issue of striking a balance between the fundamental rights, specifically, the right to privacy and the national and larger public interest. The nature of the information sought for and shared with Sprinklr Inc., which continued for a period of three weeks, was not such a kind of information as would give rise to any breach of privacy of the persons providing it. The information was necessary to find out the number of persons affected by Covid-19 and those requiring quarantine. Those personal details were required even for the benefit of the people who are not affected by Covid-19, but who were likely to be affected from those whose identities, if not disclosed, could aggravate and further spread the virus and likely to have cascading effect on the people at large. The majority of the case in AADHAAR-5J (supra) had taken the consideration of a balance to be struck between the importance of achieving the proper purpose and the social importance of preventing the limitation on the constitutional right and has observed thus: “ 368 . The majority of the case in AADHAAR-5J (supra) had taken the consideration of a balance to be struck between the importance of achieving the proper purpose and the social importance of preventing the limitation on the constitutional right and has observed thus: “ 368 . Thus, even when (sic balancing of) two aspects of the fundamental rights of the same individual, which appear to be in conflict with each other, is done, we find that the Aadhaar Act has struck a fair balance between the right to privacy of the individual with right to life of the same individual as a beneficiary. In the face of the all-pervading prescript for accomplished socio- economic rights, that need to be given to the deprived and marginalised section of the society, as the constitutional imperative embodied in these provisions of the Act, it is entitled to receive judicial imprimatur.” 17. The State in the affidavit has referred to Article 47 of the Constitution of India to argue that any act done by the State in implementation of a Directive Principles of State policy cannot be held to be violative of Article 14 of the and consequently, any collection of information or data by the State for protecting public health as well as the health of the ‘Data Principal’ cannot be challenged on the ground that it violates of the . 18. The Court while approaching such a problem in a given situation, has to be circumspect to ascertain whether under the garb of Article 47 , the main purpose is to collect data and intrude upon the right to privacy of an individual. No such breach is revealed to have occurred in this case. 19. We agree with the submission of the learned counsel for the petitioners that the Principal Secretary ought not to have entered into the said agreement without proper Cabinet approval or the consent of the Chief Minister. This was a gross dereliction on his part, for which appropriate steps should be taken by the State and such a situation should not recur in future. 20. In the instant case, we do not find that there was any ulterior motive on the part of the State in collecting the data and sharing it with Sprinklr. Moreover, it appears that Sprinklr Inc. has provided the tools only and the data are already been stored by the State. 20. In the instant case, we do not find that there was any ulterior motive on the part of the State in collecting the data and sharing it with Sprinklr. Moreover, it appears that Sprinklr Inc. has provided the tools only and the data are already been stored by the State. In fact, it would have been more prudent for the State to share the data with the National Informatics Centre (NIC), as appears to have been suggested by the learned Assistant Solicitor General of India and recorded in the order dated 24.04.2020 of the Division Bench, in paragraph No.17. However, it appears that the agreement was short-lived and terminated. Sprinklr has accepted the termination and has made a categorical statement that no issue could arise in respect of sharing of data, as the State has only used tools of Sprinklr for the purpose of identifying Covid-19 victims and their details. Moreover, all the data collected by Sprinklr have been purged. On such consideration, we do not find any reason to pass any further order, however, the order passed on 24.04.2020 stands confirmed. The Petitions are accordingly disposed of.Pending interlocutory applications, if any, stand closed.