CMO Bulk Messaging Issue: Kerala High Court Reserves Verdict, State's Plea To Send 'Thank You' Messages Also To Be Decided

The Kerala High Court on Thursday (March 5) reserved its verdict in the plea alleging violation of privacy of government employees and judges by the State by sending bulk messages to their phone numbers, which was illegally accessed from SPARK [Service Pay Roll Administrative Repository for Kerala].

Justice Bechu Kurian Thomas heard detailed arguments advanced by the Advocate General Gopalakrishna Kurup appearing for the State government.

The Advocate General stressed upon the arguments advanced yesterday, particularly that there is nothing illegal or illegitimate regarding the messages sent by the KSTIM using the centre ID of the Chief Minister's office since there is no law or regulation being violated. He also pointed out that prior this instance of Whatsapp messages, the communication was through SMS mode provided by the KSITM and it was just an infrastructural change.

The AG then told the Court that once consent is given by a Data Principal for storing data in SPARK, which is facilitated by KSITM, the State, including the Chief Minister becomes custodian of the data. He also brought to the Court's attention that not just any person is able to access the data, only a person authorised by a two-step process alone can access the platform and send messages.

Yesterday, a petition was moved by the State seeking permission of the Court to send 'Thank You' messages to the persons who had contributed to the Chief Minister's Disaster Relief Fund (CMDRF). The petitioners in the plea had objected to the same saying that acknowledgment receipts were already issued at the time when the donations were made and there is no need for new messages at this point of time. They also told that an objection would be filed and the acknowledge receipt would be produced today. 

Addressing this, the AG submitted that at the time when donations are made, any person outside SPARK has to give some details before making the payment, which in turn are given to the CM's office.

"Because, transfer of money to CMDRF can only be possible after giving these. While treasury takes these payments, they will transfer all the data. All data is available with CMDRF. Using these data only we have sought," he added.

The Court also interacted with Sri. Sabarish, one of the head of e-governance, KSITM (Kerala State IT Mission), who had appeared before the Bench pursuant to its oral direction yesterday.

The officer told the Court that there is a move to enhance SPARK and to build a Human Resource portal as part of the Digital Kerala Initiative. It was part of this that the Director of IT Mission sent letter to give updated list of employees in SPARK and only details like mobile phone and name was sought, which was transferred to IT mission through an official channel. He assured the Court that no AI based information can be accessed from SPARK. 

"So if the Chief Minister wants to send a message, how does this data get transferred? To Chief Minister's account? How does it happen?," Justice Bechu enquired.

Explaining the entire process, the officer replied:

"It is not the Chief Minister's account. I'll explain the process, sir. The Meta has got two products: Facebook and Whatsapp. Earlier, when people used to get SMS message, they cannot validate whether it was from the same source or not. They used to get lots of messages. Lots of cyber crimes were happening, so we need to put in a source which can be validated. For that Facebook has got a Meta business account. As an individual, I can create a central ID. Chief Minister or PMO something like that is called the central ID. If I try to create a central ID like that, what Meta does is, it will talk to the concerned account, say PMO's account, and it will talk to the administrator of that account whether I am an authorised guy and, unless and otherwise he gets an authorisation, it will be treated as free channel. They don't allow that central ID to be done. Here, what has happened is, IT mission has earlier developed a platform for sending SMS but it was passive and not that active. So, we created a new platform for sending through Whatsapp. For each message to be sent, we need to have a central ID. At that point of time, the only central ID, which was validated and available was the Chief Minister's. We plan to have more centre IDs like Government of Kerala, SPARK and even department-wise central IDs, which has to undergo the process of validation and verification by the Meta team to enable it."

Justice Bechu then asked, "It was validated much earlier or only for this?"

Answering the query, the officer clarified that it happened much earlier and all the CMDRF messages and IMPRD related messages were going through the CM's central ID. This was integrated to the platform by the IT mission and there is one designated nodal officer exclusively for this purpose, who alone can access the platform using multi-factor authentication. At the click of a button, he can send all these messages but only those approved, the officer explained.

Justice Bechu next asked regarding the allegation that members of the judiciary had received personalised messages: "Judges of the higher judiciary are alleged to have received messages with specific names. They are not employees of the government nor are they receiving any benefits."

Officer answered, "Their payments are processed through SPARK. Their data is there. They used to get messages like...Lot of personalised messages as well as group messages, like Onam allowance has been released. That happened in the SMS mode but this is the first time, we are using the Whatsapp platform for doing this."

Retorting to the AG's submissions, Senior Advocate George Poonthottam argued that what has to be looked into is whether it is permissible under law to send messages after accessing data through SPARK.

"If it is not permissible, and lacking legal sanction, illegality is attached," he added.

However, the Court orally remarked, "Now, it is transpired that the messages have been sent from Kerala State IT Mission. It is a State body. It is not by a third party that has sent these messages."

"That State body is given the consent by the individual," Senior Counsel replied.

"That individual has a relevance. If you look at Exhibit R1(b), where the Chairman is the Chief Minister and it is the chairman who has to approve, reject, modify or request for the use of data. So your submission that Chief Minister directed the messages be sent, to an extent, be approval or assent granted for the data that has been sent," asked Justice Bechu.

Exhibit R1(b) is a 2022 government order giving administrative sanction to the KSITM for the establishment of a Unified Registry for the State.

But the petitioners' counsel pointed out that Chief Minister is only Chairman of the Steering Committee and the Chief Secretary is the Chairman of the Executive Committee.

The senior counsel continued his arguments by saying that though the Chief Minister may wield unlimited power, he cannot become 'State' as per Article 12 of the Constitution of India. He pointed out that the attempt to gather data was done by the OSD of the Chief Minister and he is someone coming within the ambit of State. Even if he has collected it, he can only collect and keep it. Certain provisions of the Digital Personal Data Protection Act, though not yet been implemented, requires a consent.

"Crucial question is: the date which I have provided for one purpose can it be parted or used for a different purpose without obtaining the consent?," the Senior Counsel contended.

Justice Bechu then read out the message received by the petitioners and asked: "What is the extraneous purpose here? It only conveys. If you look at the message...If you look at paragraph 311 of Puttaswamy's case - Digital platforms are a vital tool of ensuring good governance in a social welfare state. Information technology – legitimately deployed is a powerful enabler in the spread of innovation and knowledge."

"But the data mining, which is the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the State to insist on the collection of data. I'm not disputing on that. If data is collected in respect of that. But, the data which the State has collected has to be utilised for legitimate purpose of the State and ought not be utilised unauthorisedly for extraneous purposes. The moment when the Supreme Court said 'unauthorisedly', it is there that the question of consent arises," the senior counsel clarified.

Justice Bechu then put forth a query, "When the messages have been sent not from the personal account of the Chief Minister, but from the mobile number of the State IT Mission, and what is contained in the messages, something related to DA, salary or housing allowance. How can we assume that it is illegitimate or for an extraneous consideration?...Unless that is there, there cannot be a good governance...If this data was send by a third party, say someone sitting in Madras, Bangalore or even in Trivandrum. Some private party is given data to send these messages, yes. But here, it is done by the State's own department. One wing of the State has sent this. They are all persons who are engaged and appointed by government order."

Senior counsel: "Decipher the process. One is collection of data, second is storage of data for both, the State has got authority. But if that data that is collected and stored by the State need to be parted, how and in what manner, it has to be parted. That is what has been explained. That is the shifting stage."

Justice Bechu: "That is the only issue. Whether the data that is collected and stored by the State has been utilitsed for an illegitimate purpose...Suppose, this messages says 'please vote for us.'"

Senior counsel reads out the message and says: "That is how it is concluded."

Justice Bechu disagrees and asks, "You are reading into the lines. Take another interpretation. Every govt is bound to protect the rights of every employees of its. In the coming days also, this protection or this security will continue. We are affirming it. Is it not an oath? Is it not an affirmation of what the government has assumed to do...It is a Welfare State. Every word of the government should not be, may be as you say, we can read it the words, something else."

Senior Counsel: "It is the circumstances that leads. Everything is to be understood in the context. Entire process has to be deciphered into several parts. The justifiability of collection of data, the justifiability of sending of messages and the question as to whether, even though it is claimed that the IT mission platform is safe enough, I have specifically averred that it is not sent by IT mission."

Justice Bechu then corrects the senior counsel: "It is sent by IT mission. It is shown in the counter affidavit...Even messages sent by SPARK or through SPARK is actually done by IT mission, which is appointed as the nodal agency for SPARK. KSITM has been given the control or it acts as the agency for sending messages to every employee for payment of salary or other benefits."

Opposing the same, the senior counsel replies, "They don't have the wherewithal for sending it...I have no quarrel with the IT mission sending messages to the employees that are drawing salary. But the IT mission is not the Chief Minister of the State. That is the difference between the State and the Council of Ministers. IT mission cannot carry the photograph of the Chief Minister...The director of the IT mission discharges his duties, he has to perform a different duty. He should not become the torch bearer of a particular person...Nature of the function differs. Then it becomes an auspice for a political entity."

Referring to the interim application filed by the State to send Thank You messages to CMDRF donors, Senior counsel contends: "This application has been filed only for the purpose of legitimising the message that has been sent. That need not be at the cost of the Court."

Justice Bechu then posted the case to next week for passing the verdict. "Hopefully, on Monday, I'll pass orders. IA also. It's a niche area, needs some study."

Earlier, an undertaking was made by the special government pleader that no messages similar to the ones produced in the plea would be sent by the State. The undertaking was extended till Monday (March 9), when the Court is likely to pronounce its verdict.

The petition is moved by Advocates George Poonthottam (Sr.), Nisha George, A.L. Navaneeth Krishnan and Kavya Varma M.

Case No: WP(C) 7090/2026

Case Title: Dr. Rasheed Ahammed P. and Anr. v. State of Kerala and Ors.