'No Free Hand Available To State To Deal With Data As They Like': Petitioners Tell Kerala High Court In CMO Bulk Messaging Issue

The Kerala High Court on Monday (March 2) heard detailed arguments of the petitioners in the plea alleging that the Chief Minister's Officer (CMO) violated the privacy of government employees and judges by illegally accessing their mobile phone numbers, email IDs and sending bulk messages as a form of election campaign.

Justice Bechu Kurian Thomas was hearing the case.

Today, Senior Advocate George Poonthottam appearing for the petitioners told the Court that the petitioners' personal data including their signature were collected and stored by SPARK [Service Pay Roll Administrative Repository for Kerala]. He further argued that the petitioners have not given their consent for the purpose of parting with their data or for disseminating messages like the ones received.

He referred to the 9-judge bench decision in Justice K.S. Puttaswamy (Retd.), And Anr. v. Union of India And Ors. and argued that the decision lays down how data can be collected, how it can be collected by the government for a particular purpose, and when it can be used for a different purpose.

He also touched upon in detail the three-fold requirement laid down in the decision. According to the senior counsel, none of the three requirements laid down have been satisfied by the State when the CMO sent out the messages to the petitioners, and lakhs of others. He said that the details were given for the sole purpose of processing of salary and no consent was given for accessing the numbers for disseminating messages.

Referring to the message, Justice Bechu then asked, "This talks about three things. One is about increase in DA."

The senior counsel read out the message received by the petitioners, the last portion of which contained a line, which translated to, "This government will always be there to protect the welfare and rights of employees; this care will continue in upcoming days."

He then told, "This government was functional in 2021, 2022, 2023, 2024 and 2025, not at the eve of the elections."

Hearing the same, the Court orally asked, "When it should be sent is a matter for the government to decide. When some message should be sent is a matter for the government. What is wrong in this message?"

Senior counsel argued that the petitioners' address and particulars have been gathered from SPARK on the basis of the requisition made by the government. He referred to various exhibits produced in the plea where the communication was sent to several government departments asking for data of various beneficiaries, including that of the "Sthree Suraksha Padhathi".

"Name is what has been mined? What is the data that has been mined?...Data - name and mobile number. This is called data mining?," Justice Bechu asked.

Senior Advocate answered: "This is data mining...That data mining was not on the basis of an informed consent given by those citizens who have parted their details by various departments, agencies, including the State."

The Court then asked what was the applicability of the Puttaswamy case, which was passed in 2017 when subsequently a statute has been introduced.

Senior counsel replied that the Digital Personal Data Protection Act has been notified only partially. "That appears to be the defence of the State as well," he added.

The Court next asked for the provisions which have been brought into effect and those that are yet to be notified. The senior counsel argued that since DPDP Act is still not fully in force, the Puttaswamy case holds force in the field. The requirements provided in the case are to be followed scrupulously.

He told the Court that the primary question to be considered is whether the data mining as carried out is a legitimate exercise. If it is not a legitimate exercise, that is contrary to Article 21 and the Apex Court in Puttaswamy decision.

Senior counsel appearing for the petitioners told that the government orders, including a 2022 government order for establishment of Aadhar Vault and Unified Registry, are only administrative instructions issued by the Chief Secretary and cannot be elevated to the status of a law.

"No free hand available with the State in dealing with the data as they like," he added.

The senior counsel concluded his arguments by pointing out that the State's counter affidavit is silent on the system that is available and the data system that is used to send out such lakhs of messages and that such bulk messages can be sent only using sophisticated systems, which are not at the disposal of the IT mission.

The Court has posted the case tomorrow for hearing the arguments of the Advocate General. The undertaking given by the State that bulk messages would not be sent out would extend till then.

The petition is moved by Advocates George Poonthottam (Sr.), Nisha George, A.L. Navaneeth Krishnan and Kavya Varma M.

Case No: WP(C) 7090/2026

Case Title: Dr. Rasheed Ahammed P. and Anr. v. State of Kerala and Ors.