After the agreement with the US-based Sprinklr Inc. stoked charges of data theft, the LDF government in what looked like a swift move to remove any suspicion of an underhand deal has made all documents related to the agreement public on Wednesday.
However, the two letters of affirmation received by the State government, one on April 11 when Leader of Opposition Ramesh Chennithala levelled grave charges, and a revised letter sent the very next day clearly indicate that both the government and Sprinklr were rattled by the charges.
These letters also demonstrate why Chief Minister Pinarayi Vijayan is on shaky ground when he insisted during his customary media briefing on April 15 that here was no confusion about the deal with Sprinklr. "We had discussed all of this (the data sharing arrangement) with them (Sprinklr) earlier and there was clarity. There is no dispute whatsoever," the chief minister said. But the two versions of the letter of affirmation contradicts Pinarayi's claim.
There was a clear tonal shift between the first and second letters, which came just a day apart. While Sprinklr's first 'letter of affirmation' adopted what looked a tone of superiority, and even seemed to suggest that getting data from Kerala was its entitlement, the second sounded extremely humble.
More than the tone, the content also got a radical overhaul. How the data would be collected, how it would be used, where it would be stored, and also the rights of Sprinklr over the citizens' data were subjected to some thorough revision.
In the first letter (received on April 11), Kerala was legally obliged to hand over the data to Sprinklr and had no means to hold the company to account if it thought the data were being unnecessarily accessed by it.
Here is what is stated in the first letter: "Customer (Kerala) expressly represents that it has the legal right to make such data available to Sprinklr for the purpose of providing the Services, and agrees to indemnify and hold harmless Sprinklr and its officers, directors, and affiliates from any associated with Sprinklr's access to and use of such Customer Data." This clearly one-sided condition has been taken out in the second letter.
If the first letter said the Kerala government had to somehow provide all the data, the second one comes with ethics written all over it. "Personal data provided by citizens is provided only pursuant to express and informed citizen consent, which is obtained electronically directly from each citizen who chooses to input data to the Platform," the revised letter states.
The first letter grants Sprinklr almost free rights to play with citizens' information as it thought fit. "Customer (Kerala) grants to Sprinklr during the term of this Agreement a royalty-free, non-exclusive, nontransferable, worldwide right and license: (i) to copy, cache, store, reproduce, perform, display, use, distribute, transmit and generally make available the Customer Content in electronic form via the Internet, through wireless communications services and social media through the Platform in order to provide the Sprinklr Services to Customer in accordance with this Agreement; and (ii) to access Customer's accounts on the Connected Services in order to provide the Sprinklr Services."
In just a day, such unbridled rights were set aside, and the revised letter looks like the work of someone quite effectively tamed. "Such data is, and at all times remains, the property of the citizen who provides it, and will be removed from the Platform upon said citizen’s instruction. Sprinklr neither has nor seeks any right to do anything with such data beyond the limited rights granted by each citizen when he or she opts into the system. Such limited rights may be revoked at any time."
In the first letter, there was no mention of where the data collected would be stored. The opposition had charged that data would be stored in foreign-owned cloud servers outside India.
The revised letter therefore speaks of geography. "All data uploaded by any party and by any means to the Citizen Experience Management Platform by or from Kerala or its citizens is and will be hosted within the geographical boundaries of India and can be moved to whatever server or data centre that meets technical requirements and that Kerala specifies, at any time."
The IT Department, in its explanatory note after the charges erupted, had said that the information was now being uploaded to the sub-domain citizencentre.sprinklr.com and once the new sub-domain citizencentre.kerala.gov.in was ready, the data would be uploaded through it.
The IT Department further promised that the Amazon cloud server owned by the government-run Centre for Development of Imaging Technology (C-DIT) would also be augmented so that the citizens' information could be eventually moved on to a government-owned server.
The chief minister also threw more light on the deal. Earlier, he had said the deal imposed no financial obligation on the government. Now, he said the free part was only till September 24, by when it is hoped the virus would be defeated.
"After that, they will charge a price," he said.
Ramesh Chennithala had on April 15 alleged that Sprinklr was a company facing grave data theft charges in the US.
Pinarayi brushed away the allegation saying it was usual for big companies to face such charges. "Companies like Google and Microsoft have such charges hurled at them," he said. Pinarayi also conceded that the Sprinklr deal was not forwarded to the Law Department for vetting. "Since there were no financial dealings involved, the agreement was not passed on to Law Department," the chief minister said.
