Logo

Defender of your Digital Freedom

All Posts | Jan 08,2019

What has been changed in the Aadhaar Amendment Bill?

On Wednesday, 02 January 2019, we got our first look at The Aadhaar and Other Laws (Amendment) Bill, 2018. On Friday, 04 January 2019, this Bill was passed by the Lok Sabha. We compared this Bill with the existing provisions under The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and the Supreme Court’s judgment in Justice K.S. Puttaswamy (Retd.) & Anr. vs Union of India & Ors. [W.P. (C) 494/2012], better known as the Aadhaar case.

The word 'Regulation' below refers to the Aadhaar (Authentication) Regulation, 2016.

 

Issue

Supreme Court’s Observations in 

Law before SC's Judgment

Change proposed in the Amendment

Our Comments

Alternate means of establishing identity

To avoid exclusion of deserving beneficiaries, the Court recommended that suitable provisions be made in concerned regulations for establishing identity by alternate means.

Section 2(a) “Aadhaar number” means an identification number issued to an individual under sub-section (3) of section 3;”

 

The proviso to Section 7 reads as "Provided that if an Aadhaar number is not assigned to an individual, the individual shall be offered alternate and viable means of identification for delivery of the subsidy, benefit or service."

Amendment to Section 2(a):

Alternative virtual identity included under definition of Aadhaar number.

 

Amendment to Section 3:

Virtual identity will be an alternative to actual Aadhar number.

"The Proviso to Section 7 has been interpreted in the past by the Executive to apply to only those people who have applied for an Aadhaar number but have not yet been assigned a number by UIDAI.

The changes to Sections 2(a) and Section 3 do not solve the issue of deserving beneficiaries being excluded. This is not an alternate means to establish identity. This method still requires the person whose identity needs to be established to be registered in the Aadhaar database. In order to comply with the Supreme Court's judgment, other forms of ID must be made acceptable as an alternative to an Aadhaar number."

Enrolment of children

1. Consent of parents/guardian is essential for enrolment of children under the Aadhaar Act.

2. Enrolled children shall be given the right to exit from Aadhar upon attaining the age of majority.

3. No Child shall be deprived of benefits if Aadhaar number is not produced. In this case verification on identity can be done on the basis of any other documents.

There was no such provision in the earlier law.

Section 3A inserted:

1. Consent of parent/ guardian of child for enrollment will be essential.

2. Application for cancellation of Aadhar number can be made by a child within a period of six months of attaining eighteen years of age.

3. No denial of subsidy or service to any child if Aadhar not produced.

Six month period for exiting the Aadhaar ecosystem is too short. In case where a person misses the six month limitation period there is no option to exit.

Authentication records

Regulation 26(c) of Aadhaar (Authentication) Regulation, 2016 has been struck down as it pertains to authentication transaction related to metadata.

Regulation 26 of 2016 Regulation requires that Authority shall store and maintain authentication transaction data, which shall inter alia contain information on meta-data related to transaction.

 

 

Residents and illegal immigrants

State directed to take suitable measures to ensure illegal immigrants do not avail benefits.

No such provision in the earlier law.

 

Action on this is awaited.

No change has been introduced by the Amendment.

Data retention

Data retention beyond six months is impermissible.

Regulation 27 of Aadhar (Authentication) Regulations, 2016 providing data retention for 5 years stuck down.

Regulation 27: Duration of storage:

(1) Authentication transaction data shall be retained by the Authority for a period of 6 months, and thereafter archived for a period of five years.

(2) Upon expiry of the period of five years specified in sub-regulation (1), the authentication transaction data shall be deleted except when such authentication transaction data are required to be maintained by a court or in connection with any pending dispute.

 

Updated regulation awaited.

Restriction on sharing of information

Presently, Aadhaar (Sharing of Information) Regulations, 2016 has no provision which impinges privacy rights of Aadhar card holders. (Section 29)

 

 

 

Disclosure of information

Read down Section 33(1):

A. Individual whose information is sought to be released to be given an opportunity of hearing.

B.Individual to be given the right to challenge disclosure of his/her information.

Sec 33(2) struck down with liberty to enact a suitable provision:

Determining if information disclosure is in the interest of national security will be done by-

a.Officer higher than rank of Joint Secretary

b.Application of judicial mind. (Judicial Officer/preferably sitting judge of High Court)

Section 33(1): Nothing contained in sub-section (2) or sub-section (5) of section 28 or sub-section (2) of section 29 shall apply in respect of any disclosure of information, including identity information or authentication records, made pursuant to an order of a court not inferior to that of a District Judge:

Provided that no order by the court under this sub-section shall be made without giving an opportunity of hearing to the Authority.

 

Section 33(2): Nothing contained in sub-section (2) or sub-section (5) of section 28 and clause (b) of sub-section (1), sub-section (2) or sub-section (3) of section 29 shall apply in respect of any disclosure of information, including identity information or authentication records, made in the interest of national security in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government of India specially authorised in this behalf by an order of the Central Government:

Provided that every direction issued under this sub-section, shall be reviewed by an Oversight Committee consisting of the Cabinet Secretary and the Secretaries to the Government of India in the Department of Legal Affairs and the Department of Electronics and Information Technology, before it takes effect:

Provided further that any direction issued under this sub-section shall be valid for a period of three months from the date of its issue, which may be extended for a further period of three months after the review by the Oversight Committee.

Amendments made to Section 33:

A.Under Section 33(1)(b) provides opportunity of hearing to the Aadhar holder.

B. Under Section 33B an aggrieved individual can appeal to TDSAT within a period of 45 days from the date of receipt of order.

C. Officer not below the rank of a Secretary will determine whether disclosure is in national interest.

D. Section 33A provides for civil penalties in case of in case of failure to comply with provisions of the Act/rules/regulations and directions.

E. Under Section 33B an officer not below the rank of a Joint Secretary shall be the adjudicating officer for holding inquiry.

The court had directed that a higher official in association with application of judicial mind determine the grounds of disclosure under Section 33(2).The Amendment did take cognizance of the judgment and prescribed for officer not below the rank of Joint Secretary. However as directed by the Court, the amendment finds no mention of determination by a judicial authority/officer.

Despite being criticized by the Majority judgment in the Aadhaar matter, the amendment fails to address the issue with respect to concentration of powers that lie with the Executive and lack of accountability.

The proposed amendment inserted a new provision on civil penalties. Even this change does not prescribe for application of judicial mind for the purpose of adjudication in event of failure to comply with the provision of the Act.

Thus, the amendment is not in consonance with the Aadhaar judgment.

Cognizance of complaints

Modification of Section 47: Include provision for filing complaints by an individual/victims.

Section 47:

(1) No court shall take cognizance of any offence punishable under this Act, save on a complaint made by the Authority or any officer or person authorised by it.

(2) No court inferior to that of a Chief Metropolitan Magistrate or a Chief Judicial Magistrate shall try any offence punishable under this Act.

Proviso has been inserted in Section 47. It enables the court to take cognizance of a complaint made by the Aadhar holder.

Until now, the court could take cognizance of an offence on a complaint made by only the UIDAI or an officer or a person authorised by it. The proviso also empowers an aggrieved individual to file complaints.

Establishing identity of individual for any purpose

There are two aspects to the Court's judgment on Section 57.

 

One part of the Section has been read down:

The provision is susceptible to misuse as it can be used to establish identity of an individual 'for any purpose'.

A. The 'purpose' in this Section has been read down to mean a purpose backed by law.

B. Any law made on this would need to be subjected to judicial scrutiny.

 

Another part of Section 57 has been held to be unconstitutional:

The part of this Section enabling body corporate and individuals to seek authentication is unconstitutional as:

A. Establishing identity for a purpose pursuant to any contract is impermissible as it is not backed by law and therefore does not meet test of proportionality.

B. Authentication services based on contract between individual and body corporate or person would:

B1. Enable commercial exploitation of individual biometric and demographic information by private entities.

B2. Impinge on right to privacy of individual.

Section 57:

Nothing contained in this Act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect:

Provided that the use of Aadhaar number under this section shall be subject to the procedure and obligations under section 8 and Chapter VI.

Section 57 has been omitted.

However, the Act now provides for voluntary use of Aadhaar number for authentication or offline verification.

To enable this, Section 4 (Properties of Aadhaar number) of the Act has been amended to allow verification of the Aadhaar number on voluntary basis with informed consent of the Aadhar number holder.

To facilitate this, the Amendment Bill seeks to amend Section 4 of Telegraph Act, 1885 and insert a new section 11A under PMLA.

The Bill removes section 57 from the Aadhaar Act. This omission is in compliance with the Aadhaar judgment.

However, the prescribed amendments to the PMLA Rules and Telegraph Act are contrary to the ratio of the majority judgement in Justice K.S. Puttaswamy (Retd.) v. Union of India & Ors. [W.P. (C) 494/2012].

In the Aadhaar judgment, J.Sikri in his majority judgment stated that apart from authorising the State, even ‘any body corporate or person’ is authorised to avail authentication services. This can be on the basis of purported agreement between an individual and such body corporate or person. Even if we presume that the legislature did not intend so, the impact of the aforesaid features would be to enable commercial exploitation of individual biometric and demographic information by the private entities.

The part of Section 57 that allowed for people to voluntarily provide their Aadhaar number to body corporates and individuals, especially on the basis of a contract between the person providing the Aadhaar number and the person acquiring / authenticating the Aadhaar number, has been held to be unconstitutional by the Supreme Court of India. The amendment to Section 4 of the Act would re-implement a clause that has already been ruled to be unconstitutional. This would raise the likelihood of fresh litigation on an aspect of law that has already been settled.

 

 

All Posts | Jan 02,2019

The Aadhaar and Other Laws (Amendment) Bill, 2018

 

Today, the Central Government introduced, The Aadhaar and Other Laws (Amendment) Bill, 2018 in the Lok Sabha. The Bill seeks to amend the Aadhaar Act, 2016 to comply with the conditions as set out in the Aadhaar judgment of the Supreme Court (Justice KS Puttaswamy v. UOI) [WP (Civil) No. 494 of 2012] and amend the Indian Telegraph Act, 1885 and the Prevention of Money-Laundering Act, 2002 to introduce voluntary linking of Aadhaar details with mobile connections and bank accounts.

For key highlights of the Aadhaar judgment, you may click - here and for reporting unwarranted requests of linking Aadhaar, you may click - here.

A copy of the Aadhaar and Other Laws (Amendment) Bill, 2018 may be accessed here:

All Posts | Nov 27,2018

Someone still asking for Aadhaar? Let us know!

Contrary to the Supreme Court’s judgment, some entities are still asking for Aadhaar

A nine judge bench of the Supreme Court delivered its verdict on Aadhaar on September 26, 2018 wherein the majority view, comprised of - Dipak Misra CJI., AK Sikri J., AM Khanwilkar, J. and Ashok Bhushan J. (though Bhushan J. dissented with the majority on certain points) upheld the constitutionality of the Aadhaar Act, 2016 barring a few provisions on disclosure of personal information, cognizance of offences and use of the Aadhaar ecosystem by private corporations. DY Chandrachud J. delivered a dissenting opinion declaring the entire Aadhaar scheme along with the Act to be unconstitutional.

“Benefits” and “services” as mentioned in Section 7 of the Aadhaar Act, the expenditure for which is derived from the Consolidated fund of India will require mandatory furnishing of Aadhaar, the judgment noted.

The Supreme Court also upheld Section 139AA of the Income Tax Act, under which every citizen who is eligible to obtain Aadhaar must quote either their Aadhaar Number or the Enrolment ID while filing Income Tax Returns or applying for PAN. However, we have come across instances wherein Aadhaar is being asked for, for the purpose of availing banking services and for recording attendance in colleges.

Apart from the above mentioned, Aadhaar is NOT mandatory for availing any other services like banking and telecom. Please refer to our FAQs for further information on this.

We have curated a list that contains instances of violations of the Supreme Court’s judgment, the data for which has been gathered from secondary sources mainly.

A lot of times, violations of the judgment are not reported by the media, and therefore we are creating a citizen reporting mechanism. Write to us at mail@sflc.in or send us a DM on our twitter handle (@SFLCin) if you come across any violation of the Supreme Court judgment and we shall help you by drafting contempt letters that can be sent to the violating entity.

 

Date

Violating entity

Kind of violation

1. 16/11/18


 

Jawaharlal Nehru Technological University, Hyderabad and all affiliate colleges

Aadhaar based Biometric attendance made mandatory for B.Tech students

2. As of Nov.27, 2018


 

Canara Bank

Aadhaar based e-KYC

3. As of Nov.27, 2018


 

Syndicate Bank

Aadhaar based e-KYC

4. As of Nov. 29, 2018


 

LazyPay (Android app)

 

Aadhaar based KYC

5. As of Dec. 2, 2018


 

EPFO

The website requires Aadhaar for withdrawal of PF;

Process life certificate for EPFO

6. As of Dec 3, 2018

 

Darpan ID

 

Aadhaar of board members necessary for getting the Darpan ID for NGOs.

7. As of Dec 3, 2018

HDFC Payzapp wallet

 

Aadhaar based KYC


 

8. Not known

Air Force Common Admission Test

 

Online Registration

 

 

 

 

All Posts | Oct 10,2015

Notes from proceedings before the Supreme Court on IAs filed in the matter of K.S. Puttaswamy & Ors. v. UOI (Aadhaar petitions) on 6th October, 2015

The Aadhaar - privacy debate witnessed a heated battle of words in the Supreme Court on Tuesday, October 6, when the Union of India, along with the State Governments of Gujarat, Haryana, Madhya Pradesh, Jharkhand and Andhra Pradesh, and Government agencies including RBI, SEBI and TRAI, sought the clarification and modification of an earlier interim order made by the SC in the matter of K.S. Puttaswamy and Ors v. UOI. The order, dated 11th August 2015 had referred the entire batch of petitions in the above mentioned case to a Constitutional Bench and in the interim permitted the use of Aadhaar only for PDS and LPG schemes.

Attorney General, Mukul Rohatgi representing the Union of India, started his arguments by stating that 92 crore people in India already have an Aadhaar card. It is only a number and can be used as the most widely held ID Card. For example, when it is checked for entry in the airport, there are no biometrics involved in that process. He wanted the SC to permit its non restricted usage on a voluntary basis, said he won’t get into the argument of privacy but gave m any elaborate examples on how the use of Aadhaar will be beneficial.

The first example was regarding elimination of fake people and ghosts in PDS schemes. He showed a small, portable machine in court that would be used. When a person’s biometrics are registered with Aadhaar, he claimed this machine would match his fingerprint with the picture on his Aadhaar card. This would authenticate a person’s identity and hence, ensure that the real person gets the benefits. He further elaborated with the example of MNREGA. He said that for the person employed under MNREGA, the money is directly credited to his bank account. Supposing, the bank is a few miles away from his village. He said that the Government as of now has 85,000 bank correspondents, 5-6 villages has one correspondent. Bank correspondent is like a mobile bank. He goes with the portable machine to each village and allows the MNREGA worker to withdraw or deposit money as per his need and provides them with a receipt. He claimed that this is a facility given to several crore workers. In this concept, it is not compulsory for these people to use this process that is facilitated by Aadhaar, it is purely on a voluntary basis.

The above mentioned method also stands true for pension schemes where old, infirm and widows are also asked to go to the pension office once a year in November and say that they are alive. These people can also use the facilities of bank correspondents and authenticate their identities with the help of Aadhaar. People can also open their bank accounts by this facility. Under the PM Jan Dhan Yojna, there is a scheme of a Zero Balance Account where a person can open a bank account without any initial balance. He asserted that all are schemes for the financial inclusion of those who are left behind. In a variant of these examples, he also mentioned that an Aadhaar card can also be used as an ID card by a migrant traveling in a train, etc.

Mr. Rohatgi insisted that it was not for 1 or 2 or 10 persons to say that we have some concerns over privacy and that someone is going to snoop. According to him, the fear is that the Aadhaar server will have the information about the population. He maintained that if a person with Aadhaar number XYZ went to the UCO Bank in SC, the UIDAI server only knows that a person with Aadhaar number XYZ went to a UCO Bank. He doesn’t know what he did there or about the transaction that was made. At this point, Justice Bobde commented that the UIDAI server will in this way, always know the location of a person. Mr. Rohatgi’s reply was about how mobile phones now a days know the location. Justice Chelameswar remarked, that a phone cannot keep a track of your location if the location services are switched off and Justice Bobde added that the people Mr. Rohatgi is talking about do not own smart phones. Mr. Rohatgi commented that even a phone costing 2000 rupees can track the location, thanks to the mobile towers and added that it doesn’t matter if they know where a person was because they cannot tell what he did there.

Justice Bobde told the AG that the court wanted to know if there are real apprehensions about the leaks. The AG fiercely replied that 50,000 people want to use Aadhaar for MNREGA and 10 people have some notions on privacy and he doesn’t understand what the big deal about it is. He said he was fighting not for the rich and effluent that have 5 million ways to go about things, but for the people with lesser means. Justice Bobde’s reply was simply that the court is just trying to balance the rights. The AG agreed that this data is only to be shared after a court order, but doesn’t understand what will happen even if the data is shared.

K.K. Venugopal, representing Centre for Civil Society

Mr. Venugopal said that assuming a person has a right to privacy, he should be allowed to waive it for greater benefit. But, the petitioners argue that the person will have to maintain his privacy. His argument was that a person can decide if he wants his privacy. Justice Bobde commented that a lot of uneducated people don’t know what they are parting with. Mr. Venugopal replied that what is the importance of these particulars to a poor man who is starving? The Justice said, that the parting with biometrics is only possible if the consent is informed. He added that the people do not have the information on the basis of which they can make an informed choice. They give it up for the benefits they are shown Aadhaar would provide. The AG interjected that if people have problems with it, they can choose not to use it. But Justice Bobde aptly retorted that the people do not know that THERE IS a problem to begin with. At this point, the AG resorted to the similar argument of not knowing what the notions of privacy were and that there should be no problems in the voluntary usage of Aadhaar card.

Justice Bobde said that the court saw the advantages, but they were here to see how much the privacy concerns mattered. Mr. Venugopal replied that what if we don’t want privacy, the court is insisting that we retain our privacy.

Government Agencies

Pension Fund Regulatory and Development Authority: They claimed that they had an online process for registering for the pension fund. It could be linked with one’s Aadhaar number and would simply port all the details from Aadhaar’s database, hence making the process very simple and paperless. The other method included filing lot of papers and was cumbersome. His main argument was about making otherwise cumbersome processes, paperless with the help of Aadhaar.

TRAI: They claimed that they had been issuing SIM cards since 2011 by using the Aadhaar number. This was for decreasing SIM card abuse and tracking down crime. The use of this was voluntary but they were soon thinking of making it mandatory. Justice Chelameswar, at this point could not understand how a SIM card and Aadhaar were linked to stopping terrorism and crime. The TRAI representative replied that SIM cards are usually sold without verification, terrorists don’t have Aadhaar and hence, they were trying to make it mandatory to verify the buyer of the SIM Card.

RBI: They were aggrieved about having to deny a lot of people who wanted to open bank accounts and only had the Aadhaar card as an ID proof. They sought clarifications on the interim order in this regard, i.e. where they to turn people down because the order restricted them to use Aadhaar cards for anything except LPG and PDS? The Insurance Regulatory and Development Authority of India (IRDAI) had the same grievance.

The AG in his final remarks said that he was not blaming the court, but he simply wanted to make the use voluntary for facilitating services to people with fewer means.

Mr. Shyam Divan appearing for the petitioner K S Puttaswamy started his arguments by pointing out that notice should not be issued on any of these applications because firstly, the matter was pending before a constitutional bench, secondly, because the interim order was passed very recently and thirdly, because at the very threshold the party in question is saying that whatever order you pass we will not obey.

He said that the order dated 11th August, 2015 had three orders:

  1. The reference to the constitutional bench

  2. That the constitutional bench notice the urgency of the matter

  3. Interim order

According to him all of these orders have to be read together. He contested that there no wide publicity given by central government with respect to the voluntariness of Aadhaar and that before they ask for a modification, the AG should satisfy that he has complied with the interim order. At this point, the AG produced a document that had a list of spending done and advertisements run across the nation. Mr. Divan argued that these Advertisements were in reality promoting Aadhaar. (for example, the text of the scroll running on the Aadhaar website and the advertisement usually given read: "Choose Aadhaar. It is voluntary. It is not mandatory for a citizen to obtain Aadhaar card.") He asserted that there were no government officials on site to counsel the people registering for Aadhaar.

Next, he argued that when the matter was referred to the Constitutional bench, nothing was pending before these judges on that matter, so these applications could not be taken up. (A judgment called Modern Dental (2012 (4) SCC 707) was cited on this point). The AG remarked that with this analogy, even the interim order would be invalid because it was made after the reference order on 11th August, 2015. Mr. Divan contended that the order was passed very recently and since then there has been no change in circumstances that could effectively warrant a change in the interim order. He further said that Aadhaar had no constitutional or administrative backing and was based on a notification. There is no mention of biometrics in the role and responsibilities of UIDAI. Mr. Divan asserted that fingerprints are a person’s most unique identity markers and belonged with him and it would only be a police state where a person would be asked to part with their biometrics when there is no legal sanction or administrative backing. He raised concerns about privacy on the grounds of lack of proprietary technology for registering biometrics and that French and US Defense contractors had close links to this project’s registration company.

He further said that the people had no option of opting/backing out of the system once registered. Regarding the problem raised on being the sole identity for many, Mr. Divan read out a Aadhaar registration form that needed at least one of the 18 listed ID proofs to be eligible for an Aadhaar card. The other system was an Introducer system that people who did not have any prior ID proof could use where a person from the community would corroborate their particulars. Mr. Divan showed data that only 2 lakh people out of the 92 crore had availed this facility. This implies that the rest already had a valid ID proof.

Meenakshi Arora raised some different points regarding the improvement of social welfare schemes. She said that the government has been shown demonstrations on how fingerprints can be easily duplicated with just fevicol. The machine that the AG produced, she said would hence be not as efficient as he is claiming in plugging leaks and weeding out ghosts from welfare schemes. She also said that there is a lip service being done about the part of the order that states that Aadhaar is not mandatory. The way the Government is describing the schemes, it seems that either one chooses Aadhaar or the cumbersome process. She produced affidavits from MNREGA workers, which said that when a worker did not have the Aadhaar card, the first thing the officials would say is that take him to the nearest Aadhaar office. She stated that the Government’s way of working was it is either my way or the high way and this cannot be the approach of a system or the government for its population.

Mr. Sai Deepak was representing Beghar Foundation, and argued that Aadhaar was used as an instrument of exclusion instead of inclusion. For manual workers and people who do strenuous work with their hands, do not have clear fingerprints and the iris scans do not work for people with cataracts and corneal blindness. Therefore, the system excludes this category of people.

The Attorney General made the last comments by saying that Mr. Divan’s arguments did not counter the benefits provided by Aadhaar to several crore people. He prayed for modification of the earlier interim order to non restricted voluntary use of Aadhaar.

UPDATE 1: Based on arguments advanced, the Supreme Court on October 7, 2015 issued an order referring all Aadhaar petitions to the Constitutional Bench. While pronouncing the order, the Court observed that since the main petition had already been referred to the larger Constitutional Bench, all opinions, including those raised on the previous day, deserved to be heard and adjudicated upon by the larger Bench.

UPDATE 2: On October 8, 2015, the Supreme Court issued a notice listing the Aadhaar petitions before the Constitutional Bench. The first hearing before the Constitutional Bench is now scheduled for October 14, 2015 at 2:00 PM.