Defender of your Digital Freedom

All Posts | Mar 07,2018

SFLC.in at the Internet Freedom Festival, 2018

The 2018 edition of the Internet Freedom Festival (IFF) is being held from March 5 - 9 in Valencia, Spain. IFF is an annual gathering that brings together those who defend digital rights around the world – journalists, activists, technologists, policy advocates, digital safety trainers, and designers – to build an inclusive space for knowledge sharing, increase diversity within the Internet freedom community, and collectively aid vulnerable communities by mapping censorship, surveillance and access obstacles. Read more about the IFF here.

This year at IFF, we are organizing a panel discussion to discuss how privacy and data protection norms must adapt to the advent and widespread use of biometric technology. The session is titled "Privacy and Data Protection in the Age of Biometrics", and will take place on Wednesday, March 7, 2018 from 12:15 - 1:15 PM in the theater at Las Naves Innovation Center. We have a great panel of experts from across the multi-stakeholder community sharing their views and experiences on the issue, so make sure to stop by if you're attending the IFF. Additional details regarding the session are available here.

We will also be at the expo area from 2:00 - 4:00 PM on Tuesday, March 6, 2018. You can say hello to Priyanka Chaudhuri from our team there, who will be happy to answer any questions about our work.


All Posts | Dec 28,2017

Extension of Aadhaar linking deadlines: What’s the catch?

Earlier this month on December 14, a five-judge Constitution Bench of the Supreme Court (SC) of India heard arguments for interim relief from a batch of 28 petitions (led by K S Puttaswamy v. Union of Indiai) that challenge the overall validity of the Aadhaar scheme on various grounds. The Bench comprised Chief Justice of India Dipak Misra and Justices A.K. Sikri, A.M. Khanwilkar, D.Y. Chandrachud and Ashok Bhushan. The matters were being heard for interim relief as Aadhaar, claimed to be a purely voluntary biometric ID program, had already been made a mandatory prerequisite to avail numerous Central and State Government schemes across India. Additionally, all bank accounts in India were to be linked to Aadhaar by December 31, 2017ii failing which they would be deactivated. Mobile phone numbers were under a similar mandate with February 6, 2018 as the stipulated deadline.iii As the SC had yet to commence final hearing on the 28 petitions, interim relief was sought so that residents would not be compelled to link Aadhaar to various schemes and services until there was a verdict on Aadhaar’s legal validity.

The hearing

Over the course of the day, the petitioners’ arguments focused mainly on the fact that Aadhaar was projected as a voluntary scheme and mandatory linking is therefore not permissible.

Senior Advocate Shyam Divan, counsel for the petitioners, pointed to a series of interlocutory orders issued previously by the SC in this matter, all of which had said that Aadhaar is non-mandatory and that no one is to be deprived of entitlements merely for want of Aadhaar. He laid special emphasis on two orders issued in August and October 2015, which had restricted even the voluntary use of Aadhaar to six Government schemes. Mr. Divan argued that all these orders have repeatedly been disregarded even though none of them were varied or modified by the SC. On CJI Misra’s observation that there may be a need to reconsider things now that Aadhaar has a governing legislation, Mr. Divan said that once an order is issued by the SC, unless it is expressly set aside, varied or merged, it stands as is.

Mr. Divan also referred to various provisions of the Aadhaar Act to support his contention that Aadhaar was meant to be purely voluntary. Among other things, he highlighted that the Act clearly labels Aadhaar an “entitlement” rather than an “obligation”, and has express provisions on alternate means of identity verification for when Aadhaar is unavailable.

On the issue of linking Aadhaar to mobile phone numbers, Mr. Divan said the Department of Telecommunications (DOT) circular that made linking mandatory was issued without statutory backing. He pointed out that the SC’s order in the Lokniti Foundation caseiv, which purportedly mandated re-verification of all mobile phone numbers using Aadhaar, was in fact misinterpreted by the DOT. He then listed out various Aadhaar linking deadlines that had not been extended, and concluded by requesting the Court to reiterate its earlier orders that determined Aadhaar to be voluntary.

Senior Advocate Gopal Subramanium argued next for the petitioners, and began by saying that the paramountcy of the Court is in question in this case. He said that in passing its earlier orders keeping Aadhaar voluntary, the SC had exercised its jurisdiction to insulate residents against compulsion, duress, or any form of force by which they would have to part with their personal information. The orders, he said, had jurisprudential bases in citizens’ rights and so cannot be removed by a statue. On being asked by Justice Chandrachud if Section 7 of the Aadhaar Act didn’t effectively allow the Government to make Aadhaar compulsory, Mr. Subramanium said the real question is whether it can introduce a mandate overriding the orders of the Court. When considered in juxtaposition with the orders, notifications issued under Section 7 do not constitute delegated legislation, but only conditional legislation. He concluded by saying that rule of law warrants obedience to the orders of Court, hence the sanctity of the orders should be preserved.

Following this, Senior Advocate Arvind Datar argued for the petitioners that even if Aadhaar can be made mandatory under Section 7 of the Act, it can only be done with respect to matters having a direct nexus with the Consolidated Fund of India (CFI) or for subsidies and benefits. He said that Aadhaar is being made mandatory for matters not connected to any of the above, like for obtaining death certificates. Pointing towards Article 144 that all civil authorities must act in aid of the Supreme Court, he concluded by saying that Aadhaar cannot be made mandatory if does not have a nexus with the CFI.

Senior Advocate KTS Tulsi went next for the petitioners, focusing his arguments on the issue of data protection. He said that if Aadhaar data is shared with private companies in the absence of a data protection law, the individual’s right to privacy would be in danger. Referring to several cybersecurity incidents involving large-scale data leaks, Mr Tulsi contended that no action could be taken in these cases due to the absence of data protection laws. He further argued that once the data has been leaked, there would be no way to repair the damage that has already been done. The only way to prevent this from happening, said Mr. Tulsi, is to nullify the entire exercise of Aadhaar.

At this point, Justice Khanwilkar intervened to observe that Section 29 of the Aadhaar Act does in fact provide an extent of safeguard against data breaches. Senior Advocate Anand Grover replied to this, pointing out that while Section 29 does propose to safeguard data, adequate measures and infrastructures are currently not in place. He also touched upon the fact that biometric information like iris and fingerprint scans are not foolproof and can be spoofed with relative ease. Moreover, biometric technology has high failure rates, he said, which means people are being excluded from entitlements because of the use of Aadhaar at various levels of governance.

After the petitioners’ arguments, Attorney General of India K.K. Venugopal submitted that the Central Government had extended the deadline for linking Aadhaar to all its schemes to March 31, 2018. He added that the deadline for linking Aadhaar to existing bank accounts had been extended to March 31, 2018, and that new bank accounts can be opened by submitting proof of having applied for Aadhaar, but the linking process itself may be completed by March 31. He also said that in light of these extensions, the SC may come to a decision on extending the deadline for linking Aadhaar to mobile phone numbers.

The petitioners reiterated their prayer that no denial of benefits and services be allowed for want of Aadhaar and that no coercive action be permitted towards Aadhaar enrollment or linking. They further requested that the deadlines for linking both mobile phone numbers and bank accounts (old and new) be extended to March 31, 2018.

The order

After hearing all arguments, an interim order was issued by the SC on Friday, December 15. The operative parts of this order are:

  • The deadlines for linking Aadhaar to all Central and State Government schemes stand extended to March 31, 2018.

  • The deadline for linking Aadhaar to existing bank accounts stands extended to March 31, 2018.

  • When opening new bank accounts, proof of having applied for Aadhaar must be submitted in the form of an application reference number, but the actual linking process can be completed by March 31, 2018.

  • The deadline for linking Aadhaar to mobile phone numbers stands extended to March 31, 2018

  • Section 139AA of the Income Tax Act continues to be governed by the SC’s judgment in Binoy Viswam v. Union of India,v which means:

    • Aadhaar number (or application reference number, for non-Aadhaar-holders) must be quoted when applying for a new PAN card and when filing income tax returns.

    • Existing Aadhaar holders must link Aadhaar to PAN by March 31, 2018, but in case of failure to do so, PAN will be considered invalid only with prospective effect.

    • Non-Aadhaar-holders need not link Aadhaar to PAN.

The catch

While all extensions of deadlines are certainly welcome, this interim order suffers from at least two serious flaws that in our opinion defeat the purpose of the extensions for a large section of the population.

First, the order makes it necessary to supply Aadhaar application reference numbers when opening new bank accounts. As application reference numbers are not allotted without going through the Aadhaar enrollment process i.e. by submitting demographic and biometric information, residents are effectively forced to enroll for Aadhaar before they can open new bank accounts. Considering that the idea behind awarding interim relief is to keep residents from being forced into the Aadhaar system while its legal validity remains undetermined, the present order has clearly failed to achieve its goal. The fact that the actual linking process can be completed by March 31, 2018 offers no respite as residents would still have to compromise their privacy and security by submitting extremely sensitive personal information to a central database with unproven security infrastructures.

Secondly, the SC’s judgment in Binoy Viswam v. Union of India was widely criticized at the time for refusing to remove the requirement to submit Aadhaar details when applying for new PAN cards or filing tax returns. The judgment also introduced a bizarre arrangement, where non-Aadhaar-holders were exempted from linking Aadhaar to PAN while existing Aadhaar holders were still required to link the two, albeit with less severe consequences in case they do not comply. The present order does nothing to clear things up, which means all shortcomings applicable to Binoy Viswam are also reflected in this order.

That being said, it is important to keep in mind that a final determination as to the overall legal validity of the Aadhaar scheme remains pending from the SC. The final hearing on Aadhaar’s validity is now scheduled to commence before the same Constitution Bench on January 17, 2018. Needless to say, this will be one of the most crucial technology-related litigations that India has ever seen, as it will, for the first time, test a large-scale national biometric initiative against the newly and definitively established fundamental right to privacy and more. For now, unless you are looking to open a new bank account, apply for a new PAN card or file your tax returns, you can temporarily set aside all Aadhaar linking concerns and await a final determination on its legal validity from our Apex Court.

i W.P.(C) No. 494/2012

ii This deadline was extended by a Ministry of Finance notification [G.S.R. 1506(E), December 12, 2017] to March 31, 2018

iii File No.: 800-26/2016-AS.11

iv Lokniti Foundation v/s Union of India; W.P.(C) No. 607/2016; see order dated 16/02/2017

v Binoy Viswam v/s Union of India; W.P.(C) No. 247/2017

All Posts | May 21,2016

Journey of Aadhaar

The Aadhaar scheme has undergone scrutinies and challenges at various levels since its inception as the flagship program of the Unique Identification Authority of India (UIDAI) in 2006. In its journey, there have been two separate Bills aimed at according it a statutory status, an extensive scrutiny by a Standing Committee, multiple challenges in the Supreme Court, and heated debates in the Parliament over the Aadhaar Bill, 2016 (now the Aadhaar Act). The following is a time-line, recording the entire Aadhaar process from 2006-2016.

2006:March 3rd: Department of Information Technology, Ministry of Communications and Information Technology gave an administrative approval for a scheme to issue unique ID for Below Poverty Line (BPL) families.

2006:December 4th: Constitution of an Empowered Group of Ministers (EGoM) to collate two schemes -the National Population Register under the Citizenship Act, 1955 and the UID scheme.

2007: First meeting of the EgoM took place where the need for creating an identity related resident database was recognized, thereby leading to the creation of Aadhaar.

2009: The Unique Identification Authority of India (UIDAI) was constituted for the purpose of issuing unique identification numbers by the Central Government. It was decided that the UIDAI will be executive in nature and function under the Planning Commission. Nandan M. Nilekani was appointed as the first chairman of this Authority.

2010: December 3rd: The National Identification Authority of India Bill, 2010 (NIAI Bill) was introduced in Rajya Sabha by the UPA government.

2010: December 10th: The NIAI Bill, 2010 was referred by the Lok Sabha Speaker to a Standing Committee for examination and a report thereafter

2011:December: The Standing committee on Finance under Yashwant Sinha issued a report on the NIAI Bill and rejected the bill in its initial form. It gave recommendations, including the requirement for an over arching privacy legislation and data protection law before the continuance of the scheme, and expressed concern about private agencies being contracted for the collection of sensitive information.

2012: Justice K.S. Puttaswamy, former Karnataka High Court Judge, filed a petition (W.P.(C) 494/2012) before the Supreme Court contending that Aadhaar does not have any statutory basis, and moreover violates fundamental rights of equality & privacy granted to every individual under the Constitution.

2013: Supreme Court in an interim order stated that no person should suffer for not having an Aadhaar card, even if it has been made mandatory by certain authorities to avail benefits (Order dated 23rd September, 2013)

2014: An order is issued by the Supreme Court in the case of UIDAI v. Central Bureau of Investigation (CBI) (SLP (Crl) 2524/2014), (subsequently tagged with Justice Puttaswamy's petition) asking agencies to revoke any orders made by them making Aadhaar mandatory for availing benefits. Moreover, it also forbid the UIDAI from sharing any information in the Aadhaar database with any agency without the data subject's consent. (Order dated 24th March, 2014)

2015: August: Three-judge bench of Supreme Court in an order restricted the use of Aadhaar to schemes of LPG, and PDS, and held that no one would be denied the benefits rightfully entitled to them for the lack of an Aadhaar card. It also refers the question of right to privacy as a fundamental right to citizens of India to a Constitutional Bench. (Order dated 11th August,2015)

2015: October: A five judge bench constituted for seeking clarifications on the August order, reiterates that Aadhaar is not mandatory for availing any benefits, but in the interim, expands the scope of the scheme to PDS, LPG, MNREGA, National Social Assistance Program, PM's Jan Dhan Yojna, and Employees' Providend Fund Organization. It further asks the CJI to expeditiously constitute a Bench for final hearing of the matter. (Order dated 15th October,2015)

2016: March 3rd: Aadhaar (Targeted Delivery of Financial & Other Subsidies, Benefits & Services)Bill introduced as a money bill in Lok Sabha

2016: March 11th: Aadhaar Bill, 2016 discussed and passed by the Lok Sabha with no amendments, and forwarded to the Rajya Sabha for their consideration

2016: March 16th: Rajya Sabha sends the Bill back to Lok Sabha with its recommendations. Lok Sabha does not consider the recommendations and passes the bill in its original form.

2016: March 25th : President gives assent to the Aadhaar Bill, 2016, according it the status of a law, but the Act will take a few months to come into force.

2016: March 26th: The Aadhaar (Targeted Delivery of Financial & Other Subsidies, Benefits & Services) Act, 2016 is notified in the Gazette of India.

2016: April 7th: Jairam Ramesh, member of Rajya Sabha, moves a petition (W.P. (C) 231/2016) in the Supreme Court challenging the introduction and passing of Aadhaar Act as a money bill.

2016: April 25th: The Supreme Court wishes to hear the Attorney General on 10th May, 2016 before issuing notice in the matter moved by Jairam Ramesh.

2016: May 10th :With respect to Jairam Ramesh's petition, the Attorney General argues in the Supreme Court that decision of the Lok Sabha Speaker to treat a Bill as money bill is not open for judicial review. However, the Supreme Court asks Jairam Ramesh to submit a note of their submissions & case laws and adjourns the hearing till July.

Image Credits: Projet de biométrie. Credit: Benoit Crouzet/Flickr CC BY 2.0