Aadhaar [Day-3 Session-2] The Entire Aadhaar Project Entails Invasiveness And Breaches: Shyam Divan

If the Act is upheld as being constitutional, by virtue of the electronic trail, profiling and authentication records, it will be possible to know where one is at any point of time throughout his life, argued Divan

As the Aadhaar hearing continued post the lunch hour, senior counsel Shyam Divan elaborated on the provisions of the Aadhaar (Targeted Deliveries of Financial and Other Subsidies, Benefits and Services) Act of 2016.

In respect of the purpose with which the Aadhaar programme was envisaged, Divan referred to The Statement of Objects and Reasons of the Act- “The correct identification of targeted beneficiaries for delivery of various subsidies, benefits, services, grants, wages and other social benefits schemes which are funded from the Consolidated Fund of India has become a challenge for the Government ... In the absence of a credible system to authenticate identity of beneficiaries, it is difficult to ensure that the subsidies, benefits and services reach to intended beneficiaries”.

Enumerating the specific objectives of the Aadhaar Bill, the senior counsel continued: “Issue of Aadhaar numbers to persons providing demographic and biometric data to the UIDAI; linkage of the Aadhaar number with the subsidies, benefits and services attached to the Consolidated Fund of India; authentication of the Aadhaar number; establishment of the UIDAI; updation of information in the Central Identities Data Repository (CIDR); and security and confidentiality of information.”

Quoting the long title of the statute, he submitted that the Act is intended to “provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto”.

Connecting the definitions of ‘bio-metric information’ and ‘core bio-metric information’ in clauses (g) and (j), respectively, Divan drew to the attention of the bench to the fact that both these definitions are not exhaustive but open ended, delegating the power to include more biological attributes, by framing regulations, to the prescribed list of photograph, iris scan and fingerprints.

Reiterating his earlier argument as to how the ‘enrolling agency’ under the Aadhaar scheme could even be private entities and how 49,000 such entities had been blacklisted, Divan submitted, “Now the concept is defined under the statute. An enrolling agency may be appointed by the UIDAI or even the Registrar.”

In context of the definition of ‘registrar’ in clause (s), the senior counsel remarked, “The enrolment is not being done by the UIDAI.”

Authentication

“Section 7 has been used by the government for introduction of the present statute as a Money Bill and also, to advance the ‘purpose’ argument in favour of the Act. But the Proviso appended here to clarifies that even alternative ID proofs shall be acceptable in the absence of the Aadhaar card,” contended the senior counsel.

Continuing in the same thread, he stated, “The notion of alternative ID is also evident in section 8(3)”.

In relation to section 9, providing that the Aadhaar card shall not be evidence of citizenship, domicile etc, Divan submitted, “But at the passport office, Aadhaar card is admitted as proof of address”.

 Unique Identification Authority of India (UIDAI)

Moving on to the powers and functions of the UIDAI, as enumerated in Section 23, he emphasised on the overreaching powers of the Authority, “Clause (a) of subsection 2 empowers the Authority to specify by regulations the biometric and demographic data to be collected. If it so desires, it shall also be entitled to collect voice samples, DNA etc in addition to the stipulated biological attributes.

Clause (c) requires the UIDAI to appoint an entity to operate the CIDR. These are advances technologies being developed by foreign contractors who may have access to the confidential data that was to remain proprietary to the Central government.

Clause (g) confers upon the UIDAI the power to deactivate the Aadhaar number. The Authority has been given a switch by which all the civil rights of an individual could disappear.

By virtue of the phrase ‘other purposes’ in clause (h), the UIDAI is entitled to mandate Aadhaar numbers for other than Subsidies, Benefits and Services”.

Stressing the provisions of subsection (3) of section 23 permitting the UIDAI to enter into agreements with the Central or state governments or any Union Territory for performing any functions such as collection, storage or processing of data, and to appoint any registrars or other agencies in the same behalf, Divan commented, “So it is not only the UIDAI that is gathering, storing, securing and processing this confidential information.”

Protection of Information

Thereafter, the senior counsel touched upon section 29 dealing with the restrictions on sharing information. At this juncture, an interaction took place between him and Justice DY Chandrachud. It has been reproduced here:

Justice Chandrachud: How does this section have a bearing on the constitutional validity of the Act?

Divan: The entire Aadhaar project entails invasiveness and breaches. The scheme is unbecoming of a liberal, democratic society. The statute protects the programme, and hence, even the Act is bad. The particular provision of section 29 is of no major consequence with regard to the unconstitutionality of the Act.

Justice Chandrachud: You have argued so far that the entire Aadhaar programme is unconstitutional. There is another facet of this- that there are some bottlenecks in the programme that can be ameliorated. Will you argue on that?

Divan: No, I will only mention that aspect. There are websites publishing huge numbers of Aadhaar cards. There is a concern regarding being protected from extensive profiling. Whether it is constitutional remains to be determined. Surely a democracy entails some amount of trust in the citizens. There are two aspects here- one, not to procure the Aadhaar at all, or secondly, not mandate the usage of Aadhaar everywhere and allow alternative ID proofs.

On section 32, he submitted, “The judgment of the 9-judge bench of this Court on the right to privacy speaks of the electronic trail that is left behind. Although section 32 ostensibly restrains the UIDAI from keeping any information about the purpose of authentication, we have already seen that the time and the location of authentication is knowable. Further, Regulation 26 of the Aadhaar (Authentication) Regulations of 2016 requires the UIDAI to store and maintain metadata relating to the authentication transaction. This represents the concern about profiling. I am not saying that someone is stalking, but the architecture is such that there is potential for the same”.

Justice Chandrachud: Even in the absence of the Aadhaar, your relationship with private entities is tracked. So how does the Aadhaar become a problem? I do not want this question answered right now though.

Chief Justice Dipak Misra proceeded to summarise the arguments advanced by the senior counsel for the petitioners till date: Your concern is regarding the involvement of private entities without any state control; even if the Aadhaar scheme is optional and restricted to subsidies, benefits and services, the state has no proprietary over the digital autonomy of the individual in view of the conferment of power on third parties; and in context of data sharing, the entire Act is unworkable.

Divan: You have captured the submissions correctly.”

Thereupon Senior Advocate Kapil Sibal also joined in the discussion.

Sibal: There is no such thing as a secret in this world. The concern is regarding the compulsion to share information of a sensitive nature. But also to what extend can the State seek information from me under one umbrella? There are instances where taxi service providers are demanding Aadhaar, a single woman has been asked by the employer to supply Aadhaar. Should the mandate of Aadhaar extend beyond the subsidies and other social schemes? These are the broad issues for the bench to decide.

Justice Chandrachud: The concern regarding profiling is fine. But is that not helped by restriction on the use of data for a specific purpose?

Sibal: By virtue of section 57 and other provisions of the Act, any private entity can ask for Aadhaar.

Divan: There is a huge difference between state and private agencies. The State is entitled to exercise a definite amount of power over the citizens. Also, it is the obligation of the State to safeguard the privacy interests of the citizens from itself as well as the private entities. If the Act is upheld as being constitutional, by virtue of the electronic trail, profiling and authentication records, it will be possible to know where one is at any point of time throughout his life.

Justice AK Sikri: Even if the Act is held to be constitutionally valid, we will determine how far the use of Aadhaar may be mandated- only as under section 7 or for other purposes as well.

Offences and Penalties

On section 47 of the Act, requiring a court to take cognisance of any offence punishable under the Act only on the complaint of the UIDAI or any officer authorised by it, Divan remarked,

“An individual who has been enrolled under the Act has no locus standi (in it).”

Miscellaneous

In respect of section 48, empowering the Central government to supersede the UIDAI in certain circumstances, the senior counsel submitted, “This provision may not so important in an ordinary statute. But under the Aadhaar Act, it is of great consequence in view of the extent of control of the government”.

Further, Divan drew the attention of the bench to section 51, whereunder the UIDAI is entitled to delegate to “any other person” any of its powers or functions.

In respect of section 57 providing that the Act does not prohibit the use of Aadhaar number for establishing the identity of an individual for any other purpose as may be required by any law or contract to that effect, an interesting exchange followed.

Divan: Aadhaar may be mandated for any service even by private entities and by virtue of merely a contract.

Justice Sikri: Only by giving your Aadhaar number, your data is not leaked.

Divan: I need to uplift your imagination much higher ... one is being required to give their Aadhaar number to several persons. That, combined with the other information already available to them, can be used to build a complete profile. And sometimes, one has no choice, like in the instance of taxi service providers cited by Mr. Sibal.

Justice Chandrachud: One is also required to submit their PAN at numerous places.

Divan: The Aadhaar number is linked to one’s biometric data.

Justice Chandrachud: That data is confined to the CIDR. One is only required to give their Aadhaar number.

Diwan: Let us say, for example, for obtaining a new telephone connection, some company requires fingerprints. The prints can be skimmed from the reader, removed and collected. And this is being done.

The hearing shall continue on Wednesday.