The Aadhaar Amendment Bill Contravenes Privacy Judgment Of SC

On January 2,  the Minister for Electronics and IT, Shri Ravi Shankar Prasad introduced the Aadhaar Amendment Bill, 2018 in the Lok Sabha. This Aadhaar Amendment Bill is a legislative follow up to the judgement of the Supreme Court on the constitutionality of the Aadhaar Program where several directions were given and parts of the Aadhaar Act, 2016 were declared unconstitutional. The proposed amendments, specifically on the point of surveillance, are in clear contravention of Supreme Court directions and even may be a stratagem to circumvent it as we explain below.

Background to the Aadhaar amendment

While we understand the need for a legislative amendment, there are questions on the timing of this legislative proposal where it has come close to the winter break, and has been done without any public consultation. These concerns are leading to many worrying that the Aadhaar Amendment Bill is being "bulldozed" without adequate transparency or public feedback on the wider problems with the programme itself. For a more holistic assessment we invite our readers to check with the updates over at the, "Rethink Aadhaar" campaign who also have put up a specific post on it.

Limiting ourselves to the aspect of surveillance, it is proper to look at Section 33 of the Aadhaar Act, 2016. This provision contemplated the sharing of Aadhaar data in two conditions and is pasted below. In sub-section 33(1) it contemplated when the sharing occurs on a direction by a district judge, and in sub-section 33(2) when it is done by an order at the level of a "joint secretary" to the Government of India.

Section 33.-- Disclosure of information in certain cases.

(1) Nothing contained in sub-section (2) or sub-section (5) of section 28 or sub-section (2) of section 29 shall apply in respect of any disclosure of information, including identity information or authentication records, made pursuant to an order of a court not inferior to that of a District Judge: Provided that no order by the court under this sub-section shall be made without giving an opportunity of hearing to the Authority.

(2) Nothing contained in sub-section (2) or sub-section (5) of section 28 and clause (b) of sub-section (1), sub-section (2) or sub-section (3) of section 29 shall apply in respect of any disclosure of information, including identity information or authentication records, made in the interest of national security in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government of India specially authorised in this behalf by an order of the Central Government:

Provided that every direction issued under this sub-section, shall be reviewed by an Oversight Committee consisting of the Cabinet Secretary and the Secretaries to the Government of India in the Department of Legal Affairs and the Department of Electronics and Information Technology, before it takes effect:

Provided further that any direction issued under this sub-section shall be valid for a period of three months from the date of its issue, which may be extended for a further period of three months after the review by the Oversight Committee.

Judgement of the Supreme Court

The Supreme Court judgement on Aadhaar is split into three opinions, and for our purposes owe are only using the Judgement of Justice A.K. Sikri which forms the operative directions. The specific findings on Section 33 are contained in paragraph below:

Page 545

"(iii) Section 33(1) of the Aadhaar Act is read down by clarifying that an individual, whose information is sought to be released, shall be afforded an opportunity of hearing.

(iv) Insofar as Section 33(2) of the Act in the present form is concerned, the same is struck down."

Page 558

"(e) Section 33(1) of the Act prohibits disclosure of information, including identity information or authentication records, except when it is by an order of a court not inferior to that of a District Judge. We have held that this provision is to be read down with the clarification that an individual, whose information is sought to be released, shall be afforded an opportunity of hearing. If such an order is passed, in that eventuality, he shall also have right to challenge such an order passed by approaching the higher court. During the hearing before the concerned court, the said individual can always object to the disclosure of information on accepted grounds in law, including Article 20(3) of the Constitution or the privacy rights etc.

(f) Insofar as Section 33(2) is concerned, it is held that disclosure of information in the interest of national security cannot be faulted with. However, for determination of such an eventuality, an officer higher than the rank of a Joint Secretary should be given such a power. Further, in order to avoid any possible misuse, a Judicial Officer (preferably a sitting High Court Judge) should also be associated with. We may point out that such provisions of application of judicial mind for arriving at the conclusion that disclosure of information is in the interest of national security, are prevalent in some jurisdictions. In view thereof, Section 33(2) of the Act in the present form is struck down with liberty to enact a suitable provision on the lines suggested above."

It becomes clear from the above that changes are required in both sub-sections. With Section 33(1) requiring the opportunity of a hearing prior to a judge ordering disclosure; and Section 33(2) requiring that not only an officer higher than the rank of a Joint Secretary ordering the sharing of Aadhaar data, but the oversight of a high court judge. Now let us look how does the Aadhaar Amendment Bill, 2018 deal with it.

Aadhaar Amendment Bill, 2018 circumvents the SC Decision

The Aadhaar Amendment Bill, 2018 ostensibly seeks to comply with the Supreme Court judgement on surveillance but does very little to provide safeguards and protections as directed by it. In clause 12 of the Amendment Bill the changes to Section 33 of the Aadhaar Act, 2016 are proposed. It is important here to concentrate on Section 33(2) which deals with executive orders which form the bulk of information sharing requests in forms of interception of surveillance. The reason being that intelligence bodies source their information requests through the the Central Government rather than through courts.

Here the amendment, to subsection 33(2) only seeks to replace the functionary with the substitution of the word, "Joint Secretary" to, "Secretary". Hence, there is still no judicial oversight as directed by the Supreme Court judgement. The centralisation of surveillance powers without any checks and balances has been criticised in several analysis such as by Chaitanya Ramachandran and in a separate paper by Rishab Bailey, Vrinda Bhandari, Smriti Parsheera, Faiza Rahman.

This omission by the Aadhaar Amendment Bill, 2018 is not casual or an oversight and speaks to the larger trend with the MHA notification authorising 10 intelligence and police agencies to conduct digital surveillance, and the proposed intermediary guidelines which seek to break encryption with traceability. It also is telling of the legislative priorities where there is no movement on the Government's flawed, inadequate Data Protection Bill. This proposed legislation in addition to lacking a clear legislative roadmap and now looking as an afterthought is also substantially deficient as it does not contain provisions for judicial oversight for surveillance.

We at #SaveOurPrivacy are campaigning for an alternative that protects you and also balances the state interest in your protection and safety. Our draft law, which we have termed the Indian Privacy Code, 2018 contains a well thought and developed proposal for surveillance reform that requires judicial involvement along with the data protection authority. Without such a law, as we have stated before India runs the risk of turning into a surveillance state.

(Apar Gupta is a lawyer and Executive Director of Internet Freedom Foundation. Opinions are personal)

(The article, which was originally published in www.saveourprivacy.in, is published here as such without editing)