Aadhaar Scheme: FAQ

This guest piece was written by Elonnai Hickok, Amber Sinha and Vanya Rakesh of the Centre for Internet and Society. It does not necessarily reflect the views or position of Privacy International.

In 2009, the Government of India set up the Unique Identification Authority of India (UIDAI) as an attached office of the erstwhile Planning Commission of India via an executive order. The mandate of the UIDAI was to assign a 12-digit unique identification (UID) number (termed as Aadhaar) to all the residents of India. While the original legislation to govern UIDAI was sent back by the Parliament’s Standing Committee with a number of recommendations, earlier this year, the government withdrew the old draft and introduced a new legislation, the Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016 (henceforth, Aadhaar Act) which was passed as a Money Bill, thus, circumventing a more extensive debate on the bill. The new legislation received a lot of attention, and criticism. This FAQ attempts to address the key questions regarding the Aadhaar project and the Aadhaar Act.

What Is The Aadhaar Scheme?

Aadhaar is a 12 digit individual identification number issued by the UIDAI to any resident of India. It is a random number, bearing no relation to the attributes or identity of the individual. Every resident is entitled to obtain an Aadhaar Number. It is a paperless, online identifier which can be used by any private or public organization/body/entity and authenticated by the UIDAI against the records in the UIDAI’s Central Identities Data Repository (CIDR). The stated objective of the Aadhaar scheme is effective targeted delivery of subsidies, benefits and services to residents of India.

What Is The Unique Identification Authority Of India?

The UIDAI is a corporate body responsible for performing functions assigned to it under the Act. Powers of UIDAI include enrolment and assignment of Aadhaar numbers to individuals, managing the CIDR, processing authentication requests from requesting entities, and specifying terms, policies, and practices for actors in the Aadhaar ecosystem.

Is The Aadhaar Scheme Mandatory?

In 2015 the Supreme Court stated that enrolment in Aadhaar is purely voluntary. However, the Aadhaar Act permits the government to make the Aadhaar number mandatory for access to certain government subsidies and benefits. There is a divergence between the stated objectives of the Aadhaar Act which is identification of individuals for targeted delivery of entitlements and the provisions of the Aadhaar Act which allows any entities, public or private, to use the Aadhaar number for authentication.

What Information Is Collected In The Process Of Enrollment?

The enrollment process includes submission of demographic information (such as information relating to the name, date of birth, address and any other relevant information specified) and biometric information by the individual. The definition of “biometric information” is vague and includes within its scope, aside from photographs, iris scans and fingerprint impression, the phrase, “other such biological attributes of an individual”. This gives sweeping discretionary power to the UIDAI / Central Government to expand the scope of the definition and include other potentially sensitive and identifying information.

What Have Been Past Issues With The Aadhaar Enrollment Process? 

There have been various implementation issues in the enrolmentprocess of the Aadhaar scheme including the collection of additional and unnecessary information not provided by law, such as bank account details, unclear retention, storage, and destruction standards for data collected by enrollment agencies, and inaccuracy in the collection of data.    

Section 23 of the Aadhaar Act specifies that appropriate technical and organisational security measures shall be put in place without elaborating upon what those measures should be or defining any standards that the UIDAI and its contractors will adhere to.

Further, there are no opt-out mechanisms in the legislation. This means that individuals cannot opt out and leave the Aadhaar ‘ecosystem’ once enrolled and their information is not deleted.

What Are The Protections Against A Person’s Information Stored In The Central Identities Data Repository (CIDR) Being Unlawfully Accessed?

The Aadhaar Act provides for legal safeguards to protect against unauthorized collection, access, disclosure and use of data in the Aadhaar project, and also prescribes penalties for the respective offences. Disclosure of information maintained in the CIDR can only be done on the orders of a District Judge for a purpose deemed fit by him, or if in the interest of national security, on directions of a Joint Secretary to the Government of India. It is noteworthy there is no established definition of the term ‘in the interest of national security’ under the Aadhaar Act or any other legislation, nor are there any guiding principles which articulate the circumstances and manner in which this power may be used.

Does The Scheme Empower Individuals To Claim Against Possible Unlawful Access Or Use Of Their Aadhaar Number?

A requesting entity is required to obtain the consent of an individual and inform them of:

(a) the nature of information shared upon authentication;

(b) uses to which the information received during authentication may be put; and

(c) alternatives to submission of identity information to the requesting entity.

However, the legislation does not provide for a clear and independent grievance redressal mechanism for individuals in case of harm or violation incurred through the scheme.

How Was The Aadhaar Bill Passed?

The Aadhaar Bill was introduced as a Money Bill in the Lok Sabha. Money bills are a subset of the financial bills which contain provisions only related to taxation, financial obligations of the government, expenditure from or receipt to the Consolidated Fund of India and any matters incidental to the above. The decision of whether a legislation is a Money Bill rests with the Speaker of the Lok Sabha.

Why Is Passing It As A Money Bill A Problem?

A Money Bill is peculiar in that it can only be introduced in the Lok Sabha, the lower house of the Parliament comprised of directly elected representatives. Following this, it is transmitted to the Rajya Sabha, the upper house of the Parliament comprising representatives nominated by the state legislatures. The Rajya Sabha’s powers are restricted to giving recommendations on the Bill and sending it back to the Lok Sabha, which the Lok Sabha is under no obligation to accept. The decision to introduce the Aadhaar Bill as a Money Bill has been widely seen as an attempt to circumvent the Rajya Sabha where the ruling party is in a minority. A petition by former Union Minister, Jairam Ramesh challenging the legislation on this ground is scheduled to be heard by the Supreme Court of India in detail after the Court vacations on June 21, 2016.

What Technology Is Used To Gather Information In The Aadhaar Scheme?

The enrollment and authentication process in the Aadhaar scheme involves the use of the Iris scanner, fingerprint scanner, and face camera. For the Aadhaar scheme, the biometric devices are provisionally certified by the Standardization Testing and Quality Certification (STQC) Directorate.

What Are The Potential Problems With Collecting And Using Biometrics In The Aadhaar Scheme?

The Biometrics Standards Committee of the UIDAI has itself acknowledged inaccuracies caused due to a high number of manual labourers in India, which would lead to sub-optimal fingerprint scans. A report by 4G Identity Solutions estimates that while in any population approximately 5% of the people have unreadable fingerprints, in India it could lead to a failure to enroll up to 15% of the population. A recent paper by Hans Varghese Mathews, a mathematician with the Centre for Internet and Society, shows the scheme would fail to uniquely identify individuals in a country of 1.2 billion. Based on data from an experiment performed at an early stage of the scheme, he concludes that the ratio of individuals would have their biometric identifiers matching those of some other person would be 1/121, which is extremely high.

Are There Challenges To The Legal Validity Of The Aadhaar Scheme?

Despite the legislation having been passed by the Parliament and received presidential assent, the project and the legislation continue to face judicial challenge in the form of two high profile petitions before the Supreme Court. The first is a PIL filed originally by Judge K S Puttaswamy, a former High Court judge which was combined with other petitions challenging the Aadhaar project. So far, the Supreme Court, in orders including those dated 11th August 2015 and 16th October 2015, has held that Aadhaar is not mandatory but voluntary. In the other petition, Jairam Ramesh, a former union minister has challenged the passage of the Aadhaar Act as a Money Bill, as unconstitutional. The Supreme Court shall hear the petition in July 2016 after court vacations. It remains to be seen how the court decides on these two issues and how much bearing they will have on the Aadhaar project.