“…Directive 2006/24 covers, in a generalised manner, all persons and all means of electronic communication as well as all traffic data without any differentiation, limitation or exception being made in the light of the objective of fighting against serious crime… …Whilst seeking to contribute to the fight against serious crime, Directive 2006/24 does not require any relationship between the data whose retention is provided for and a threat to public security and, in particular, it is not restricted to a retention in relation (i) to data pertaining to a particular time period and/or a particular geographical zone and/or to a circle of particular persons likely to be involved, in one way or another, in a serious crime, or (ii) to persons who could, for other reasons, contribute, by the retention of their data, to the prevention, detection or prosecution of serious offences.”386 “Not only is there a general absence of limits in Directive 2006/24 but Directive 2006/24 also fails to lay down any 385 Ibid, at para 51 386 Ibid, at paras 57-59 289 PART H objective criterion by which to determine the limits of the access of the competent national authorities to the data and their subsequent use for the purposes of prevention, detection or criminal prosecutions concerning offences that, in view of the extent and seriousness of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, may be considered to be sufficiently serious to justify such an interference. On the contrary, Directive 2006/24 simply refers, in Article 1(1), in a general manner to serious crime, as defined by each Member State in its national law.”387 The Court concluded that the Directive failed to set out “clear and precise rules”388 for access or for how states should judge the period of time for which data should be held, and “entails a wide-ranging and particularly serious interference with those fundamental rights in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary.”389 The Court struck down the Directive on the basis of the scope of the data to be retained, 390 the lack of limits imposed on state access,391 and the failure to distinguish between the treatment of data based on its usefulness and relevance.392 Of crucial importance is the Court’s emphasis that the judicial review of the EU legislature’s discretion “should be strict” because of “the important role played by the protection of personal data in the light of the fundamental right to respect for private life and the extent and seriousness of the interference with 387 Ibid, at para 60 388 Ibid, at para 54 389 Ibid, at para 65 390 Ibid, at paras 56 –58 391 Ibid, at paras 60-62 392 Ibid, at paras 59, 63– 64 290 PART H that right caused by Directive 2006/24”.393 In addition, the Court emphasized that even highly important objectives such as the fight against serious crime and terrorism cannot justify measures which lead to forms of interference that go beyond what is ‘strictly necessary’.394 213 In Michael Schwarz v Stadt Bochum,395 the Court of Justice of the European Union was called upon to examine the validity of a provision in a Council Regulation that obliged persons applying for a passport to provide fingerprints which would be stored in that passport. In considering whether this regulation was valid and necessary, the Court observed:
“…Article 1(2) of Regulation No 2252/2004 does not provide for the storage of fingerprints except within the passport itself, which belongs to the holder alone.396 The regulation not providing for any other form or method of storing those fingerprints, it cannot in and of itself…be interpreted as providing a legal basis for the centralised storage of data collected thereunder or for the use of such data for purposes other than that of preventing illegal entry into the European Union.397 In those circumstances, the arguments put forward by the referring court concerning the risks linked to possible centralisation cannot, in any event, affect the validity of that regulation and would have, should the case arise, to be examined in the course of an action brought before the competent courts against legislation providing for a centralised fingerprint base. In the light of the foregoing, it must be held that Article 1(2) of Regulation No 2252/2004 does not imply any processing of fingerprints that would go beyond what is necessary in order to achieve the aim of protecting against the fraudulent use of passports. It follows that the interference arising from Article 1(2) of Regulation No 2252/2004 is justified by its aim of protecting against the fraudulent use of passports.”398 393 Ibid, at para 48 394 Ibid, at para 51 395 [2013] EUECJ C-291/12 396 Ibid, at para 60 397 Ibid, at para 61 398 Ibid, at para 62 291 PART H The Court held that although the taking and storing of fingerprints in passports constituted an infringement of the right to respect for private life and the right to protection of personal data, Article 1(2) of Regulation No 2252/2004 did not imply any processing of fingerprints that would go beyond what is necessary in order to achieve the aim of protecting against the fraudulent use of passports and was therefore valid.
214 In Madhewoo v The State of Mauritius,399 the Judicial Committee of the Privy Council heard an appeal from a judgment of the Supreme Court of Mauritius regarding the constitutionality of the provisions of The National Identity Card (Miscellaneous Provisions) Act, 2013. The Act required biometric information including fingerprints, to be stored in a central register in which particulars of the identity of every citizen of Mauritius were to be recorded.
The Supreme Court upheld provisions of the Act that provided for the compulsory taking of fingerprints. However, the Court struck down those provisions that provided for the biometric data to be stored in a central register. The Appellant appealed to the Committee, contending that the provisions providing for the compulsory taking of fingerprints should also be struck down as unconstitutional.
The appellant challenged the following provisions of the Act: (i) the storage of data in a register in electronic data under Section 3; (ii) the obligation to 399 [2016] UKPC 30 292 PART H provide biometric information under Section 4; (iii) the collection of information, in electronic form, for a national ID card under Section 5; (iv) the compulsory production of an identity card to a policeman under Section 7(1A) in response to a request under Section 7(1)(b); and (v) the gravity of the potential penalties for non-compliance under Section 9(3), before the Mauritian Supreme Court. The challenge was on the ground that the implementation of the biometric identity card and the permanent storage of biometric data contravened provisions of the Mauritian Constitution and the Civil Code.
Regarding the challenge to Section 4 (2)(c) of the Act, which provided that, “every person who applies for an identity card shall allow his fingerprints, and other biometric information about himself, to be taken and recorded … for the purpose of the identity card,” the Supreme Court noted that the right to privacy under Section 9(1) of the Constitution was not an absolute right and interference with that right could be permitted under Section 9(2), if a law that interfered with that right was in the interest, inter alia, of public order. The Committee noted the Supreme Court’s approach to determining whether Section 4(2)(c) fell foul of the Constitution, which was based on the test laid down in S and Marper v The United Kingdom400:
“In addressing the question whether section 4(2)(c) of the 1985 Act (as amended) was reasonably justifiable in a democratic society the Supreme Court drew on jurisprudence of the European Court of Human Rights in S v The United Kingdom…In substance the Court asked whether the 400 [2008] ECHR 1581 293 PART H measure pursued a legitimate aim, whether the reasons given by the national authorities for the interference in pursuit of that aim were relevant and sufficient, and whether the measure was proportionate to the aim pursued. This evaluation is essentially the same as that adopted by the courts in the United Kingdom in relation to article 8(2) of the ECHR, in which the courts ask themselves (a) whether the measure is in accordance with the law, (ii) whether it pursues a legitimate aim, and (iii) whether the measure will give rise to interferences with fundamental rights which are disproportionate, having regard to the legitimate aim pursued.
In relation to (iii), the courts ask themselves: (a) whether the objective is sufficiently important to justify a limitation of the protected right, (b) whether the measure is rationally connected to the objective, (c) whether a less intrusive measure could have been used without compromising the achievement of the objective (in other words, whether the limitation on the fundamental right was one which it was reasonable for the legislature to impose), and (d) whether the impact of the infringement of the protected rights is disproportionate to the likely benefit of the measure” The Committee reproduced the Mauritian Supreme Court’s holding that the provisions of the Act which enforced the compulsory taking and recording of fingerprints interfered with the Appellant’s rights guaranteed under section 9(1) of the Constitution,401 but that the law was justifiable on grounds of public interest and public order:
“We find that it can hardly be disputed that the taking of fingerprints within the applicable legal framework pursues the legitimate purpose of establishing a sound and secure identity protection system for the nation and thus answers a pressing social need affording indispensable protection against identity fraud. Such a purpose, as has been amply demonstrated, is vital for proper law enforcement in Mauritius. Furthermore, taking into consideration the appropriate safeguards in the taking of fingerprints for their insertion in the cards, and the relatively limited degree of interference involved, we are led to conclude that such interference is proportionate to the legitimate aim pursued.”402 401 Maharajah Madhewoo v. The State of Mauritius & Anr., 2015 SCJ 177, at page 23 402 [2016] UKPC 30, at page 10 294 PART H Thus, the Mauritian Supreme Court upheld provisions of the Act which provided for the compulsory taking of fingerprints. The Appellant also challenged Section 3 of the Act, which provided for biometric data to be stored in a register. The Supreme Court, after taking into consideration witness testimonies on the purpose of data collection, noted that though there may have been a legitimate aim for storing and collecting this data, “sufficiently strong reasons…to establish that such storage and retention of data for an indefinite period is proportionate to the legitimate aim pursued” were not established.403 Thus, the Court held that:
“… it is inconceivable that there can be such uncontrolled access to personal data in the absence of the vital safeguards afforded by judicial control. The potential for misuse or abuse of the exercise of the powers granted under the law would be significantly disproportionate to the legitimate aim which the defendants have claimed in order to justify the retention and storage of personal data under the Data Protection Act.”404 Thus, while the Supreme Court noted that the law providing for the storage and retention of personal biometric data constituted a permissible derogation under Section 9(2) of the Constitution,405 it held that since the Respondent had not established that provisions dealing with storage and retention were reasonably justifiable in a democratic society, they were unconstitutional.
403 Ibid, at page 31 404 Ibid, at page 33 405 Article 9. Protection of privacy of home and other property: (2) Nothing contained in or done under the authority of any law shall be held to be consistent with or in contravention of this section to the extent that the law in question makes provision - (a) in the interests of defence, public safety, public order, public morality, public health, town and country planning, the development or utilisation of mineral resources or the development or utilisation of any other property in such a manner as to promote the public benefit; (b) for the purpose of protecting the rights or freedoms of other persons; (c) to enable an officer or agent of the government or a local authority, or a body corporate established by law for public purpose, to enter on the premises of any person in order to value those premises for the purpose of any tax, rate or due, or in order to carry out work connected with any property that is lawfully on those premises and that belongs to the government, the local authority or that body corporate, as the case may be; or (d) to authorise, for the purpose of enforcing the judgement or order of a court in any civil proceedings, the search of any person or property by order of a court or the entry upon any premises by such order, Except so far as that provision or, as the case may be, the thing done under its authority is shown not to be reasonably justifiable in a democratic society 295 PART H The Judicial Committee did not interfere with the Supreme Court’s decision.
However, it noted an inconsistency in the Supreme Court’s order wherein it held that the law providing for the storage and retention of fingerprints and other biometric data constitutes a permissible derogation under section 9(2) of the Constitution, whilst simultaneously holding the same provisions to be unconstitutional. The Committee reconciled the holding to be:
“A law providing for the storage and retention of fingerprints and other personal biometric data regarding the identity of a person in principle constitutes a permissible derogation, in the interests of public order, under section 9(2) of the Constitution.” (Emphasis supplied) 215 The learned Attorney General has relied on cases from other jurisdictions to buttress his contention that the collection and use of biometric information for various services have been found to be legal. ‘Biometric data406’ is defined in the General Data Protection Regulation thus:
“personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.” The learned Attorney General cited the following judgments of the US Supreme Court: Vernonia School District 47J v Acton (“Acton”),407 Skinner v Railway Labor Executives’ Association (“Skinner”),408 Whalen v Roe (“Whalen”),409 United States v Dionisio (“Dionisio”)410 and Bowen v Roy 406 Article 4(14) 407 515 U.S. 646 (1995) 408 489 U.S. 602 (1989) 409 429 U.S. 589 (1977) 410 410 U.S. 1 (1973) 296 PART H (“Bowen”).411 Only Acton, Skinner and Dionisio were decided in the context of biometrics, which as we have found before, forms the bedrock of the Aadhaar program. In Acton, the court held that the action of the authorities conducting random drug testing of high school athletes was legal since the conditions of collection were nearly identical to those typically encountered in public restrooms. As a result, it was found that, privacy interests of the students were negligibly affected. In Skinner, the court found the actions of the Federal Railroad Administration (“FRA”) requiring mandatory blood and urine testing of employees involved in train accidents to be constitutional. The court observed that railroad accidents, if not prevented, could cause massive loss of life and property. Further, it was held that FRA’s regulations fulfilled a “special need” because of the interest of the government in ensuring safety of railroads and were therefore, not “an undue infringement on the justifiable expectations of privacy of covered employees”. In Whalen, the Court found that retention of patients’ information such as their name, address and age, under the New York State Controlled Substances Act, 1972, was not in violation of the constitutional right to privacy as the Court was satisfied that the statute provided for proper safeguards and redressal against theft and loss of information. In Dionisio, the Court found no constitutional infirmity with the issuance of a subpoena to procure voice recording exhibits by tapping telephones in order to investigate crimes. The Court held that “neither the summons to appear before the grand jury, nor its directive to make a voice recording, infringed upon any interest protected by the Fourth Amendment”.
411 476 U.S. 693 (1986) 297 PART H The Court observed that a compelled display of identifiable physical characteristics does not infringe upon an “interest protected by the privilege against compulsory self-incrimination”. In Bowen, the Court upheld the provisions of a welfare scheme which required citizens to furnish their social security number, rejecting the argument that the use of a social security number violated the Appellant’s Native American beliefs. The Court held that the Free Exercise Clause of the First Amendment could not be construed to place a requirement on the government to conduct its internal affairs in consonance with the religious beliefs of particular citizens.
In In re Crawford,412 the Ninth Circuit upheld provisions of the Bankruptcy Code which mandated public disclosure of a Bankruptcy Petition Preparers’ Social Security Number on documents submitted to the Court, noting that the provision had been enacted to serve governmental interests of preventing fraud and providing public access to judicial proceedings. 216 Some decisions of lower courts in the US which have considered the validity of laws or actions of the State deploying biometrics and which have been cited by the respondents are: Haskell v Harris (“Haskell”),413 Utility Workers Union of America v Nuclear Regulatory Commission (“UWUA”),414 Nicholas A Iacobucci v City of Newport (“Iacobucci”),415 412 194 F.3d 954 (9th Cir. 1999) 413 669 F.3d 1049 (9th Cir. 2012) 414 664 F. Supp. 136 (S.D.N.Y. 1987) 415 785 F.2d 1354 (6th Cir. 1986) 298 PART H Thom v New York Stock Exchange (“Thom”),416 Perkey v Department of Motor Vehicles (“Perkey”),417 Buchanan v Wing (Buchanan),418 People v Stuller (“Stuller”),419 United States v Kelly (“Kelly”)420 and Brown v Brannon (“Brannon”).421 At first blush, it does seem that these cases support the Respondents’ stand, however, we cannot lose sight of the context in which the courts came to the conclusion emphasised by the respondents in support of their submissions. In Haskell, the Ninth Circuit found a Californian law which authorized law enforcement officers to collect DNA in the form of a sample from the buccal swab of the mouth of felony arrestees, who had not been convicted, to be constitutional. The Court noted that the arrestees had reduced privacy interests; the physical intrusion of collecting a buccal swab was de minimis in nature; there were stringent limits on the manner in which the information was to be used; and the interest of the State in deterring future criminal acts to exculpate innocent arrestees aided in prison administration and law enforcement. For the above reasons, the Court found that the infringement of privacy of the felony arrestees was justified. In UWUA, the Ninth Circuit ruled that a law requiring individuals working in nuclear power facilities to submit their fingerprints for identification and criminal history record checks was not unconstitutional. In Iacobucci, an ordinance which required employees of liquor selling establishments which permitted nude dancing, to be fingerprinted and photographed by the police department, was held 416 306 F. Supp. 1002 (S.D.N.Y. 1969) 417 (1986) 42 Cal. 3d 185 418 N.Y.S.2d 865 419 10 Cal. App.3d 582 (1970) 420 55 F.2d 67 (2d Cir. 1932) 421 399 F. Supp. 133 (M.D.N.C. 1975) 299 PART H constitutional. The Court observed that fingerprinting and photographing of employees of retail liquor establishments bore a rational relationship to the legitimate aim of elimination of crime. In Thom, a New York statute, which as a condition of employment, required all the employees of member firms of national stock exchanges to be fingerprinted, was upheld. The Court ruled that fingerprinting was a necessary means of verifying the existence or non- existence of a prior criminal record, in order to avert any threat posed by an employee who was in a position to commit theft of securities. In Perkey, the Californian Supreme Court upheld the actions of the state mandating an individual to provide a fingerprint in order to obtain a driver’s license. The Court held that fingerprint technology was the only reliable means of ensuring the integrity of the records of the department of motor vehicles as other methods such as handwriting specimens and photographs were not reliable. Thus, the submission of fingerprints as part of the license application process, bore a rational relationship to the State’s goal of promoting safe and lawful use of highways. In Buchanan, the Court upheld the eligibility requirement for a welfare aid scheme which mandated participation in an identity verification procedure known as Automated Finger Imaging System (AFIS), rejecting the challenge based on religious beliefs of the Petitioner. The Court held that the Petitioner had failed to prove that the AFIS involved any invasive procedures, noting that she had acknowledged that she had never seen finger imaging performed and had no idea whether a laser was involved. In Stuller, the constitutionality of a law which required “temporary and itinerant classes of 300 PART H employees” to undergo fingerprinting in order to protect “visitors and residents” of a resort city from crime and loss, both against people and against property, was upheld. In Kelly, the Circuit Court of Appeals rejected a claim for return of fingerprints of the defendant which had been obtained after he had been arrested by prohibition agents, holding that there was no reason to interfere with a method of identifying persons “charged with a crime”. In Brannon, the court held that a law requiring “massagists” to submit their fingerprints, photographs and reports of their medical examinations in order to obtain licenses was valid, noting that the fingerprints and photographs would aid in their identification as well as in the enforcement of criminal statutes relating to public morality and decency.
217 The cases cited by the learned Attorney General would not be applicable in the context of the Aadhaar program. The cases cited dealt with narrowly tailored legislations set out to achieve very specific objectives. For instance, courts upheld statutes aimed at protecting a nuclear facility or to prevent theft of securities, where incidents of sabotage or breach of security would have led to national disasters. These national disasters in turn would have resulted in the immediate loss of human life or in a situation of financial emergency. Such laws, were therefore, enacted in order to assuage security concerns which, if not implemented, could lead to incidents of massive losses of life and property.
301 PART H Some of the statutes upheld, permitted collection of DNA samples, fingerprints and photographs for identification. The objective behind these laws was prevention of crime, albeit on a comparatively smaller scale. Moreover, the courts in these cases were also satisfied that the procedures involved in collecting biometrics were not invasive enough to strike them down as unconstitutional or that there were adequate safeguards to prevent misuse. The aforementioned cases will not apply in the backdrop of the Aadhaar program because they were rendered broadly in the context of prevention of crime. It needs no reiteration that an entire population cannot be presumed to be siphoning huge sums of money in welfare schemes or viewed through the lens of criminality, and therefore, considered as having a diminished expectation of privacy. The judgments cited by the respondents which were decided in the context of crime, require the State to at least form a reasonable belief about the criminal antecedents of individuals or their potential to commit crimes. On the contrary, by collecting identity information, the Aadhaar program treats every citizen as a potential criminal without even requiring the State to draw a reasonable belief that a citizen might be perpetrating a crime or an identity fraud. When the State is not required to have a reasonable belief and judicial determination to this effect, a program like Aadhaar, which infringes on the justifiable expectations of privacy of citizens flowing from the Constitution, is completely disproportionate to the objective sought to be achieved by the State.
302 PART H 218 The fundamental precepts of proportionality, as they emerge from decided cases can be formulated thus:
1. A law interfering with fundamental rights must be in pursuance of a legitimate state aim;
2. The justification for rights-infringing measures that interfere with or limit the exercise of fundamental rights and liberties must be based on the existence of a rational connection between those measures, the situation in fact and the object sought to be achieved;
3. The measures must be necessary to achieve the object and must not infringe rights to an extent greater than is necessary to fulfil the aim;
4. Restrictions must not only serve a legitimate purposes; they must also be necessary to protect them; and
5. The State must provide sufficient safeguards relating to the storing and protection of centrally stored data. In order to prevent arbitrary or abusive interference with privacy, the State must guarantee that the collection and use of personal information is based on the consent of the individual; that it is authorised by law and that sufficient safeguards exist to ensure that the data is only used for the purpose specified at the time of collection. Ownership of the data must at all times vest in the individual whose data is collected. The individual must have a right of access to the data collected and the discretion to opt out.
303 PART H 219 Privacy and proportionality are two interlocking themes that recur consistently in the above judgements. Privacy, also construed as “informational self-determination”, is a fundamental value. There is a consistent emphasis on the impact on personal dignity if private information is widely available and individuals are not able to decide upon its disclosure and use. This right of controlling the extent of the availability and use of one’s personal data is seen as a building block of data protection - especially in an environment where the state of technology facilitates ease of collection, analysis and dissemination of information. 220 The blanket and indiscriminate collection of information is seen as a violation of privacy, which is a constituent of the right to liberty. An extensive power to retain collected data is also seen as a disproportionate interference with the right to privacy and not necessary in a democratic society. The judgments hold that unlimited data retention and unrestricted state access both constitute a disproportionate interference with privacy and data protection. They also emphasize the need to clearly stipulate the nature of the data being collected and ensure its confidentiality. Provisions where these principles are not respected cannot be regarded as valid. While courts do recognize the need for public order and security, they emphasize the need to strike a balance between safeguarding public order and the right to privacy. 304 PART H 221 The principle of proportionality also recurs through these judgments, which note that the collection and use of information must be limited to the purpose specified by law and to the extent indispensable for the protection of public interest. The striking of a balance between public and private interests is crucial to proportionality. The judgments hold that there must be a protection against unauthorized use and clearly defined conditions for processing of data collected. Those conditions must not be excessive and must be justified on grounds of public interest and implemented in a manner proportionate to the objective. Too broad a scope of data collected and retained, the lack of limits imposed on access to data by authorities and a failure to distinguish between the treatment of data based on its usefulness and relevance are seen by Courts as constituting grounds for striking down the measure. While the State's imperatives are seen as relevant, emphasis is laid on retention and access requirements being proportionate to those imperatives and the need to prevent against abuse. Courts have upheld regulations that are necessary to achieve the legitimate aims and not excessive in their nature or impact.
The issue is whether the Aadhaar project and the Act, Rules and Regulations meet the test of proportionality.
305 PART H H.4 Aadhaar: the proportionality analysis 222 Under Aadhaar, the State has put forth an objective of transferring subsidies and entitlements to its citizens. The aim was to curb leakages and to increase transparent and efficient “targeted delivery of subsidies, benefits and services”. However, the Act in the present form has surpassed a tailored objective and has sought to administer every facet of the citizen-state engagement through mandatory biometric-enabled Aadhaar linking. The violations of fundamental rights that result from the operation of the Aadhaar scheme will have to be evaluated on the touchstone of legitimate state interest and proportionality.
Since biometric systems have been employed, it is fundamental to understand that the right to privacy and its protection must be at the centre of the debate, from the very onset of the decision to use biometric data. It is vital that adequate safeguards are set down for every step of the process from collection to retention of biometric data. At the time of collection, individuals must be informed about the collection procedure, the intended purpose of the collection, the reason why the particular data set is requested and who will have access to their data. Additionally, the retention period must be justified and individuals must be given the right to access, correct and delete their data at any point in time, a procedure familiar to an opt-out option. The intended purpose should always act as a shining light and adequate caution must be 306 PART H taken to ensure that there is no function creep with the lapse of time, in order to prevent the use of the data for new, originally unintended purposes. Measures to protect privacy would include enacting more entrenched and specific legislation so that the right to privacy is not only recognized but protected in all its aspects. Meeting this obligation would necessarily mean enactment of data protection legislation as well. The choice of particular techniques and the role of components in the architecture of the technology also have a strong impact on the privacy protections provided by the biometric system.
During the course of the hearing, the CEO of UIDAI, Mr Ajay Bhushan Pandey was permitted on the request of the learned Attorney General to make a power-point presentation before the Court, explaining the architecture and working of the Aadhaar project. On the basis of the presentation, Mr Shyam Divan, counsel for the petitioners had served a list of questions to the respondents. Responses to these questions have been filed by UIDAI. Analysing the power-point presentation by the CEO, questions addressed by Mr Divan and the responses filed by the respondents will facilitate an understanding of the architecture of the Aadhaar project. Our analysis indicates that the correctness of the documents submitted by an individual at the stage of enrolment or while updating information is not verified by any official of UIDAI or of the Government. UIDAI does not take 307 PART H institutional responsibility for the correctness of the information entering its database. It delegates this task to the enrolment agency or the Registrar. The following response has been submitted by the respondents to the queries addressed specifically on this aspect:
“As per UIDAI process, the verification of the documents is entrusted to the Registrar. For Verification based on Documents, the verifier present at the Enrolment Centre will verify the documents. Registrars/Enrolment agency must appoint personnel for the verification of documents.” 223 UIDAI does not identify the persons who enrol within the Aadhaar system. Once the biometric information is stored in the CIDR during enrolment, it is only matched with the information received at the time of authentication. Biometric authentication of an Aadhaar number holder is performed as a “one to one” biometric match against the biometric information of the Aadhaar number holder in CIDR. Based on the match, UIDAI provides a ‘yes’ or ‘no’response. Whether the information which is entering into CIDR is correct or not is a task entrusted to the enrolling agency or the Registrars.
UIDAI does not assume responsibility for it. The task of verifying whether a person is an illegal resident has also been left to the enrolling agencies. At the stage of enrolment, a verification of whether a person has been residing in India for 182 days or more in the past twelve months is done on the basis of a ‘self-declaration’ of the individual. The declaration which has been provided in the Aadhaar enrolment forms is thus: 308 PART H “Disclosure under section 3(2) of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Servìces Act, 2016 I confirm that I have been residing in India for at least 182 days in the preceding 12 months & information (including biometrics) provided by me to the UIDAI Ìs my own and is true, correct and accurate. I am aware that my information including biometrics will be tested for generation of Aadhaar and authentication. I understand that my identity information (except core biometric) may be provided to an agency only with my consent during authentication or as per the provisions of the Aadhaar Act. I have a right to access my identity information (except core biometrics) following the procedure laid down by UIDAI.”422 224 The petitioners have argued that persons who were enrolled under the Aadhaar programme before the Act came into force on 12 September 2016 (more than a hundred crore) were not even required to make this declaration. The authenticity of the documents submitted (along with the declaration) is not checked by UIDAI.
The exception handling process permitting the use of alternative modes of identification if the Aadhaar authentication fails, is also left to the discretion of the Requesting Entity. On this aspect, the response which has been provided to the Court is thus:
“As per Regulation 14(i) of Aadhaar (Authentication) Regulations 2016, requesting entities shall implement exception-handling mechanisms and back-up identity authentication mechanisms to ensure seamless provision of authentication services to Aadhaar number holders.
Therefore, this exception handling mechanism is to be implemented and monitored by the requesting entities and in case of the government, their respective ministries.” 309 PART H Forty-nine thousand enrolment operators have been blacklisted by UIDAI. In reply to the question of the petitioners asking the reasons for blacklisting of the enrolment operators, UIDAI has stated that a data quality check is done during the enrolment process and if any Aadhaar enrolment is found to be not to be compliant with the UIDAI process, the enrolment gets rejected and an Aadhaar number is not generated. An operator who crosses a threshold defined in the policy, is blacklisted/ removed from the UIDAI ecosystem. UIDAI has provided information that forty-nine thousand operators were blacklisted/removed from the UIDAI ecosystem for the following reasons: (a) illegally charging residents for Aadhaar enrolment; (b) poor demographic data quality; (c) invalid biometric exceptions; and (d) other process malpractices. Once an operator is blacklisted or suspended, further enrolments cannot be carried out by it until the order of blacklisting/suspension is valid. 225 The Aadhaar architecture incorporates the role of Authentication User Agencies (AUAs) and Authentication Service Agencies (ASAs). ASAs, under the Aadhaar (Authentication) Regulations, have been defined as entities providing necessary infrastructure for ensuring secure network connectivity and related services for enabling a requesting entity to perform authentication using the authentication facility provided by UIDAI.423 AUAs have been defined under the Aadhaar (Authentication) Regulations as requesting entities that use the Yes/No authentication facility provided by UIDAI. 424 “Yes/No 423 Regulation 2(f), Aadhaar (Authentication) Regulations 424 Regulation 2(g), Aadhaar (Authentication) Regulations 310 PART H authentication facility” is a type of authentication facility in which the identity information and Aadhaar number securely submitted with the consent of the Aadhaar number holder through a requesting entity, are matched against the data available in the CIDR, and the Authority responds with a digitally signed response containing a “Yes” or “No”, along with other technical details related to the authentication transaction, excluding identity information.425 The other type of authentication facility is the e-KYC authentication facility, in which the biometric information and/or OTP and Aadhaar number securely submitted with the consent of the Aadhaar number holder through a requesting entity, are matched against the data available in the CIDR, and the Authority returns a digitally signed response containing e-KYC data along with other technical details related to the authentication transaction. A requesting entity which, in addition to being an AUA, uses e-KYC authentication facility provided by UIDAI is called a “e-KYC User Agency” or “KUA”.426 Under Regulation 15(2), a requesting agency may permit any other agency or entity to perform Yes/ No authentication by generating and sharing a separate license key for every such entity through the portal provided by UIDAI to the said requesting entity. It has also been clarified that sharing of a license key is only permissible for performing Yes/ No authentication, and is prohibited in case of e-KYC authentication.427 425 Regulation 2(p), Aadhaar (Authentication) Regulations 426 Regulation 2(l), Aadhaar (Authentication) Regulations 427 Regulation 15, Aadhaar (Authentication) Regulations 311 PART H The petitioners have contended that the points of service (PoS) biometric readers are capable of storing biometric information. The response which UIDAI has provided is extracted below:
“UIDAI has mandated use of Registered Devices (RD) for all authentication requests. With Registered Devices biometric data is signed within the device/ RD service using the provider key to ensure it is indeed captured live. The device provider RD Service encrypts the PID block before returning to the host application. This RD Service encapsulates the biometric capture, signing and encryption of biometrics all within it. Therefore, introduction of RD in Aadhaar authentication system rules out any possibility of use of stored biometric and replay of biometrics captured from other source. Requesting entities are not legally allowed to store biometrics captured for Aadhaar authentication under Regulation 17(1)(a) of Aadhaar (Authentication) Regulations 2016.” 226 A PID block is defined in Regulation 2(n) of Aadhaar (Authentication) Regulations, 2016 as the Personal Identity Data element, which includes necessary demographic and/or biometric and/or OTP collected from the Aadhaar number holder during authentication. Regulation 17(1)(c) allows the requesting entity to store the PID block when “it is for buffered authentication where it may be held temporarily on the authentication device for a short period of time, and that the same is deleted after transmission”. Thus, under the Aadhaar project, requesting entities can hold the identity information of individuals, even if for a temporary period.
It was further contended by the petitioners that authentication entities in the Aadhaar architecture are capable of recording the date and time of the authentication, the client IP, the device ID and purpose of authentication. In 312 PART H response, UIDAI stated that it does not ask requesting entities to maintain any logs related to the IP address of the device, GPS coordinates of the device and purpose of authentication. It was, however, admitted that in order to ensure that their systems are secure and frauds are managed, AUAs like banks and telecom providers may store additional information according to their requirement to secure their system.
227 The process of sending authentication requests has been dealt with in Regulation 9 of the Aadhaar (Authentication) Regulations. It provides that after collecting the Aadhaar number or any other identifier provided by the requesting entity which is mapped to the Aadhaar number and necessary demographic and / or biometric information and/ or OTP from the Aadhaar number holder, the client application immediately packages and encrypts the input parameters into the PID block before transmission and sends it to the server of the requesting entity using secure protocols. After validation, the server of a requesting entity passes the authentication request to the CIDR, through the server of the Authentication Service Agency. The Regulation further provides that the authentication request must be digitally signed by the requesting entity and/or by the Authentication Service Agency, pursuant to the mutual agreement between them. Based on the mode of authentication requested, the CIDR validates the input parameters against the data stored and returns a digitally signed Yes or No authentication response, or a digitally signed e-KYC authentication response with encrypted e-KYC data, as the 313 PART H case may be, along with other technical details related to the authentication transaction. In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the input parameters such that authentication is always reduced to a 1:1 match. Clause (5) of Regulation 9 provides that a requesting entity shall ensure that encryption of PID Block takes place at the time of capture on the authentication device according to the processes and specifications laid down by UIDAI. Regulation 18(1) provides that a requesting entity would maintain logs of the authentication transactions processed by it, containing the following transaction details:
(a) the Aadhaar number against which authentication is sought;
(b) specified parameters of authentication request submitted;
(c) specified parameters received as authentication response;
(d) the record of disclosure of information to the Aadhaar number holder at the time of authentication; and
(e) record of consent of the Aadhaar number holder for authentication. The provision excludes retention of PID information in any case. Regulations 18(2) and 18(3) allow the retention of the logs of authentication transactions by the requesting entity for a period of two years. Upon the expiry of two years the logs have to be archived for a period of five years or the number of years required by the laws or regulations governing the entity, whichever is later. Upon the expiry of this period, the logs shall be deleted except those records which are required to be retained by a court or for any pending disputes. Regulation 20(1) provides that an Authentication Service Agency would 314 PART H maintain logs of the authentication transactions processed by it, containing the following transaction details:
(a) identity of the requesting entity;
(b) parameters of authentication request submitted; and
(c) parameters received as authentication response. The Regulation excludes retention of Aadhaar number, PID information, device identity related data and e-KYC response data. Under Regulations 20(2) and 20(3), authentication logs shall be maintained by the ASA for a period of two years, during which period the Authority and/or the requesting entity may require access to such records for grievance redressal, dispute redressal and audit in accordance with the procedure specified in the regulations. The authentication logs shall not be used for any purpose other than that stated. Upon the expiry of the period of two years, the authentication logs shall be archived for a period of five years. Upon the expiry of five years or the number of years required by the laws or regulations governing the entity whichever is later, the authentication logs shall be deleted except those logs which are required to be retained by a court or for pending disputes. Section 2(d)428 of the Aadhaar Act allows storage of the record of the time of authentication. These provisions permit the storage of logs of authentication transactions for a specific time period.
The power-point presentation made by the CEO of UIDAI states that: 428Section 2(d) states: “authentication record” means the record of the time of authentication and identity of the requesting entity and the response provided by the Authority 315 PART H “With registered devices every biometric device will have a unique identifier allowing traceability, analytics and fraud management and biometric data will be signed within the device.” The response further indicates that UIDAI gets the AUA code, ASA code, unique device code, registered device code used for authentication, and that UIDAI would know from which device the authentication has happened and through which AUA/ASA. The response provided by the respondents states:
“UIDAI does not get any information related to the IP address or the GPS location from where authentication is performed as these parameters are not the part of authentication (v2.0) and e-KYC (v2.1) API. UIDAI would only know from which device the authentication has happened, through which AUA/ASA etc. This is what the slides meant by traceability.
UIDAI does not receive any information about at what location the authentication device is deployed, its IP address and its operator and the purpose of authentication. Further, the UIDAI or any entity under its control is statutorily barred from collecting, keeping or maintaining any information about the purpose of authentication under Section 32(3) of the Aadhaar Act.” However, Regulation 26, which deals with the storage and maintenance of Authentication Transaction Data clearly provides that UIDAI shall store and maintain authentication transaction data, which shall contain the following information:
(a) authentication request data received including PID block;
(b) authentication response data sent;
(c) meta data429 related to the transaction; and
(d) any authentication server side configurations430 as necessary. 429AUA code, ASA code, unique device code, registered device code used for authentication, and that UIDAI would know from which device the authentication has happened 430An important configuration could be IP address 316 PART H The only data, which has been excluded from retention under this provision, like Section 32(3) of the Aadhaar Act, is the purpose of authentication. Regulation 27 provides that the authentication transaction data shall be retained by UIDAI for a period of six months, and will thereafter be archived for five years, upon which, the authentication transaction data shall be deleted except when it is required to be maintained by a court or in connection with any pending dispute. These provisions indicate that under the Aadhaar architecture, UIDAI stores authentication transaction data. This is in violation of the widely recognized data minimisation principles which seek that data collectors and processors delete personal data records when the purpose for which it has been collected is fulfilled. The lack of specification of security standards and the overall lack of transparency and inadequate grievance redressal mechanism under the Aadhaar program greatly exacerbate the overall risk associated with data retention. In the Aadhaar regime, an Authentication User Agency (AUA) connects to the CIDR and uses Aadhaar authentication to validate a user and enable its services. The responsibility for the logistics of service delivery rests with the AUAs. In this federated model, Authentication Service Agencies (ASAs) transmit authentication requests to CIDR on behalf of one or more AUAs. However, any device that communicates via the Internet is assigned an IP address. Using the meta- data related to the transaction, the location of the authentication can easily be traced using the IP address.
317 PART H 228 The petitioners have also brought the attention of this Court to bear on an expert report, with respect to security and Aadhaar, which was filed along with an Additional Affidavit dated 09 March 2018. The report dated 4 March 2018 is titled as “Analysis of Major Concern about Aadhaar Privacy and Security” and has been authored by Professor Manindra Agrawal. Professor Agrawal is the N Ramarao Professor at IIT Kanpur and is a member of the Technology and Architecture Review Board (TARB) and of the Security Review Committee of UIDAI. Professor Agarwal’s Report deals with the notion of differential privacy. Differential privacy makes it possible for tech entities to collect and share aggregate information about user habits, while maintaining the privacy of individual users. The Report states that differential privacy of a protocol is the change in the privacy of people when the protocol is introduced without altering any other protocol present. If the differential privacy of a protocol is “non-negative”, the protocol does not compromise privacy in any way. There are four existing Aadhaar databases:
(i) The ‘person database’ stores personal attributes of a person (name, address, age, etc.) along with his/her Aadhaar number;
(ii) The reference database stores the Aadhaar number of a person along with a unique reference number (which has no relationship with the Aadhaar number of an individual);
(iii) The biometric database stores biometric information of a person along with the unique reference number; and 318 PART H
(iv) The verification log records all ID verifications done in the past five years. For each verification, it stores the biometric data, Aadhaar number, and ID of the device on which verification was done. The report analyses the situation if any of the databases gets leaked. The report remarks:
“Finally, let us turn attention to Verification Log. Its leakage may affect both the security and the privacy of an individual as one can extract identities of several people (and hence can keep changing forged identities) and also locate the places of transactions done by an individual in the past five years. Note that differential privacy of this becomes negative since without access to this database it is not possible to track locations of an individual in past five years (as opposed to tracking current location which is possible). Therefore, Verification Log must be kept secure.” The Report underlines the importance of ensuring the security of verification logs in the Aadhaar database. The leakage of verification logs is capable of damaging the security and privacy of individuals since the report notes that from the verification log, it is possible to locate the places of transactions by an individual in the past five years. A breach in verification log would allow a third party to access the location of the transactions of an individual over the past five years. The report indicates that it is possible through the Aadhaar database to track the location of an individual. The Aadhaar database is different from other databases such as PAN Card or driving license. The Aadhaar database is universal and contains the biometrics of an individual.
The threshold to scrutinize the effects of this database is therefore much higher as compared to that of other databases. 319 PART H 229 In Puttaswamy, Justice Kaul (in his concurring judgment) emphasized upon the concerns regarding surveillance of individuals. The learned Judge held:
“The growth and development of technology has created new instruments for the possible invasion of privacy by the State, including through surveillance, profiling and data collection and processing. Surveillance is not new, but technology has permitted surveillance in ways that are unimaginable… One such technique being adopted by States is ‘profiling’. The European Union Regulation of 2016 on data privacy defines ‘Profiling’ as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Such profiling can result in discrimination based on religion, ethnicity and caste.”431 Justice Kaul also dealt with the need to regulate the conduct of private entities vis-a-vis profiling of individuals:
“The capacity of non-State actors to invade the home and privacy has also been enhanced. Technological development has facilitated journalism that is more intrusive than ever before…432 …[I]n this digital age, individuals are constantly generating valuable data which can be used by non-State actors to track their moves, choices and preferences. Data is generated not just by active sharing of information, but also passively… These digital footprints and extensive data can be analyzed computationally to reveal patterns, trends, and associations, especially relating to human behavior and interactions and hence, is valuable information. This is the age of ‘big data’.
The advancement in technology has created not just new forms of data, but also new methods of analysing the data and has led to the discovery of new uses for data. The algorithms are more effective and the computational power has magnified exponentially.”433 431 Puttaswamy at para 585 432 Puttaswamy at para 587 433 Puttaswamy at para 588 320 PART H 230 Section 2(c) of the Aadhaar Act is capable of revealing the identity of an individual to UIDAI. Section 2(d) permits storage of record of the time of authentication. Through meta data and in the light of the observations made in the Professor Manindra Agarwal Report, it can easily be concluded that it is possible through the UIDAI database to track the location of an individual.
Further, the verification logs reveal the details of transactions over the past five years. The verification logs are capable of profiling an individual. Details of the transaction include what the transaction was (whether authentication request was accepted/rejected), where it was sent from, and how it was sent. The only thing not stored in the transaction is its purpose. 231 The threat to privacy arises not from the positive identification that biometrics provide, but the ability of third parties to access this in an identifiable form and link it to other information, resulting in secondary use of that information without the consent of the data subject. This erodes the personal control of an individual over the uses of his or her information. The unauthorised secondary use of biometric data is perhaps the greatest risk that biometric technology poses to informational privacy.434 The Manindra Agarwal Report acknowledges that the biometric database in the CIDR is accessible by third-party vendors providing biometric search and de-duplication algorithms. The other three databases are stored, in encrypted form, by UIDAI.
434Nancy Yue Liu, Bio-Privacy: Privacy Regulations and the Challenge of Biometrics, Routledge (2013) at page 76 321 PART H In this regard, it would be necessary to deal with the Contract (dated 24 August 2010) signed between UIDAI and L1 Identity Solutions (the foreign entity which provided the source code for biometric storage). It has been submitted by the petitioners that the contract gives L1 Identity Solutions free access to all personal information about all residents in India. The contract specifies that UIDAI (‘the purchaser’) has the right in perpetuity to use all original newly created processes “identified” by M/S L-1 Identity Solutions “solely during execution” of the contract to the purchaser’s unique specifications and which do not contain any pre-existing intellectual property right belonging to L-1 Identity Solutions.435 UIDAI was provided the license of the software (proprietary algorithms) developed by L-1 Identity Solutions. However, it has been clarified in the Contract that:
“The Contract and the licenses granted herein are not a sale of a copy of the software and do not render Purchaser the owner of M/S L-1 Identity Solutions Operating Company’s proprietary ABIS and SDK software.”436 The Contract authorises L-1 Identity Solutions to retain proprietary ownership of all intellectual property rights in and to goods, services and other deliverables to the purchaser under the Contract that are modifications or derivative works to their pre-existing technologies, software, goods, services and other works. If a modification or derivative work made by L-1 Identity Solutions or its consortium members contains unique confidential information of the purchaser, then, the contract provides that the former shall not further 435 Clause 13.1 of the Contract 436 Ibid 322 PART H license or distribute such modification or derivative to any other customer or third party other than the purchaser without the purchaser’s prior written permission.437 Clause 13.3 provides:
“M/S L-1 Identity Solutions Operating Company/ The team of M/S L-1 Identity Solutions Operating Company shall ensure that while it uses any software, hardware, processes, document or material in the course of performing the Services, it does not infringe the Intellectual Property Rights of any person and M/S L-1 Identity Solutions Operating Company shall keep the Purchaser indemnified against all costs, expenses and liabilities howsoever, arising out any illegal or unauthorized use (piracy) or in connections with any claim or proceedings relating to any breach or violation of any permission/license terms or infringement of any Intellectual Property Rights by M/S L-1 Identity Solutions Operating Company or the team of M/S L-1 Identity Solutions Operating Company during the course of performance of the Services.
In case of infringement by M/S L-1 Identity Solutions Operating Company/ The team of M/S L-1 Identity Solutions Operating Company, M/S L-1 Identity Solutions Operating Company shall have sole control of the defense and all related settlement negotiations.” Clause 13.4 deals with information privacy. It provides:
“M/S L-1 Identity Solutions Operating Company/ The team of M/S L-1 Identity Solutions Operating Company shall not carry any written/printed document, layout diagrams, floppy diskettes, hard disk, storage tapes, other storage devices or any other goods/material proprietary to Purchaser into/out of Datacenter Sites and UIDAI Locations without written permission from the Purchaser.” Clause 15, titled as “data and hardware”, provides:
“15.1 By virtue of this Contract, M/s L-1 Identity Solutions Operating Company/The team of M/s L-1 Identity Solutions Operating Company may have access to personal information of the Purchaser [UIDAI] and/or a third party or any resident of India, any other person covered within the ambit of any legislation as may be applicable. The purchaser shall have the sole ownership of and the right to use all such data in 437 Ibid 323 PART H perpetuity including any data or other information pertaining to the residents of India that may be in the possession of M/s L-1 Identity Solutions Operating Company or the Tram of M/s L-1 Identity Solutions Operating Company in the course of performing.
15.2 The purchaser shall have the sole ownership of and the right to use, proprietary Biometric templates of residents of India as created and maintained by M/S L-1 Identity Solutions Operating Company in the course of performing the Services under this Contract. In the event of termination or expiry of contract, M/S L-1 Identity Solutions Operating Company shall transfer all the proprietary templates to UIDAI in an electronic storage media in a form that is freely retrievable for reference and usage in future.
15.3 The Data shall be retained by M/S L-1 Identity Solutions Operating Company not more than a period of 7 years as per Retention Policy of Government of India or any other policy that UIDAI may adopt in future.” Under the Contract, L-1 Identity Solutions retains the ownership of the biometric software. UIDAI has been given only the license to use the software. Neither the Central Government nor the UIDAI have the source code for the de-duplication technology which is at the heart of the programme. The source code belongs to a foreign corporation. UIDAI is merely a licensee. It has also been provided that L-1 Identity Solutions can be given access to the database of UIDAI and the personal information of any individual. 232 This Court in Puttaswamy had emphasized on the centrality of consent in protection of data privacy:
“307…Apart from safeguarding privacy, data protection regimes seek to protect the autonomy of the individual. This is evident from the emphasis in the European data protection regime on the centrality of consent. Related to the issue of consent is the requirement of transparency which requires a disclosure by the data recipient of information pertaining to data transfer and use.” 324 PART H Prior to the enactment of the Aadhaar Act, an individual had no right of informed consent. Without the consent of individual citizens, UIDAI contracted with L-1 Identity Solutions to provide any information to it for the performance of the Contract. It has been provided in the Contract that L-1 Identity Solutions would indemnify UIDAI against any loss caused to it. However, the leakage of sensitive personal information of 1.2 billion citizens, cannot be remedied by a mere contractual indemnity. The loss of data is irretrievable. In a digital society, an individual has the right to protect herself by maintaining control over personal information. The protection of data of 1.2 billion citizens is a question of national security and cannot be indemnified by a Contract.
233 Mr Shyam Divan, learned senior counsel for the petitioners, has also drawn the attention of this Court to the Memorandum of Understanding (MoU) signed between UIDAI and various entities for carrying out the process of enrolment. Before the enactment of the Aadhaar Act, UIDAI existed as an executive authority, under the erstwhile Planning Commission and then under the Union Ministry of Communications and Information Technology. Mr. Divan has argued that the activities of the private parties engaged in the process of enrolment had no statutory or legal backing. It was his contention that MOUs signed between UIDAI and Registrars are not contracts within the purview of Article 299 of the Constitution, and therefore, do not cover the acts done by 325 PART H the private entities engaged by the Registrars for enrolment. In Monnet Ispat and Energy Ltd v Union of India438, this Court had held:
“290. What the appellants are seeking is in a way some kind of a specific performance when there is no concluded contract between the parties. An MOU is not a contract, and not in any case within the meaning of Article 299 of the Constitution of India.”439 The MoUs entered into by UIDAI do not fall within the meaning of Article 299 of the Constitution. There is no privity of contract between UIDAI and the Enrolling agencies.
234 This Court held in Puttaswamy that any law which infringes the right to privacy of an individual needs to have stringent inbuilt safeguards against the abuse of the process. The Aadhaar Act envisages UIDAI as the sole authority for the purpose of the Act. It entrusts UIDAI with a wide canvass of functions, both administrative and adjudicatory. It performs the functions of appointing enrolling agencies, registrars and requesting entities. Currently, there are 212 Registrars and 755 enrolling agencies in different states of the country. 440 Monitoring the actions of so many entities is not a task easily done. Responsibility has also been placed on UIDAI to manage and secure the central database of identity information of individuals. UIDAI is also required to ensure that data stored in CIDR is kept secure and confidential. It has been placed with the responsibility for the protection of the identity information of 1.2 billion citizens. UIDAI is entrusted with discretionary powers under the 438 (2012) 11 SCC 1 439 Ibid, at page 153 440 As submitted by Mr Rakesh Dwivedi, learned senior counsel for the State of Gujarat 326 PART H architecture of Aadhaar, including the discretion to share the personal information of any individual with the biometric service providers (BSPs) for the performance of contracts with them.
235 The proviso to Section 28(5) provides only for a request to UIDAI for access to information and does not make access to information a right of the individual. This would mean that it would be entirely upon the discretion of the UIDAI to refuse to grant access to the information once a request has been made. It is also not clear how a person is supposed to know that the biometric information contained in the database has changed if he/she does not have access to it. UIDAI is also empowered to investigate any breach under the Act, as a result of which any offence under the Act will be cognizable only if a complaint is filed by UIDAI. UIDAI is not an independent monitoring agency. Under the Aadhaar architecture, UIDAI is the only authority which carries out all the functions, be it administrative, adjudicatory, investigative, or monitoring of the project. While the Act confers such major functions on UIDAI, it does not place any institutional accountability upon UIDAI to protect the database of citizens’ personal information. The Act is silent on the liability of UIDAI and its personnel in case of non-compliance of the provisions of the Act or the regulations made under it. Under Section 23(2)(s) of the Act, UIDAI is required to establish a grievance redressal mechanism. Making the authority administering a project, also responsible for providing for the framework to 327 PART H address grievances arising from the project, severely compromises the independence of the grievance redressal body.441 Section 47 of the Act violates the right to seek remedy. Under Section 47(1), a court can take cognizance of an offence punishable under the Act only on a complaint made by UIDAI or any officer or person authorised by it. There is no grievance redressal mechanism if any breach or offence is committed by UIDAI itself. The law must specify who is to be held accountable. The Act lacks a mechanism through which any individual can seek speedy redressal for his/her data leakage and identity theft. Compensation must be provided for any loss of data of an individual. A stringent and independent redressal mechanism and options for compensation must be incorporated in the law. Section 47 is arbitrary as it fails to provide a mechanism to individuals to seek efficacious remedies for violation of their right to privacy. Whether it is against UIDAI or a private entity, it is critical that the individual retains the right to seek compensation and justice. This would require a carefully designed structure.442 236 An independent and autonomous authority is needed to monitor the compliance of the provisions of any statute, which infringes the privacy of an individual. A fair data protection regime requires establishment of an independent authority to deal with the contraventions of the data protection framework as well as to proactively supervise its compliance. The 441 The Centre for Internet & Society, Salient Points in the Aadhaar Bill and Concerns, available at https://cis- india.org/internet-governance/salient-points-in-the-aadhaar-bill-and-concerns. 442Shankkar Aiyar, Aadhaar: A Biometric History of India’s 12-Digit Revolution, Westland (2017), at pages 226- 227 328 PART H independent monitoring authority must be required to prescribe the standards against which compliance with the data protection norms is to be measured. It has to independently adjudicate upon disputes in relation to the contravention of the law. Data protection requires a strong regulatory framework to protect the basic rights of individuals. The architecture of Aadhaar ought to have, but has failed to embody within the law the establishment of an independent monitoring authority (with a hierarchy of regulators), along with the broad principles for data protection.443 The principles should include that the means of collection of data are fair and lawful, the purpose and relevance is clearly defined, user limitations accompanied by intelligible consent requirements are specified and subject to safeguards against risks such as loss, unauthorised access, modification and disclosure.444 The independent authority needs to be answerable to Parliament. In the absence of a regulatory framework which provides robust safeguards for data protection, the Aadhaar Act does not pass muster against a challenge on the ground of Article 14. The law fails to meet the norms expected of a data protection regime which safeguards the data of 1.2 billion Indians. The absence of a regulatory framework leaves the law vulnerable to challenge on the ground that it has failed to meet the requirements of fair institutional governance under the rule of law. 237 The scheme of the Aadhaar Act is postulated on the norms enunciated in Chapter VI for the protection of information and their enforcement under a 443Subhashis Banerjee, Architecture for privacy, The Indian Express (5 May 2018), available at https://indianexpress.com/article/opinion/columns/architecture-for-privacy-data-protection-facebook-india- united-states-5163819/ 444 Shankkar Aiyar, Aadhaar: A Biometric History of India’s 12-Digit Revolution, Westland (2017), at page 226 329 PART H regime of criminal offences and penalties under Chapter VII. Providing a regime under law for penalizing criminal wrongdoing is necessary. But, criminal offences are not a panacea for a robust regulatory framework under the auspices of an autonomous regulatory body. Violations in regard to the integrity of data may be incremental. Millions of data transactions take place in the daily lives of a community of individuals. Violations in regard to the integrity of data are numerous. Some of them may appear to be trivial, if looked at in isolation. However, cumulatively, these violations seriously encroach on the dignity and autonomy of the individual. A regime of criminal law may not in itself be adequate to deal with all these violations in terms of their volume and complexity. It is hence necessary that the criminal law must be supplemented by an independent regulatory framework. In its absence, there is a grave danger that the regime of data protection, as well as the administration of criminal justice will be rendered dysfunctional. Unfortunately, a regulatory framework of the nature referred to above is completely absent. UIDAI which is established and controlled by the Union Government possesses neither the autonomy nor the regulatory authority to enforce the mandate of the law in regard to the protection of data. The absence of a regulatory framework renders the legislation largely ineffective in dealing with data violations. Data protection cannot be left to an unregulated market place. Nor can the law rest in the fond hope that organized structures within or outside government will be self-compliant. The Aadhaar Act has manifestly failed in its legislative design to establish and enforce an autonomous 330 PART H regulatory mechanism. Absent such a mechanism, the state has failed to fulfil the obligation cast upon it to protect the individual right to informational self- determination.
238 Section 33(2), which permits disclosure of identity information and authentication records in the interest of national security, specifies a procedure for oversight by a committee. However, no substantive provisions have been laid down as guiding principles for the oversight mechanism such as the principle of data minimisation.
239 Privacy concerns relating to the Aadhaar project have been the subject of wide ranging deliberation. Biometric data offers strong evidence of one’s identity since it represents relatively unique biological characteristics which distinguish one person from another. As biometric data can be usually linked to only one individual it acts as a powerful, unique identifier that brings together disparate pieces of personal information about an individual. As a relatively unique identifier, biometric data not only allows individuals to be tracked, but it also creates the potential for the collection of an individual’s information and its incorporation into a comprehensive profile. Central databases, data matching/linking and profiling are technical factors that facilitate ‘function creep’ (the slippery slope according to which information can be used for functions other than that for which it was collected). Privacy advocates believe that any identification scheme can be carried out with a 331 PART H hidden agenda and that the slippery slope effect can be relevant to several factors such as motivations of governments and business, and on the existence of safeguards. The special nature of biometric data makes function creep more likely and even attractive. The legal measures possible to control function creep are still limited. However, there are several ways in which function creep can be curtailed. They include (i) limiting the amount of data that is collected for any stated purpose; (ii) enabling regulation to limit technological access to the system; (iii) concerted debates with all stakeholders and public participation; (iv) dispersion of multiple enablers for a system; and (v) enabling choices for user participation. 240 This Court held in Puttaswamy that a reasonable expectation of privacy requires that data collection must not violate the autonomy of an individual. The Court has held consent, transparency, and control over information as the cornerstones over which the fundamentals of informational privacy stand. The Court had made it clear that an individual has the right to prevent others from using his or her image, name and other aspects of personal life and identity for commercial purposes without consent. An Aadhaar number is a unique attribute of an individual. It embodies unique information associated with an individual. The manner in which it is to be used has to be dependent on the consent of the individual. 332 PART H 241 Section 57 of the Aadhaar Act allows the use of an Aadhaar number for establishing the identity of an individual “for any purpose” by the state, private entities and persons. Allowing private entities to use Aadhaar numbers will lead to commercial exploitation of an individual’s personal data without his/her consent and could lead to individual profiling. The contention is that Section 57 fails to meet the requirements set out in the Puttaswamy judgment. In this regard, reference must be drawn to a 2010 policy paper. A group of officers was created by the Government of India to develop a framework for a privacy legislation that would balance the need for privacy protection with security and sectoral interests, and respond to the need for domain legislation on the subject. An approach paper for the legal framework for a proposed legislation on privacy was prepared by the group and was uploaded on the website of the Government of India. The paper noted the repercussions of having a project based on a database of unique individual IDs:
“Data privacy and the need to protect personal information is almost never a concern when data is stored in a decentralized manner. However, all this is likely to change with the implementation of the UID Project. One of the inevitable consequences of the UID Project will be that the UID Number will unify multiple databases. As more and more agencies of the government sign on to the UID Project, the UID Number will become the common thread that links all those databases together. Over time, private enterprise could also adopt the UID Number as an identifier for the purposes of the delivery of their services or even for enrolment as a customer...Once this happens, the separation of data that currently exists between multiple databases will vanish… Such a vast interlinked public information database is unprecedented in India. It is imperative that appropriate steps be taken to protect personal data before the vast government 333 PART H storehouses of private data are linked up and the threat of data security breach becomes real.”445 The Paper highlighted the potential of exploitation that the UID project possessed. The potential was that the UID data could be used directly or indirectly by market forces for commercial exploitation as well as for intrusions by the State into citizens’ privacy. The Paper contained an incisive observation in regard to the exploitation of citizens’ data by private entities:
“Similarly, the private sector entities such as banks, telecom companies, hospitals etc are collecting vast amount of private or personal information about individuals. There is tremendous scope for both commercial exploitation of this information without the consent/ knowledge of the individual consent and also for embarrassing an individual whose personal particulars can be made public by any of these private entities. The IT Act does provide some safeguards against disclosure of data / information stored electronically, but there is no legislation for protecting the privacy of individuals for all information that may be available with private entities In view of the above, privacy of individual is to be protected both with reference to the actions of Government as well as private sector entities.”446 The Paper highlighted the need for a stringent privacy protection mechanism, which could prevent individual data from commercial exploitation as well as individual profiling.
242 Reference must also be drawn to Chapter V of the National Identification Authority of India Bill, 2010, which provided for the constitution of 445Government of India, Approach Paper for a Legislation on Privacy (2010), available at http://www.prsindia.org/uploads/media/UID/aproach_paper.pdf 446 Ibid 334 PART H an Identity Review Committee. The proposed Committee was to be entrusted to carry out the function of ascertaining the extent and pattern of usage of Aadhaar numbers across the country. The Committee was required to prepare a report annually in relation to the extent and pattern of usage of the Aadhaar numbers along with its recommendations thereon and submit it to the Central Government. The idea behind the establishment of such a Committee was to limit the extent to which Aadhaar numbers could be used. These provisions have not been included in the Aadhaar Act, 2016. Instead, the Act allows the use of Aadhaar number for any purpose by the State as well as private entities. This is a clear case of overbreadth and an instance of manifest arbitrariness.
243 Section 57 indicates that the legislature has travelled far beyond its stated object of ensuring targeted delivery of social welfare benefits. Allowing the Aadhaar platform for use by private entities overreaches the purpose of enacting the law. It leaves bare the commercial exploitation of citizens data even in purported exercise of contractual clauses. This will result in a violation of privacy and profiling of citizens.
335 PART H An article titled “Privacy and Security of Aadhaar: A Computer Science Perspective”447 underlines the risk of profiling and identification that is possible by the use of Aadhaar numbers. It states:
“The Aadhaar number is at the heart of the Aadhaar scheme and is one of the biggest causes of concern. Recall that the Aadhaar number is a single unique identifier that must function across multiple domains. Given that the Aadhaar number must necessarily be disclosed for obtaining services, it becomes publicly available, not only electronically but also often in human readable forms as well, thereby increasing the risk that service providers and other interested parties may be able to profile users across multiple service domains. Once the Aadhaar number of an individual is (inevitably) known, that individual may be identified without consent across domains, leading to multiple breaches in privacy.” 244 The risks which the use of Aadhaar “for any purpose” carries is that when it is linked with different databases (managed by the State or by private entities), the Aadhaar number becomes the central unifying feature that connects the cell phone with geo-location data, one’s presence and movement with a bank account and income tax returns, food and lifestyle consumption with medical records. This starts a “causal link” between information which was usually unconnected and was considered trivial. 448 Thus, linking Aadhaar with different databases carries the potential of being profiled into a system, which could be used for commercial purposes. It also carries the capability of influencing the behavioural patterns of individuals, by affecting their privacy and liberty. Profiling individuals could be used to create co-relations between human lives, which are generally unconnected. If the 447 Shweta Agrawal, Subhashis Banerjee, and Subodh Sharma, Privacy and Security of Aadhaar: A Computer Science Perspective, Economic & Political Weekly (16 September 2017), Vol. 52, available at https://www.epw.in/journal/2017/37/special-articles/privacy-and-security-aadhaar.html 448 Nishant Shah, Digital Native: Cause an effect, The Indian Express (17 June 2018), available at https://indianexpress.com/article/technology/social/digital-native-cause-an-effect-5219977/ 336 PART H traces of Aadhaar number are left in every facet of human life, it will lead to a loss of privacy. The repercussions of profiling individuals were anticipated in 1966 by Alexander Solzhenitsyn in ‘Cancer Ward’449. His views are prescient to our age:
“As every man goes through life he fills in a number of forms for the record, each containing a number of questions. A man’s answer to one question on one form becomes a little thread, permanently connecting him to the local centre of personnel records administration. There are thus hundreds of little threads radiating from every man, millions of threads in all. If these threads were suddenly to become visible, the whole sky would look like a spider’s web, and if they materialised as elastic bands, buses, trams and even people would all lose the ability to move, and the wind would be unable to carry torn newspapers or autumn leaves along the streets of the city. They are not visible, they are not material, but every man is constantly aware of their existence… Each man, permanently aware of his own invisible threads, naturally develops a respect for the people who manipulate the threads…” The invisible threads of a society networked on biometric data have grave portents for the future. Unless the law mandates an effective data protection framework, the quest for liberty and dignity would be as ephemeral as the wind.
245 A novelist’s vision is threatening to become a reality in our times.
Profiling can impact individuals and their behaviour. Since data collection records the preferences of an individual based on the entities which requested for proof of identity, any such pattern in itself is crucial data that could be used to predict the emergence of future choices and preferences of individuals. 449 Aleksandr Solzhenitsyn, Cancer Ward, The Bodley Head (1968) 337 PART H These preferences could also be used to influence the decision making of the electorate in choosing candidates for electoral offices. Such a practice would be unhealthy for the working of a democracy, where a citizen is deprived of free choice. In the modern digital era, privacy protection does not demand that data should not be collected, stored, or used, but that there should be provable guarantees that the data cannot be used for any purpose other than those that have been approved. In any of the programmes employed, it is imperative that the state takes strong data privacy measures to prevent theft and abuse. Moreover, it must be realized that an identification system like Aadhaar, which is implemented nationwide, will always be more prone to external threats. The State is always open to threat from its adversaries, and a national level identification system can become an easy target for anyone looking to cause serious damage as individuals’ biometric credentials are at risk in the process. Therefore, it is vital that state action ascertain security vulnerabilities while developing an identification system. These issues have not been dealt with by the Aadhaar Act. There is currently limited legislative or other regulatory guidance to specify whether private or public organisations are prevented from sharing or selling biometric information to others. Section 57 cannot be applied to permit commercial exploitation of the data of individuals or to affect their behavioural patterns. Section 57 does not pass constitutional muster. It is manifestly arbitrary, suffers from overbreadth and violates Article 14.
338 PART H 246 At its core, the Aadhaar Act attempts to create a method for identification of individuals so as to provide services, subsidies and other benefits to them. The Preamble of the Act explains that the architecture of the Act seeks to provide “efficient, transparent and targeted delivery of subsidies, benefits and services” for which the expenditure is incurred from the Consolidated Fund to resident individuals. Section 7 of the Act makes the proof of possession of Aadhaar number or Aadhaar authentication as a mandatory condition for receipt of a subsidy, benefit or service, which incurs expenditure from the Consolidated Fund of India. The scope of Section 7 is very wide. It leaves the door open for the government to route more benefits, subsidies and services through the Consolidated Fund of India and expand the scope of Aadhaar. Any activity of the government paid for from the Consolidated Fund of India ranging from supply of subsidised grains and LPG, to use of roads and civic amenities, healthcare, and even rebates to tax payers could come under such an umbrella. The scope of Section 7 could cover every basic aspect of the lives of citizens. The marginalized sections of society, who largely depend upon government’s social security schemes and other welfare programmes for survival could be denied basic living conditions because of a mismatch in biometric algorithms. The notifications issued by government under Section 7 of the Act, which require mandatory proof of possession of an Aadhaar number or requiring authentication, cover 252 schemes, including schemes for children (such as benefits under the Sarva Shiksha Abhiyan or getting meals under the Mid-day meal scheme, painting 339 PART H and essay competitions for children, scholarships on merit), schemes relating to rehabilitation of bonded labour and human trafficking, scholarship schemes for SC/ST students, universal access to tuberculosis care, pensions, schemes relating to labour and employment, skill development, personnel and training, agriculture and farmers’ welfare, primary and higher education, social justice, benefits for persons with disabilities, women and child development, rural development, food distribution, healthcare, panchayati raj, chemicals & fertilizers, water resources, petroleum and natural gas, science and technology, sanitation, textiles, urban development, minority affairs, road transport, culture, tourism, urban housing, tribal affairs and stipends for internship for students. The list is ever expanding and is endless. These notifications cover a large number of facilities provided by the government to its citizens. Every conceivable facility can be brought under the rubric of Section 7. From delivery to deliverance, almost every aspect of the cycle of life would be governed by the logic of Aadhaar. 247 When Aadhaar is seeded into every database, it becomes a bridge across discreet data silos, which allows anyone with access to this information to re-construct a profile of an individual’s life. It must be noted while Section 2(k) of the Aadhaar Act excludes storage of individual information related to race, religion, caste, tribe, ethnicity, language, income or medical history into CIDR, the mandatory linking of Aadhaar with various schemes allows the same result in effect. For instance, when an individual from a particular caste 340 PART H engaged in manual scavenging is rescued and in order to take benefit of rehabilitation schemes, she/he has to link the Aadhaar number with the scheme, the effect is that a profile as that of a person engaged in manual scavenging is created in the scheme database. The stigma of being a manual scavenger gets permanently fixed to her/his identity. What the Aadhaar Act seeks to exclude specifically is done in effect by the mandatory linking of Aadhaar numbers with different databases, under cover of the delivery of benefits and services.
Moreover, the absence of proof of an Aadhaar number would render a resident non-existent in the eyes of the State, and would deny basic facilities to such residents. Section 7 thus makes a direct impact on the lives of citizens. If the requirement of Aadhaar is made mandatory for every benefit or service which the government provides, it is impossible to live in contemporary India without Aadhaar. It suffers from the vice of being overbroad. The scope of subsidies provided by the government (which incur expenditure from the Consolidated Fund) is not the same as that of other benefits and services which the government provides to its citizens. Therefore, benefits and services cannot be measured with the same yardstick as subsidies. The inclusion of services and benefits in Section 7 is a pre- cursor to the kind of function creep which is inconsistent with privacy and informational self-determination. The broad definitions of the expressions ‘services and ‘benefits’ would enable government to regulate almost every 341 PART H facet of its engagement with citizens under the Aadhaar platform. Section 7 suffers from clear overbreadth in its uncanalised application to services and benefits.
248 The open-ended nature of the provisions of Section 7 is apparent from the definition of ‘benefit’ in Section 2(f) and of ‘service’ in Section 2(w). ‘Benefit’ is defined to mean any advantage, gift, reward, relief or payment in cash or kind provided to an individual or a group of individuals. ‘Service’ is defined to mean any provision, facility, utility, or any other assistance provided in any form to an individual or a group of individuals. These are broad and unstructured terms under which the government can cover the entire gamut of its activities involving an interface with the citizen. The provision has made no requirement to determine whether in the first place biometric identification is necessary in each case and whether a less intrusive modality should suffice. Both the definitions include such other services as may be notified by the Central government. The residuary clause is vague and ambiguous and leaves it to the Central government at its uncharted discretion to expand on what benefits and services would be covered by the legislation. The manner in which these definitions have been expansively applied to cover a wide range of activities is attributable to the vagueness implicit in Section 7. Can the provisions of Section 7 be applied with any justification to pensions payable on account of the past service rendered by a person to the state? 342 PART H Pension, it is well settled, is not a largesse or bounty conferred by the state. Pension, as a condition of service, attaches as a recompense for the long years of service rendered by an individual to the state and its instrumentalities. Pensioners grow older with passing age. Many of them suffer from the tribulations of old age including the loss of biometrics. It is unfair and arbitrary on the part of the state to deny pension to a person entitled to it by linking pensionary payments to the possession of an Aadhaar number or to its authentication. A right cannot be denied on the anvil of requiring one and only one means of identification. The pension disbursing authority is entitled to lay down regulations (which are generally speaking, already in place) to ensure the disbursal of pension to the person who is rightfully entitled. This aim of the government can be fulfilled by other less intrusive measures. The requirement of insisting on an Aadhaar number for the payment of pensionary benefits involves a breach of the principle of proportionality. Such a requirement would clearly be contrary to the mandate of Article 14. Similarly, the state as a part of its welfare obligations provides numerous benefits to school going children, including mid-day meals or scholarships, to children belonging to the marginalised segments of the society. Should the disbursal of these benefits be made to depend upon a young child obtaining an Aadhaar number or undergoing the process of authentication? The object of the state is to ensure that the benefits which it offers are being availed of by genuine students who are entitled to them. This legitimate aim can be fulfilled 343 PART H by adopting less intrusive measures as opposed to the mandatory enforcement of the Aadhaar scheme as the sole repository of identification. The state has failed to demonstrate that a less intrusive measure other than biometric authentication will not subserve its purposes. That the state has been able to insist on adherence to the Aadhaar scheme without exception is a result of the overbreadth of Section 7. Consequently, the inclusion of benefits and services in Section 7 suffers from a patent ambiguity, vagueness and overbreadth which renders the inclusion of services and benefits arbitrary and violative of Article 14.
249 Various entities are involved in the Aadhaar project. Their inter- dependencies require a greater onus to be put on them so as to match privacy and security requirements. The architecture of Aadhaar treats individuals as data. However, the core must be about personhood. The architecture of Aadhaar is destroyed by a lack of transparency, accountability and limitations. Safeguards for protection of individual rights ought to have been explicitly guaranteed by design and default.450 The presence of accountability and transparency within the Aadhaar architecture ought to be a necessary requirement so as to overcome the fear of the loss of privacy and liberty. Without these safeguards, the legislation and its architecture cannot pass muster under proportionality.
450 Shankkar Aiyar, Aadhaar: A Biometric History of India’s 12-Digit Revolution, Westland (2017), at page 226 344 PART H It is also important to highlight that identity is a vital facet of personality and hence of the right to life under Article 21 of the Constitution. Identity is essential and inalienable to human relationships and in the dealings of an individual with the State. The notion that individuals possess only one, or at the least, a dominant identity is not sound constitutional principle. The Constitution has been adopted for a nation of plural cultures. It is accepting of diversity in every walk of life. Diversity of identity is an expression of the plurality which constitutes the essence of our social culture. Amartya Sen in ‘The Argumentative Indian’451 demonstrates the untenability of the notion that identity is exclusive. He rejects the notion of an exclusive identity as “preposterous”, observing that in different settings, individuals rely upon and assert varying identities:
“Each of us invokes identities of various kinds in disparate contexts. The same person can be of Indian origin, a Parsee, a French citizen, a US resident, a woman, a poet, a vegetarian, an anthropologist, a university professor, a Christian, a bird watcher, and an avid believer in extra-
terrestrial life and of the propensity of alien creatures to ride around the cosmos in multicoloured UFOs. Each of these collectivities, to all of which this person belongs, gives him or her a particular identity. They can all have relevance, depending on the context.”452 Sen’s logic, drawn from how individuals express their personalities in the real world, has a strong constitutional foundation. In the protection which it grants to a diverse set of liberties and freedoms, the Constitution allows for the assertion of different identities. The exercise of each freedom may generate a distinct identity. Combinations of freedoms are compatible with composite 451 Amartya Sen, The Argumentative Indian, Penguin (2005), at page 350 452 Ibid, at page 350 345 PART H identities. Sen also rejects the notion that individuals “discover their identities with little room for choice”. The support for such a notion, as he observes, comes from communitarian philosophy, according to which identity precedes choice:
“As Professor Michael Sandel has explained this claim (among other communitarian claims) : ‘community describes not just what they have as fellow citizens but also what they are, not a relationship they choose (as in a voluntary association) but an attachment they discover, not merely an attribute but a constituent of their identity In this view, identity comes before reasoning and choice.”453 Sen rejects the above idea on the ground that it does not reflect a universally valid principle. Undoubtedly, some identities are ‘given’. But even here, as Sen explains, the issue is not whether an identity can be selected by an individual in all cases but whether the individual has a choice over the relative weight to be ascribed to different identities:
“The point at issue is not whether any identity whatever can be chosen (that would be an absurd claim), but whether we have choices over alternative identities or combinations of identities, and perhaps more importantly, whether we have some freedom in deciding what priority to give to the various identities that we may simultaneously have. People’s choices may be constrained by the recognition that they are, say, Jewish or Muslim, but there is still a decision to be made by them regarding what importance they give to that particular identity over others that they may also have (related, for example, to their political beliefs, sense of nationality, humanitarian commitments or professional attachments).”454 Sen reasons that identity is a plural concept and the relevance of different identities depends on the contexts in which they are asserted:
453 Ibid, at page 350 454 Ibid, at page 351 346 PART H “Identity is thus a quintessentially plural concept, with varying relevance of different identities in distinct contexts. And, most importantly, we have choice over what significance to attach to our different identities. There is no escape from reasoning just because the notion of identity has been invoked. Choices over identities do involve constraints and connections, but the choices that exist and have to be made are real, not illusory. In particular, the choice of priorities between different identities, including what relative weights to attach to their respective demands, cannot be only a matter of discovery.
They are inescapably decisional, and demand reason-not just recognition.”455 250 The Constitution recognizes, through the rights which it protects, a multitude of identities and the myriad forms of its expression. Our political identities as citizens define our relationship with the nation state. The rights which the Constitution recognizes as fundamental liberties constitute a reflection of the identity of the self. As we speak, so we profess who we are. An artist who paints, the writer who shares a thought, the musician who composes, the preacher who influences our spirituality and the demagogue who launches into human sensibilities are all participants in the assertion of identity. In this participative process, the identities of both the performer and the audience are continuously engaged. Identity at a constitutional level is reflected in the entitlement of every individual, protected by its values, to lead a way of life which defines the uniqueness of our beings. The Constitution recognizes a multitude of identities, based on the liberties which it recognizes as an inseparable part of our beings. To be human is to have a multitude of identities and be guaranteed the right to express it in various forms. The state 455 Ibid, at page 352 347 PART H which must abide by a written Constitution cannot require any person to forsake one or more identities. Constitutional freedoms compel the state to respect them.
251 Technologies that affect how our identities function must be subject to constitutional norms. The existence of individual identity is the core of a constitutional democracy. Addressing the Constituent Assembly on 4th November 1948, Dr B.R. Ambedkar had emphasised on the importance of individual identity in our constitutional framework:
“I am glad that the Draft Constitution has… adopted the individual as its unit.”456 Having an individual identity is an important part of the human condition. The negation of identity is the loss of personhood, which in turn affects the freedom of choice and free will. Personhood constructs democracy. It represents the quality of democracy. Our decided cases have recognized the intimate relationship between human liberty and identity. The traveller in Maneka Gandhi v Union of India457, the employee complaining of sexual harassment in Vishaka v State of Rajasthan458, the guardian of the minor in Githa Hariharan (Ms) v Reserve Bank of India459, the bar employee in Anuj Garg v Hotel Association of India460, the transgender in National Legal 456 Constituent Assembly Debates (4 November, 1948) 457 (1978) 1 SCC 248 458 (1997) 6 SCC 241 459 (1999) 2 SCC 228 460 (2008) 3 SCC 1 348 PART H Services Authority v Union of India461, the tribal worker in Madhu Kishwar v State of Bihar462 and the oppressed victim of state violence in Nandini Sundar v State of Chattisgarh463 are all engaged in the assertion of identity. Puttaswamy recognizes the role of the individual as “the core of constitutional focus” and “the focal point of the Constitution”. Justice Kaul’s concurring opinion recognised that the individual has the right to control her identity.464 It was submitted by the petitioners that a unique identity number infringes the identity of the individual since it reduces every resident to a number. Ascribing to the holder of an Aadhaar card, a unique identity number must not infringe constitutional identities. The Aadhaar Act indicates, in its Statement of Objects and Reasons, that correct identification of targeted beneficiaries is necessary and that a failure to establish the identity of an individual is a major hindrance in the disbursal of welfare benefits. Section 3(1) recognizes the entitlement of every resident to obtain an Aadhaar number. Section 4(3) provides that an Aadhaar number may be accepted as proof of identity. Section 7(1) indicates that its purpose is for establishing the identity of an individual for the receipt of services, benefits or subsidies drawn from the Consolidated Fund. These provisions cannot be allowed to displace constitutional identities. Nor can the provisions of Section 7 reduce an individual to a nameless or faceless person. 461 (2014) 5 SCC 438 462 (1996) 5 SCC 125 463 (2011) 7 SCC 547 464 Ibid 349 PART H 252 Aadhaar is about identification and is an instrument which facilitates a proof of identity. It must not obliterate constitutional identity. The definition of demographic information in Section 2(k) excludes race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. However, as has been specifically discussed before, the linking of the Aadhaar number to different databases is capable of profiling an individual, which could include information regarding her/his race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Thus, the impact of technology is such that the scheme of Aadhaar can reduce different constitutional identities into a single identity of a 12-digit number and infringe the right of an individual to identify herself/himself with choice. 253 Social security schemes and programmes are a medium of existence of a large segment of society. Social security schemes in India, such as the PDS, were introduced to protect the dignity of the marginalized. Exclusion from these schemes defeats the rationale for the schemes which is to overcome chronic hunger and malnutrition. Exclusion is violative of human dignity. As discussed previously in detail, the statistics recorded in government records and the affidavits filed by the petitioners point out glaring examples of exclusion due to technical errors in Aadhaar. The authentication failures in the Aadhaar scheme have caused severe disruptions particularly in rural India. Exclusion as a consequence of biometric devices has a disproportionate impact on the lives of the marginalized and poor. This Court 350 PART H cannot turn a blind eye to the rights of the marginalized. It may be the fashion of the day to advance the cause of a digital nation. Technology is undoubtedly an enabler. It has become a universal unifier of our age. Yet, the interface between technology and basic human rights cannot be oblivious to social reality. Compulsive linking of biometrics to constitutional entitlements should not result in denial to the impoverished. There exists a digital divide. To railroad those on one side of that divide unconcerned about social and technical constraints which operate in society is to defeat the purpose of social welfare. The Court has to be specifically conscious of the dignity of the underprivileged. The Court must fulfill its role of protecting constitutional values even if it affects a small percentage of the population. The exclusion errors in this case have led to grave injustice to the marginalized. The Court, therefore, has to play an active role in protecting their dignity. 254 The institution of rights places a heavy onus on the State to justify its restrictions. No right can be taken away on the whims and fancies of the State. The State has failed to justify its actions and to demonstrate why facilitating the targeted delivery of subsidies, which promote several rights such as the right to food for citizens, automatically entails a sacrifice of the right to privacy when both these rights are protected by the Constitution. One right cannot be taken away at the behest of the other especially when the State has been unable to satisfy this Court that the two rights are mutually exclusive. The State has been unable to respond to the contention of the 351 PART H petitioners that it has failed to consider that there were much less rights- invasive measures that could have furthered its goals. The burden of proof on the State was to demonstrate that the right to food and other entitlements provided through the Aadhaar scheme could not have been secured without the violating the fundamental rights of privacy and dignity. Dworkin in his classical book “Taking Rights Seriously”, while answering the question whether some rights are so important that the State is justified in doing all it can to maintain even if it abridges other rights, states that:
“But no society that purports to recognize a variety of rights, on the ground that a man’s dignity or equality may be invaded in a variety of ways, can accept such a principle… If rights make sense, then the degrees of their importance cannot be so different that some count not at all when others are mentioned.”465 (Emphasis supplied) 255 There is no antinomy between the right to privacy and the legitimate goals of the State. An invasion of privacy has to be proportional to and carefully tailored for achieving a legitimate aim. While the right to food is an important right and its promotion is a constitutional obligation of the State, yet the right to privacy cannot simply and automatically yield to it. No legitimate goal of the State can be allowed at the cost of infringement of a fundamental right without passing the test of constitutionality. While analysing the architecture of Aadhaar, this Court has demonstrated how the purported safeguards in the Aadhaar architecture are inadequate to protect the integrity of personal data, the right of informational self-determination and above all rights attributable to the privacy-dignity-autonomy trilogy. It is also concluded 465 Ronald Dworkin, Taking Rights Seriously (1977), at pages 203-204 352 PART H that the Aadhaar scheme is capable of destroying different constitutional identities. The financial exclusion caused due to errors in Aadhaar based authentication violate the individual’s right to dignity. The Aadhaar scheme causes an unwarranted intrusion into fundamental freedoms guaranteed under the Indian Constitution since the respondents have failed to demonstrate that these measures satisfy the test of necessity and proportionality.
H.5 Dignity and financial exclusion 256 Our jurisprudence reflects a keen awareness of the need to achieve dignity. The nine judge Bench decision in Puttaswamy also emphasized the seminal value of dignity in our constitutional scheme. Human dignity is a strengthening bond in the relationship between Parts III and IV of the Constitution. Reading the Directive Principles contained in Part IV in the context of the right to life (in Part III of the Constitution) has significant implications both for the substantive content of the right and on the ability of the state in pursuit of its positive obligation to secure conditions of a dignified existence. Dignity is an integral element of natural law and an inalienable constitutional construct. To lead a dignified life is a constitutional assurance to an individual. Dr Ambedkar conceptualized four basic premises on which a political democracy can rest:
“Political Democracy rests on four premises which may be set out in the following terms:
353
PART H
(i) The individual is an end in himself.
(ii) That the individual has certain inalienable rights which
must be guaranteed to him by the Constitution.
(iii) That the individual shall not be required to relinquish any of his constitutional rights as a condition precedent to the receipt of a privilege.
(iv) That the State shall not delegate powers to private persons to govern others.”466 (Emphasis supplied) Interpreting the words of Dr Ambedkar in a constitutional context, any action on the part of the State which forces an individual to part with her or his dignity or any other right under Part III will not be permissible. 257 The experience of living with chronic hunger; recurring uncertainty about the availability of food; debt bondage; low and highly underpaid work; self-denial; and sacrifice of other survival needs, being discriminated against467 are instances of the loss of dignity for the marginalized. The State has social security programmes and legislation to improve the living conditions of the marginalized and to protect their dignity and means of livelihood. However, as documented in the works of Sainath, Dreze, Sen and other authors, India has “utterly poor standards of the social services provided to common folk, whether it is the Mid-day Meal Scheme, the Sarva Shiksha Abhiyan, Integrated Child Development Services, Public Distribution system, healthcare at the primary health centres, district hospitals and even public 466Dr. Babasaheb Ambedkar: Writings and Speeches (Vol. 1), Dr. Ambedkar Foundation (2014) 467Harsh Mander, Living with Hunger: Deprivation among the Aged, Single Women and People with Disability, Economic & Political Weekly (April 26, 2008), Vol. 43, available at https://www.epw.in/journal/2008/17/special-articles/living-hunger-deprivation-among-aged-single-women-and- people 354 PART H hospitals in the state capitals”468. This manner of addressing the deprivations faced by the marginalized crushes their dignity. Any action or inaction on the part of the State which is insensitive to and unconcerned about protecting the dignity of the marginalized is constitutionally impermissible. Denial of benefits arising out of any social security scheme which promotes socio-economic rights of the marginalized, would not be legitimate under the Constitution, for the reason that such denial violates human dignity. No individual can be made to part with his or her dignity. Responsibility for protection of dignity lies not only with governments but also with individuals, groups and entities.
It is in the above background that this Court must deal with the next contention of the petitioners. The submission of the petitioners is that identity recognition technology may be based on a system which is deterministic or probabilistic. Biometric authentication systems work on a probabilistic model. For the purposes of authentication, a comparison is through a template which reduces the finger print to a scale and then, a minutea. The claim of the petitioners is that as a result, identities are reduced from certainty to a chance. 468Dignity, Not Mere Roti, Economic & Political Weekly (10 August, 2013), Vol. 48, available at https://www.epw.in/journal/2013/32/editorials/dignity-not-mere-roti.html 355 PART H 258 Section 7 of the Aadhaar Act makes it mandatory for an individual to undergo authentication or furnish proof of possession of an Aadhaar number in order to avail a subsidy, benefit or service, which incurs expenditure from the Consolidated Fund of India. In the Aadhaar based Biometric Authentication, the Aadhaar number and biometric information submitted by an Aadhaar number holder are matched with the biometric information stored in the CIDR. This may be fingerprints-based or iris-based authentication or other biometric modalities based on biometric information stored in the CIDR.469 It has been submitted that failure of the authentication process results in denial of a subsidy, benefit or service contemplated under Section 7 of the Act. It has been contended that non-enrolment in the Aadhaar scheme and non-linking of the Aadhaar number with the benefit, subsidy or service causes exclusion of eligible beneficiaries. It is the submission of the petitioners that authentication of biometrics is faulty, as biometrics are probabilistic in nature. It is the case of the petitioners that Aadhaar based biometric authentication often results in errors and thus leads to exclusion of individuals from subsidies, benefits and services provided under Section 7. Across the country, it has been urged, several persons are losing out on welfare entitlements because of a biometric mis-match. Mr Divan has argued in his written submissions, that “the project is not an ‘identity’ project but ‘identification’ 469 UIDAI, Aadhaar Authentication, available at https://uidai.gov.in/authentication.html 356 PART H exercise and unless the biometrics work, a person in flesh and blood, does not exist for the state”.
In order to deal with this contention, it is necessary to understand whether biometrics authentication can result in errors in matching. People are identified by three basic means: “by something they know, something they have, or something they are”.470 Biometrics fall within the last category, and, as such, should presumably be less susceptible to being copied or forged. However, various factors can reduce the probability of accurate human identification, and this increases the probability of a mismatch. Human fallibility can produce errors.471 259 In the United States of America, the National Academy of Science published a report in 2010 on biometrics titled “Biometric Recognition: Challenges & Opportunities”472. The report was based on a study carried out by several reputed scientists and researchers under the aegis of the National Research Council, the National Academy of Engineering and the Institute of Medicine. This report highlights the nature of biometrics as follows:
“Biometric recognition systems are inherently probabilistic and their performance needs to be assessed within the context of this fundamental and critical characteristic. Biometric recognition involves matching, within 470United States General Accounting Office, Technology Assessment: Using Biometrics for Border Security (2002), available at http://www.gao.gov/new.items/d03174.pdf.
471Jeremy Wickins, The ethics of biometrics: the risk of social exclusion from the widespread use of electronic identification, Science & Engineering Ethics (2007), at pages 45-54 472Biometric Recognition: Challenges & Opportunities (Joseph N. Pato and Lynette I. Millett eds.), National Academy of Science- United States of America (2010), available at https://www.nap.edu/read/12720/chapter/1 357 PART H a tolerance of approximation, of observed biometric traits against previously collected data for a subject. Approximate matching is required due to the variations in biological attributes and behaviors both within and between persons.”473 (Emphasis supplied) The report also took note of how changes in an individual’s biometrics may occur due to a number of factors:
“Biometric characteristics and the information captured by biometric systems can be affected by changes in age, environment, disease, stress, occupational factors, training and prompting, intentional alterations, socio- cultural aspects of the situation in which the presentations occurs, changes in human interface with the system, and so on. As a result, each interaction of the individual with the system (at enrolment, identification and so on) will be associated with different biometric information.
Individuals attempting to thwart recognition for one reason or another also contribute to the inherent uncertainty in biometric systems.”474 (Emphasis supplied) The report had also stated that biometrics can result in exclusion of people if it is used for claiming entitlement to a benefit:
“When used in contexts where individuals are claiming enrollment or entitlement to a benefit, biometric systems could disenfranchise people who are unable to participate for physical, social, or cultural reasons. For these reasons, the use of biometrics—especially in applications driven by public policy, where the affected population may have little alternative to participation—merits careful oversight and public discussion to anticipate and minimize detrimental societal and individual effects and to avoid violating privacy and due process rights.
Social, cultural, and legal issues can affect a system’s acceptance by users, its performance, or the decisions on whether to use it in the first place—so it is best to consider these explicitly in system design. Clearly, the behavior of those being enrolled and recognized can influence the accuracy and effectiveness of virtually any biometric system, 473 Ibid, at page 3 474 Ibid 358 PART H and user behavior can be affected by the social, cultural, or legal context. Likewise, the acceptability of a biometric system depends on the social and cultural values of the participant populations.”475 (Emphasis supplied) The report underlines that the relationship between an individual’s biometric traits and data records has the potential to cause disenfranchisement, when a section of the population is excluded from the benefits of positive claim systems. The report thus states that:
“Policies and interfaces to handle error conditions such as failure to enroll or be recognized should be designed to gracefully avoid violating the dignity, privacy, or due process rights of the participants.” (Emphasis supplied) 260 Els Kindt in a comprehensive research titled “Privacy and Data Protection Issues of Biometric Applications: A Comparative Legal Analysis”476, deals with the nature of biometrics. The book notes that error rates in biometric systems lead to a situation where entitled data subjects will be falsely rejected from the process of database matching. This will adversely affect the rights of individuals. It has been observed that:
“The error rates imply also that the system will allow impostors. This is equally important because the security of biometric systems should be questioned in case of high false accept rates. This element should be given sufficient weight in the decision to implement a biometric system for security purposes… Other tests clearly indicated increased error rates for young persons, in case of aging, in particular for face and for disabled persons. Individuals with health problems may also be falsely rejected or no longer be recognized, although they 475Ibid, at pages 10-11 476 Els J. Kindt, Privacy and Data Protection Issues of Biometric Applications: A Comparative Legal Analysis, Springer (2013) 359 PART H were previously enrolled. In some cases, (non-)enrolment will be a significant problem. It is clear that these data subjects need additional protection.”477 The book underlines the risk inherent in the limited accuracy of biometrics.478 261 A recently published book titled “Automating Inequality: How High-
Tech Tools Profile, Police, and Punish the Poor”479, authored by Virginia Eubanks, deals with the impact of data mining, policy algorithms, and predictive risk models on economic inequality and democracy in America.
Eubanks outlines the impacts of automated decision-making on public services in the USA through three case studies relating to welfare provision, homelessness and child protection services. Eubanks looks at these three areas in three different parts of the United States: Indiana, Los Angeles and Pittsburgh, to examine what technological automation has done in determining benefits and the problems it causes. The author records that in Indiana, one million applications for health care, food stamps, and cash benefits in three years were denied, because a new authentication system interpreted any application mistake as “failure to cooperate”. In Los Angeles, an algorithm calculates the comparative vulnerability of thousands of homeless people so as to prioritize them for an inadequate pool of housing resources. In Pittsburgh, child services use an algorithm to predict future behaviour. Statistics are used to predict which children might be future victims of abuse 477 Ibid, at page 363 478 Ibid 479 Virginia Eubanks, Automating Inequality: How High-Tech Tools Profile, Police, and Punish the Poor, St. Martin's Press (2018) 360 PART H or neglect. Eubanks shows how algorithms have taken over for human interaction and understanding. She has argued that automated decision- making is much wider in reach and is likely to have repercussions unknown to non-digital mechanisms, such as nineteenth-century poorhouses in America. Poorhouses were tax-supported residential institutions to which people were required to go if they could not support themselves. 480 People who could not support themselves (and their families) were put up for bid at public auction. The person who got the contract (which was for a specific time-frame) got the use of the labour of the poor individual(s) for free in return for feeding, clothing, housing and providing health care for the individual and his/her family. The practice was a form of indentured servitude and hardly had any recourse for protection against abuse. Eubanks considers the technology based decision-making for poverty management as the extension of the poorhouses of the 19th century:
“America’s poor and working-class people have long been subject to invasive surveillance, midnight raids, and punitive public policy that increase the stigma and hardship of poverty. During the nineteenth century, they were quarantined in county poorhouses. During the twentieth century, they were investigated by caseworkers, treated like criminals on trial. Today, we have forged what I call a digital poorhouse from databases, algorithms, and risk models. It promises to eclipse the reach and repercussions of everything that came before.
Like earlier technological innovations in poverty management, digital tracking and automated decision-making hide poverty from the professional middle-class public and give the nation the ethical distance it needs to make inhuman choices: who gets food and who starves, who has housing and who remains homeless, and which families are broken by the state. The digital poorhouse is a part of a long American 480 Tommy L. Gardner, Spending Your Way to the Poorhouse, Authorhouse (2004), at page 221 361 PART H tradition. We manage the individual poor in order to escape our shared responsibility for eradicating poverty.”481 The author further remarks:
“While poorhouses have been physically demolished, their legacy remains alive and well in the automated decision-
making systems that encage and entrap today's poor. For all their high-tech polish, our modern systems of poverty management - automated decision-making, data mining, and predictive analysis - retain a remarkable kinship with the poorhouses of the past. Our new digital tools spring from punitive, moralistic views of poverty and create a system of high-tech containment and investigation. The digital poorhouse deters the poor from accessing public resources; polices their labor, spending, sexuality, and parenting; tries to predict their future behavior; and punishes and criminalizes those who do not comply with its dictates. In the process, it creates ever-finer moral distinctions between the 'deserving' and 'undeserving' poor, categorizations that rationalize our national failure to care for one another.”482 (Emphasis supplied) Eubanks builds the argument that automated decision-making technology does not act as a facilitator for welfare schemes for the poor and only acts as a gatekeeper:
“New high-tech tools allow for more precise measuring and tracking, better sharing of information, and increased visibility of targeted populations. In a system dedicated to supporting poor and working-class people's self-determination, such diligence would guarantee that they attain all the benefits they are entitled to by law. In that context, integrated data and modernized administration would not necessarily result in bad outcomes for poor communities. But automated decision-