Try out our Premium Member services: Virtual Legal Assistant, Query Alert Service and an ad-free experience. Free for one month and pay only if you like it.
REPORTABLE IN THE SUPREME COURT OF INDIA CIVIL ORIGINAL JURISDICTION WRIT PETITION (CIVIL) NO. 494 OF 2012 JUSTICE K.S. PUTTASWAMY (RETD.) AND ANOTHER .....PETITIONER(S) VERSUS UNION OF INDIA AND OTHERS .....RESPONDENT(S) WITH TRANSFERRED CASE (CIVIL) NO. 151 OF 2013 TRANSFERRED CASE (CIVIL) NO. 152 OF 2013 WRIT PETITION (CIVIL) NO. 833 OF 2013 WRIT PETITION (CIVIL) NO. 829 OF 2013 TRANSFERRED PETITION (CIVIL) NO. 1797 OF 2013 WRIT PETITION (CIVIL) NO. 932 OF 2013 TRANSFERRED PETITION (CIVIL) NO. 1796 OF 2013 CONTEMPT PETITION (CIVIL) NO. 144 OF 2014 IN WRIT PETITION (CIVIL) NO. 494 OF 2012 TRANSFERRED PETITION (CIVIL) NO. 313 OF 2014 Signature Not Verified TRANSFERRED PETITION (CIVIL) NO. 312 OF 2014 Digitally signed by CHETAN KUMAR SPECIAL LEAVE PETITION (CRIMINAL) NO. 2524 OF 2014 Date: 2018.09.26 13:36:51 IST Reason: WRIT PETITION (CIVIL) NO. 37 OF 2015 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 1 of 567 WRIT PETITION (CIVIL) NO. 220 OF 2015 CONTEMPT PETITION (CIVIL) NO. 674 OF 2015 IN WRIT PETITION (CIVIL) NO. 829 OF 2013 TRANSFERRED PETITION (CIVIL) NO. 921 OF 2015 CONTEMPT PETITION (CIVIL) NO. 470 OF 2015 IN WRIT PETITION (CIVIL) NO. 494 OF 2012 WRIT PETITION (CIVIL) NO. 231 OF 2016 CONTEMPT PETITION (CIVIL) NO. 444 OF 2016 IN WRIT PETITION (CIVIL) NO. 494 OF 2012 CONTEMPT PETITION (CIVIL) NO. 608 OF 2016 IN WRIT PETITION (CIVIL) NO. 494 OF 2012 WRIT PETITION (CIVIL) NO. 797 OF 2016 CONTEMPT PETITION (CIVIL) NO. 844 OF 2017 IN WRIT PETITION (CIVIL) NO. 494 OF 2012 WRIT PETITION (CIVIL) NO. 342 OF 2017 WRIT PETITION (CIVIL) NO. 372 OF 2017 WRIT PETITION (CIVIL) NO. 841 OF 2017 WRIT PETITION (CIVIL) NO. 1058 OF 2017 WRIT PETITION (CIVIL) NO. 966 OF 2017 WRIT PETITION (CIVIL) NO. 1014 OF 2017 WRIT PETITION (CIVIL) NO. 1002 OF 2017 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 2 of 567 WRIT PETITION (CIVIL) NO. 1056 OF 2017 AND CONTEMPT PETITION (CIVIL) NO. 34 OF 2018 IN WRIT PETITION (CIVIL) NO. 1014 OF 2017 JUDGMENT
A.K. SIKRI, J.
(For Chief Justice, himself and A.M. Khanwilkar, J.) Introduction and Preliminaries:
It is better to be unique than the best. Because, being the best makes you the number one, but being unique makes you the only one.
2) ‘Unique makes you the only one’ is the central message of Aadhaar, which is on the altar facing constitutional challenge in these petitions. ‘Aadhaar’ which means, in English, ‘foundation’ or ‘base’, has become the most talked about expression in recent years, not only in India but in many other countries and international bodies. A word from Hindi dictionary has assumed secondary significance. Today, mention of the word ‘Aadhaar’ would not lead a listener to the dictionary meaning of this word. Instead, every person on the very mentioning of this word ‘Aadhaar’ would associate it with the card that is issued to a Writ Petition (Civil) No. 494 of 2012 & connected matters Page 3 of 567 person from where he/she can be identified. It is described as an ‘Unique Identity’ and the authority which enrols a person and at whose behest the Aadhaar Card is issued is known as Unique Identification Authority of India (hereinafter referred to as ‘UIDAI’ or ‘Authority’). It is described as unique for various reasons. UIDAI claims that not only it is a foolproof method of identifying a person, it is also an instrument whereby a person can enter into any transaction without needing any other document in support. It has become a symbol of digital economy and has enabled multiple avenues for a common man. Aadhaar scheme, which was conceptualised in the year 2006 and launched in the year 2009 with the creation of UIDAI, has secured the enrolment of almost 1.1 billion people in this country. Its use is spreading like wildfire, which is the result of robust and aggressive campaigning done by the Government, governmental agencies and other such bodies. In this way it has virtually become a household symbol. The Government boasts of multiple benefits of Aadhaar.
3) At the same time, the very scheme of Aadhaar and the architecture built thereupon has received scathing criticism from a section of the society. According to them, Aadhaar is a serious invasion into the right to privacy of persons and it has the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 4 of 567 tendency to lead to a surveillance state where each individual can be kept under surveillance by creating his/her life profile and movement as well on his/her use of Aadhaar. There has been no other subject matter in recent past which has evoked the kind of intensive and heated debate wherein both sides, for and against, argue so passionately in support of their respective conviction. The petitioners in these petitions belong to the latter category who apprehend the totalitarian state if Aadhaar project is allowed to continue. They are demanding scrapping and demolition of the entire Aadhaar structure which, according to them, is anathema to the democratic principles and rule of law, which is the bedrock of the Indian Constitution. The petitioners have challenged the Aadhaar project which took off by way of administrative action in the year 2009. Even after Aadhaar got a shield of statutory cover, challenge persists as the very enactment known as Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (hereinafter referred to as the ‘Aadhaar Act’) is challenged as constitutionally impermissible. The wide range of issues involved in this case is evident from the fact that it took almost four months for the parties to finish their arguments in these cases, and the Court witnessed highly skilled, suave, brilliant and intellectual advocacy, with the traces of passions as Writ Petition (Civil) No. 494 of 2012 & connected matters Page 5 of 567 well.
4) The issue has generated heated public debate as well. Even outside the Court, there are groups advocating in favour of the Aadhaar scheme and those who are stoutly opposing the same. Interestingly, it is not only the commoners who belong to either of the two groups but intelligentsia is also equally divided. There have been number of articles, interviews for discourses in favour of or against Aadhaar. Those in favour see Aadhaar project as ushering the nation into a regime of good governance, advancing socio-economic rights, economic prosperity etc. and in the process they claim that it may make the nation a world leader. Mr. K.K. Venugopal, learned Attorney General for India, referred to the commendations by certain international bodies, including the World Bank. We clarify that we have not been influenced by such views expressed either in favour or against Aadhaar. Those opposing Aadhaar are apprehensive that it may excessively intrude into the privacy of citizenry and has the tendency to create a totalitarian state, which would impinge upon the democratic and constitutional values. Some such opinions of various persons/bodies were referred to during the arguments. Notwithstanding the passions, emotions, annoyance, despair, Writ Petition (Civil) No. 494 of 2012 & connected matters Page 6 of 567 ecstasy, euphoria, coupled with rhetoric, exhibited by both sides in equal measure during the arguments, this Court while giving its judgment on the issues involved is required to have a posture of calmness coupled with objective examination of the issues on the touchstone of the constitutional provisions.
5) Initiative in spearheading the attack on the Aadhaar structure was taken by the petitioners, namely, Justice K.S. Puttaswamy (Retd.) and Mr. Pravesh Khanna, by filing Writ Petition (Civil) No. 494 of 2012. At that time, Aadhaar scheme was not under legislative umbrella. In the writ petition the scheme has primarily been challenged on the ground that it violates fundamental rights of the innumerable citizens of India, namely, right to privacy falling under Article 21 of the Constitution of India. Few others joined the race by filing connected petitions. Series of orders were passed in this petition from time to time, some of which would be referred to by us at the appropriate stage. In 2016, with the passing of the Aadhaar Act, these very petitioners filed another writ petition challenging the vires of the Act. Here again, some more writ petitions have been filed with the same objective. All these writ petitions were clubbed together. There are number of interventions as well by various individuals, groups, NGOs, etc., some opposing the petitions and some supporting the Aadhaar Writ Petition (Civil) No. 494 of 2012 & connected matters Page 7 of 567 scheme.
6) Before we go into the premise on which the attack is laid on the constitutional validity of the Aadhaar project and the Aadhaar Act, it would be apposite to take note of the events in chronological order that shaped the formulation, take off and implementation of the Aadhaar scheme.
7) On March 03, 2006, approval was given by the Department of Information Technology, Ministry of Communications and Information Technology, Government of India for the project titled ‘Unique Identification for BPL Families’ to be implemented by the National Informatics Centre (NIC) for over a period of twelve months. As a result, a Processes Committee was set up on July 03, 2006 to suggest the process for updation, modification, addition and deletion of data and fields from the core database to be created under the Unique Identification for BPL Families project. This Committee, on November 26, 2006, prepared a paper known as ‘Strategic Vision Unique Identification of Residents’. Based thereupon, the Empowered Group of Ministers (EGoM) was set up on December 04, 2006, to collate the National Population Register under the Citizenship Act, 1955 and the Unique Identification Number project of the Department Writ Petition (Civil) No. 494 of 2012 & connected matters Page 8 of 567 of Information Technology. The EGoM was also empowered to look into the methodology and specific milestones for early and effective completion of projects and to take a final view on these projects. The EGoM was composed of the then Ministers of External Affairs, Home Affairs, Law, Panchayati Raj and Communications and Information Technology and the then Deputy Chairman, Planning Commission.
8) Various meetings on the Unique Identification (hereinafter referred to as ‘UID’) project were held from time to time. In the fourth meeting held on December 22, 2006, various aspects of proposed data elements and their formats were discussed. Thereafter, in its fifth meeting held on April 27, 2007, it was decided that the evolution of UID database would be in three stages in principle. The Committee further decided that linkage with major partner databases such as Household Survey of RD and the individual State Public Distribution System (PDS) databases should be taken up in a phased manner. On June 11, 2007, at the final stage of the project, a presentation on the UID project was made to the then Prime Minister by the Cabinet Secretary. The sixth meeting of the UID project was held on June 15, 2007. The Committee, inter alia, took the following decisions: Writ Petition (Civil) No. 494 of 2012 & connected matters Page 9 of 567
(i) The numbering format of 11 digits was approved.
(ii) The need for UID authority to be created by an executive order under the aegis of the Planning Commission was appreciated in order to ensure pan-departmental and neutral identity for the authority.
(iii) The proposal for creation of Central and State UIDs was approved.
(iv) Department of Information Technology (DIT) was directed to work out modalities for linkage with Election Commission and initiate discussions with MoRD and PDS for linkage.
(v) In principle, approval of proposed sequence for phasing plan was granted.
9) In the seventh meeting held on August 30, 2007, the proposed administrative framework and structure of UID authority and manpower requirement, including financial implications, was discussed. It was decided that a detailed proposal based on the resource model be presented to the Committee for its ‘in principle’ approval. At this stage, EGoM convened its first meeting on November 27, 2007. At this meeting, a consensus emerged on the following points:
(i) There is a clear need for creating an identity related Writ Petition (Civil) No. 494 of 2012 & connected matters Page 10 of 567 resident database, regardless of whether the database is created on a de novo collection of data or is based on an already existing data (such as the Election Commission’s Voter List).
(ii) Additionally, there is a critical need to create an institutional mechanism that would ‘own’ the database and be responsible for its maintenance and updating.
(iii) The next meeting is to consider topics relating to collating the National Population Register (NPR) and UID schemes, including methodology, effective implementation techniques, identification of the institutional mechanism stated above, and the time schedule for putting the scheme into operation.
A series of meetings took place thereafter to work out the modalities of the programme. Certain issues were raised therein and to address those issues, a Committee of Secretaries was formed. The said Committee gave its recommendations which were discussed by EGoM. After approving the Aadhaar Scheme in principle, it instructed the Cabinet Secretary to convene a meeting to finalise the detailed organisational structure of the UID.
10) After considering the recommendation of the Cabinet Secretary, Notification No. A-43011/02/2009-Admn.I was issued on January Writ Petition (Civil) No. 494 of 2012 & connected matters Page 11 of 567 28, 2009 by the Government of India which constituted and notified the UIDAI as an attached office under the aegis of the Planning Commission. Consequent to the constitution of UIDAI, allocation of Rs.147.31 crores for Phase I of Aadhaar enrolments was approved by the Finance Minister on the recommendation of the Standing Committee on Finance. Demo-Official letter dated February 25, 2009, was sent by the Secretary, Planning Commission to all Chief Secretaries of 35 States/Union Territories apprising them of their roles and responsibilities of the States/Union Territories in implementation of UIDAI, such as appointment of the State/UT UID Commissioners, logistics support and coordination with various departments and State units.
As they say, rest is history, which we recapitulate in brief hereinafter.
11) A core group was set up to advice and further the work related to UIDAI. Budgets were allocated to UIDAI to enable it to undertake its task. Staff was also allocated to it. Meetings of the core group took place from time to time. The core group, inter alia, decided that it was better to start with the electoral roll database of 2009 for undertaking the UIDAI project. The status of digitisation of Writ Petition (Civil) No. 494 of 2012 & connected matters Page 12 of 567 PDS records, state-wise, was sought to be sent from the Department of Food and Public Distribution to the Standing Commission/UID. This and other steps taken in this direction culminated in issuance of Notification dated July 02, 2009 whereby Mr. Nandan Nilekani was appointed as the Chairman of UIDAI for an initial tenure of five years in the rank and status of a Cabinet Minister. He assumed charge on July 24, 2009. Thereafter, the Prime Minister’s Council of UIDAI was constituted on July 30, 2009 which held its first meeting on August 12, 2009 where the Chairman of UIDAI made detailed representation on the broad strategy and approach of the proposed UID project. One of the proposals was to provide a legislative framework for UID at the earliest so that it could have the legal sanction to perform its function. Some other Committees like the Biometrics Standard Committee, Demographic Data Standards and Verification Procedure Committee were set up as a support system to the project, which submitted their respective reports in December 2009. Even a Cabinet Committee on UID was constituted vide orders dated October 22, 2009 which was headed by the Prime Minister with the aim to cover all issues relating to UIDAI, including its organisation, policies, programmes, schemes, funding and methodology to be adopted Writ Petition (Civil) No. 494 of 2012 & connected matters Page 13 of 567 for achieving its objectives.
12) The matter was addressed in the Seventeenth Finance Commission Report also which was tabled in the Parliament on February 25, 2010. In this report, the Finance Commission suggested targeting of subsidies through UIDAI. By April 2010, UIDAI came out with its Strategy Overview. This Overview describes the features, benefits, revenue model and timelines of the UIDAI project. Furthermore, it outlined the goal of the UID to serve as a universal proof of identity, allowing residents to prove their identities anywhere in the country. The project would give the Government a clear view of India’s population, enabling it to target and deliver services effectively, achieve greater returns on social investments and monitor money and resource flows across the country. It was felt that crucial to the achievement of this goal is the active participation of the central, state and local Governments as well as public and private sector entities. Only with their support will the project be able to realise a larger vision of inclusion and development in India.
13) A Cabinet Note bearing No. 4(4)/57/2010/CC-UIDAI for the Cabinet Committee on UIDAI was submitted on May 12, 2010. The Note outlined a brief background of UIDAI, proposed an Writ Petition (Civil) No. 494 of 2012 & connected matters Page 14 of 567 approach for collection of demographic and biometric attributes of residents for the UID project and sought approval of the Cabinet Committee for adoption of the aforesaid approach and suggested that the same standards and processes be adhered to by the Registrar General of India for the NPR exercise and all other Registrars in the UID system. Rationale for inclusion of iris biometrics was also submitted with the aforesaid Cabinet Note to explain the need for capturing iris scans at the time of capturing biometric details.
14) By September 2010 enrolment process of Aadhaar began with the nationwide launch of the Aadhaar project. In December 2010, UIDAI came out with a report on enrolment process known as ‘UID Enrolment Proof-of-Concept Report’ studying enrolment proof-of-concept in three rural areas of Karnataka, Bihar and Andhra Pradesh published by the UIDAI. According to this report, ‘the biometric matching analysis of 40,000 people showed that the accuracy levels achieved by both iris and ten fingerprints were more than an order of magnitude better compared to using either of the two individually. The multi-modal enrolment was adequate to carry out de-duplication on a much larger scale, with reasonable expectations of extending it to all residents of India’. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 15 of 567
15) Going by the recommendation of the Chairman of UIDAI for providing legislative framework to UIDAI, a Bill was introduced in the Rajya Sabha on December 03, 2010 known as ‘National Identification Authority of India Bill, 2010’.
16) Various other steps were taken to smoothen the process of enrolment. There were studies from time to time on the effectiveness of the enrolment process. Notifications/orders were also issued by the Reserve Bank of India stating that an Aadhaar letter would be recognised by Banks to open bank accounts for a resident. Similar Orders/Notifications were issued by other authorities as well. On the first anniversary of Aadhaar launch, which fell on September 29, 2011, announcement was made that 10 crores enrolments and generation of more than 3.75 crores of Aadhaar had taken place. Some of the reports submitted in due course of time, which are relevant for our purposes, are taken note of at this stage:
(i) Report of the Task Force on an Aadhaar-Enabled Unified Payment Infrastructure for the direct transfer of subsidies on Kerosene, LPG and Fertilizer.
(ii) In March 2012, Fingerprint Authentication Report was submitted to UIDAI. This Report showcased the high accuracy Writ Petition (Civil) No. 494 of 2012 & connected matters Page 16 of 567 rates of using fingerprints to authenticate identities. The study conducted in the rural setting representing typical demography of the population established that it is technically possible to use fingerprint to authenticate a resident in 98.13% of the population. The accuracy of 96.5% can be achieved using one best finger and 99.3% can be achieved using two fingers. Further improvement is possible if the device specifications are tightened to include only the best devices and certain mechanical guide is used to aid proper placement of the finger. It was also demonstrated through benchmarking that the authentication infrastructure is able to sustain one million authentications per hour.
(iii) Fifty Third Report of the Standing Committee on Finance on the ‘Demands for Grants (2012-13)’ of the Ministry of Planning was presented to the Lok Sabha and Rajya Sabha on April 24, 2012. This Report summarises the objectives and financial implications of the UID scheme being implemented under the aegis of the Planning Commission.
(iv) Iris Authentication Accuracy Report was submitted to UIDAI on September 12, 2012. This Report based on an empirical study of 5833 residents demonstrated iris authentication to be viable in Indian context. With current level of device readiness for Writ Petition (Civil) No. 494 of 2012 & connected matters Page 17 of 567 iris capture, it is capable of providing coverage for 99.67% of population with authentication accuracy of above 99.5%. Suggestions made in this document for the vendors, once implemented, will improve the rates further. The overall systems – network and software – have shown to meet desired requirements in real life condition. Finally, six different devices with variety of form and function are available to provide competitive vendor eco-system.
(v) Background Note on Introduction to Cash Transfers was prepared by the National Committee on Direct Cash Transfers in its first meeting on November 26, 2012. This Report outlines the advantages of cash transfers in the Indian context stating that a unique ID for all is a prerequisite for this purpose.
17) At this juncture, Writ Petition (Civil) No. 494 of 2012 was filed in which show-cause notice dated November 30, 2012 was issued by this Court. As pointed out above, this writ petition assailed Aadhaar scheme primarily on the ground that it violates right to privacy which is a facet of fundamental rights enshrined in Article 21 of the Constitution.
18) Counter affidavit thereto was filed by the Union of India as well as UIDAI. The stand taken by the respondents, inter alia, was that Writ Petition (Civil) No. 494 of 2012 & connected matters Page 18 of 567 right to privacy is not a fundamental right, which was so held by the eight Judge Bench judgment in M.P. Sharma and 4 Others v. Satish Chandra Distt. Magistrate, Delhi and 4 Others 1. This is notwithstanding the fact that thereafter in many judgments rendered by this Court, right to privacy was accepted as a facet of Article 21. Contention of the respondents, however, was that those judgments were contrary to the dicta laid down in M.P. Sharma and were, therefore, per in curium. The matter on this aspect was heard by a three Judge Bench and after hearing the parties, the Bench deemed it appropriate to make the reference to the Constitution Bench. A five Judge Bench was constituted, which after considering the matter, referred the same to a nine Judge Bench to resolve the controversy in an authoritative manner. The nine Judge Bench judgment has given an unanimous answer to the Reference with conclusive, unambiguous and emphatic determination that right to privacy is a part of fundamental rights which can be traced to Articles 14, 19 and 21 of the Constitution of India.
19) We may also record at this stage that in this petition certain interim orders were passed from time to time. We may give the gist of some of the relevant orders:
1 1954 SCR 1077 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 19 of 567
(a) Order dated September 23, 2013 (two Judge Bench) “All the matters require to be heard finally. List all matters for final hearing after the Constitution Bench is over. In the meanwhile, no person should suffer for not getting the Aadhaar card in spite of the fact that some authority had issued a circular making it mandatory and when any person applies to get the Aadhaar card voluntarily, it may be checked whether that person is entitled for it under the law and it should not be given to any illegal immigrant.”
(b) Order dated November 26, 2013 (two Judge Bench) “After hearing the matter at length, we are of the view that all the States and Union Territories have to be impleaded as respondents to give effective directions. In view thereof, notice be issued to all the States and Union Territories through standing counsel.
xx xx xx Interim order to continue, in the meantime.”
(c) Order dated March 16, 2015 (three Judge Bench) “In the meanwhile, it is brought to our notice that in certain quarters, Aadhaar identification is being insisted upon by the various authorities, we do not propose to go into the specific instances.
Since Union of India is represented by learned Solicitor General and all the States are represented through their respective counsel, we expect that both the Union of India and States and all their functionaries should adhere to the order passed by this Court on 23rd September, 2013.”
(d) Order dated August 11, 2015 (three Judge Bench) “Having considered the matter, we are of the view that the balance of interest would be best served, till the matter is finally decided by a larger Bench, if the Union of India or the UIDAI proceed in the following manner:
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 20 of 567
1. The Union of India shall give wide publicity in the electronic and print media including radio and television networks that it is not mandatory for a citizen to obtain an Aadhaar card.
2. The production of an Aadhaar card will not be condition for obtaining any benefits otherwise due to a citizen.
3. The Unique Identification Number or the Aadhaar card will not be used by the respondents for any purpose other than the PDS Scheme and in particular for the purpose of distribution of food grains, etc. and cooking fuel, such as kerosene. The Aadhaar card may also be used for the purpose of LPG Distribution Scheme.
4. The information about an individual obtained by the Unique Identification Authority of India while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a Court for the purpose of criminal investigation.”
(d) Order dated October 15, 2015 (Constitution Bench) “3. After hearing the learned Attorney General for India and other learned senior counsels, we are of the view that in paragraph 3 of the order dated 11.08.2015, if we add, apart from the other two Schemes, namely, P.D.S. Scheme and L.P.G. Distribution Scheme, the Schemes like The Mahatma Gandhi National Social Assistance Programme (Old Age Pensions, Widow Pensions, Disability Pensions), Prime Minister’s Jan Dhan Yojana (PMJDY) and Employees’ Provident Fund Organisation (EPFO) for the present, it would not dilute earlier order passed by this Court. Therefore, we now include the aforesaid Schemes apart from the other two Schemes that this Court has permitted in its earlier order dated 11.08.2015.
4. We impress upon the Union of India that it shall strictly follow all the earlier orders passed by this Court commencing from 23.09.2013.
5. We will also make it clear that the Aadhaar card scheme is purely voluntary and it cannot be made mandatory till the matter is finally decided by this Court one way or the other.” Writ Petition (Civil) No. 494 of 2012 & connected matters Page 21 of 567
(e) Order dated September 14, 2016 in WP (C) No. 686/2016 “Having regard to the facts and circumstances of the case, the material evidence available on record and the submissions made by learned senior counsel, we stay the operation and implementation of letters dated 14.07.2006 (i.e. Annexure P-5, P-6, P-7) for Pre-Matric Scholarship Scheme, Post-Matric Scholarship Scheme and Merit-cum- Means Scholarship Scheme to the extent they have made submission of Aadhaar mandatory and direct the Ministry of Electronics and Information Technology, Government of India, i.e. respondent No.2, to remove Aadhaar number as a mandatory condition for student registration form at the National Scholarship Portal of Ministry of Electronics and Information Technology, Government of India at the website...”
20) It is also relevant to point out that against an order passed by the High Court of Bombay at Panaji, in some criminal proceedings, wherein the Authority was directed to pass on biometric information on a person, UIDAI had filed Special Leave Petition (Criminal) No. 2524 of 2014 challenging the said order with the submission that such a direction for giving biometric information was contrary to the provisions of the Aadhaar Act and the Authority was not supposed to give such an information, which was confidential. In the said special leave petition, order dated March 24, 2014 was passed staying the operation of the orders of the Bombay High Court. This order reads as under:
“Issue notice.
In addition to normal mode of service, dasti service, is permitted.Writ Petition (Civil) No. 494 of 2012 & connected matters Page 22 of 567
Operation of the impugned order shall remain stayed.
In the meanwhile, the present petitioner is restrained from transferring any biometric information of any person who has been allotted the Aadhaar number to any other agency without his consent in writing.
More so, no person shall be deprived of any service for want of Aadhaar number in case he/she is otherwise eligible/entitled. All the authorities are directed to modify their forms/circulars/likes so as to not compulsorily require the Aadhaar number in order to meet the requirement of the interim order passed by this Court forthwith. Tag and list the matter with main matter i.e. WP (C) No. 494 of 2012.”
21) Likewise, in Writ Petition (Civil) No. 1002 of 2017 titled Dr. Kalyan Menon Sen v. Union of India and Others, where constitutional validity of linking bank accounts and mobile phones with Aadhaar linkage was challenged, interim order was passed on November 03, 2017 extending the last date of linking to December 31, 2017 and February 06, 2018 respectively. This order was extended thereafter and continues to operate.
22) We would also like to refer to the order dated September 14, 2011 passed in People’s Union for Civil Liberties (PDS Matter) v. Union of India & Ors.2, wherein various directions were given to ensure effective implementation of the PDS Scheme and in the process to also undertake the exercise of eliminating the task and 2 (2011) 14 SCC 331 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 23 of 567 ghost ration cards. In the same manner, vide order dated March 16, 2012 it was noted that the Government had set up a task force under the Chairmanship of Mr. Nandan Nilekani to recommend, amongst others, an IT strategy for the PDS. Mr. Nilekani was requested to suggest ways and means by which computerization process of the PDS can be expedited. Computerisation of PDS system was directed to be prepared and in this hue the process of computerisation with Aadhaar registration was also suggested.
In the same very case above, which also pertained to providing night shelters to homeless destitute persons, some orders were passed on February 10, 2010 3 as well as on September 14, 20114.
23) Again, in the case of State of Kerala & Ors. v. President, Parent Teachers Association SNVUP School and Ors. 5, where the Court was concerned with the problem of fake or bogus admissions, it was felt that instead of involving the Police in schools to prevent fake admissions, more appropriate method of verification would be Unique Identification (UID) card as means of verification. Architecture of the Aadhaar Project and the Aadhaar Act: 3 (2010) 5 SC 318 4 (2010) 13 SCC 45 5 (2013) 2 SCC 705 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 24 of 567
24) Before adverting to the discussion on various issues that have been raised in these petitions, it would be apposite to first understand the structure of the Aadhaar Act and how it operates, having regard to various provisions contained therein. UIDAI was established in the year 2009 by an administrative order i.e. by resolution of the Govt. of India, Planning Commission, vide notification dated January 28, 2009. The object of the establishment of the said Authority was primarily to lay down policies to implement the Unique Identification Scheme (for short the ‘UIS’) of the Government, by which residents of India were to be provided unique identity number. The aim was to serve this as proof of identity, which is unique in nature, as each individual will have only one identity with no chance of duplication. Another objective was that this number could be used for identification of beneficiaries for transfer of benefits, subsidies, services and other purposes. This was the primary reason, viz. to ensure correct identification of targeted beneficiaries for delivery of various subsidies, benefits, services, grants, wages and other social benefits schemes which are funded from the Consolidated Fund of India. It was felt that the identification of real and genuine beneficiaries had become a challenge for the Government. In the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 25 of 567 absence of a credible system to authenticate identity of beneficiaries, it was becoming difficult to ensure that the subsidies, benefits and services reach to intended beneficiaries. As per the Government, failure to establish identity was proving to be major hindrance for the successful implementation of the welfare programmes and it was hitting hard the marginalised section of the society and, in particular, women, children, senior citizens, persons with disabilities, migrant unskilled and organised workers, and nomadic tribes. After the establishment of the Authority, vide the aforesaid notification, it started enrolling the residents of this country under the UIS. These residents also started using Aadhaar number allotted to them. It was found that over a period of time, the use of Aadhaar number had increased manifold. This necessitated ensuring security of the information contained in Aadhaar number as well as the information that generated as a result of the use of Aadhaar numbers. It was, thus, felt desirable to back the system with a Parliamentary enactment.
25) With this intention, the Aadhaar Bill was introduced with the following Introduction:
“The Unique Identification Authority of India was established by a resolution of the Government of India in 2009. It was meant primarily to lay down policies and to Writ Petition (Civil) No. 494 of 2012 & connected matters Page 26 of 567 implement the Unique Identification Scheme, by which residents of India were to be provided unique identity number. This number wold serve as proof of identity and could be used for identification of beneficiaries for transfer of benefits, subsidies, services and other purposes.
Later on, it was felt that the process of enrollment, authentication, security, confidentiality and use of Aadhaar related information be made statutory so as to facilitate the use of Aadhaar number for delivery of various benefits, subsidies and services, the expenditures of which were incurred from or receipts therefrom formed part of the Consolidated Fund of India.
The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Bill, 2016 inter alia, provides for establishment of Unique Identification Authority of India, issuance of Aadhaar number to individuals, maintenance and updating of information in the Central Identities Data Repository, issues pertaining to security, privacy and confidentiality of information as well as offences and penalties for contravention of relevant statutory provisions.”
26) After mentioning the reasons recorded above, Statement of Objects and Reasons for introducing the Bill also highlight the salient features thereof in the following manner:
“5. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Bill, 2016, inter alia, seeks to provide for—
(a) issue of Aadhaar numbers to individuals on providing his demographic and biometric information to the Unique Identification Authority of India;
(b) requiring Aadhaar numbers for identifying an individual for delivery of benefits, subsidies, and services the expenditure is incurred from or the receipt therefrom forms part of the Consolidated Fund of India;Writ Petition (Civil) No. 494 of 2012 & connected matters Page 27 of 567
(c) authentication of the Aadhaar number of an Aadhaar number holder in relation to his demographic and biometric information;
(d) establishment of the Unique Identification Authority of India consisting of a Chairperson, two Members and a Member-Secretary to perform functions in pursuance of the objectives above;
(e) maintenance and updating the information of individuals in the Central Identities Data Repository in such manner as may be specified by regulations;
(f) measures pertaining to security, privacy and confidentiality of information in possession or control of the Authority including information stored in the Central Identities Data Repository; and
(g) offences and penalties for contravention of relevant statutory provisions.”
27) The Bill having been passed by the Legislature, received the assent of the President on March 25, 2016 and, thus, became Act (18 of 2016). Preamble to this Act again emphasises the aim and objective which this Act seeks to achieve. It reads:
“An Act to provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto”
28) Section 2 of the Act provides certain definitions. Some of the definitions can be noted at this stage itself, while other relevant definitions would be mentioned at the appropriate stage.Writ Petition (Civil) No. 494 of 2012 & connected matters Page 28 of 567
“(a) “Aadhaar number” means an identification number issued to an individual under sub-section (3) of Section 3;
(b) “Aadhaar number holder” means an individual who has been issued an Aadhaar number under this Act;
(c) “authentication” means the process by which the Aadhaar number along with demographic information or biometric information of an individual is submitted to the Central Identities Data Repository for its verification and such Repository verifies the correctness, or the lack thereof, on the basis of information available with it;
(d) “authentication record” means the record of the time of authentication and identity of the requesting entity and the response provided by the Authority thereto;
xx xx xx
(f) “benefit” means any advantage, gift, reward, relief, or payment, in cash or kind, provided to an individual or a group of individuals and includes such other benefits as may be notified by the Central Government;
(g) “biometric information” means photograph, finger print, Iris scan, or such other biological attributes of an individual as may be specified by regulations;
(h) “Central Identities Data Repository” means a centralised database in one or more locations containing all Aadhaar numbers issued to Aadhaar number holders along with the corresponding demographic information and biometric information of such individuals and other information related thereto;
xx xx xx
(j) “core biometric information” means finger print, Iris scan, or such other biological attribute of an individual as may be specified by regulations;
(k) “demographic information” includes information relating to the name, date of birth, address and other relevant information of an individual, as may be specified by regulations for the purpose of issuing an Aadhaar number, but shall not include race, religion, caste, tribe, ethnicity, Writ Petition (Civil) No. 494 of 2012 & connected matters Page 29 of 567 language, records of entitlement, income or medical history;
(l) “enrolling agency” means an agency appointed by the Authority or a Registrar, as the case may be, for collecting demographic and biometric information of individuals under this Act;
(m) “enrollment” means the process, as may be specified by regulations, to collect demographic and biometric information from individuals by the enrolling agencies for the purpose of issuing Aadhaar numbers to such individuals under this Act;
(n) “identity information” in respect of an individual, includes his Aadhaar number, his biometric information and his demographic information;
xx xx xx
(r) “records of entitlement” means records of benefits, subsidies or services provided to, or availed by, any individual under any programme;
xx xx xx (u) “requesting entity” means an agency or person that submits the Aadhaar number, and demographic information or biometric information, of an individual to the Central Identities Data Repository for authentication;
(v) “resident” means an individual who has resided in India for a period or periods amounting in all to one hundred and eighty-two days or more in the twelve months immediately preceding the date of application for enrolment; (w) “service” means any provision, facility, utility or any other assistance provided in any form to an individual or a group of individuals and includes such other services as may be notified by the Central Government;
(x) “subsidy” means any form of aid, support, grant, subvention, or appropriation, in cash or kind, to an individual or a group of individuals and includes such other subsidies as may be notified by the Central Government.” Writ Petition (Civil) No. 494 of 2012 & connected matters Page 30 of 567
29) Chapter II of the Act deals with enrolment. Section 3 in this Chapter entitles every resident to obtain the Aadhaar number by submitting his demographic information and biometric information. As noted above, demographic information includes information relating to the name, date of birth, address and ‘other relevant information of an individual, as may be specified by regulations for the purpose of issuing an Aadhaar number’. Photograph, fingerprint, iris scan, ‘or such other biological attribute of an individual as may be specified by regulations’ are treated as biometric information. Sub-section (2) of Section 3 stipulates that the enrolling agency shall, at the time of enrolment, inform the individual undergoing enrolment of the following details in such manner as may be specified by regulations, namely:
(a) the manner in which the information shall be used;
(b) the nature of recipients with whom the information is intended to be shared during authentication; and
(c) the existence of a right to access information, the procedure for making requests for such access, and details of the person or department in-charge to whom such requests can be made.
30) Section 4, inter alia, provides that Aadhaar number issued to an individual shall not be reassigned to any individual. In this sense, Writ Petition (Civil) No. 494 of 2012 & connected matters Page 31 of 567 it makes an Aadhaar number given to a particular individual ‘unique’. Section 5 delineates special measures for issuance of Aadhaar number to certain categories of persons and reads as under:
“5. Special measures for issuance of Aadhaar number to certain category of persons.— The Authority shall take special measures to issue Aadhaar number to women, children, senior citizens, persons with disability, unskilled and unorganised workers, nomadic tribes or to such other persons who do not have any permanent dwelling house and such other categories of individuals as may be specified by regulations.”
31) Section 6 enables the Authority to update demographic and biometric information of the Aadhaar number holders from time to time.
32) Chapter III deals with ‘authentication’, which has generated the maximum debate in these proceedings. Section 7 falling under this Chapter mandates that proof of Aadhaar number would be necessary for receipt of certain subsidies, benefits and services etc. meaning thereby for availing such subsidies, benefits and services, it would be necessary for the intended beneficiary to possess Aadhaar number. In case of an individual to whom no Aadhaar number has been assigned, he/she would be required to show that application for enrolment has been given. Where the Aadhaar number is not assigned, proviso to Section 7 lays down Writ Petition (Civil) No. 494 of 2012 & connected matters Page 32 of 567 that the individual shall be offered alternate and viable means of identification for delivery of subsidy, benefit or service. Section 8 deals with authentication of Aadhaar number and provides that on submission of request by any requesting entity, the Authority shall perform authentication of Aadhaar number. This authentication is in relation to biometric information or demographic information of an Aadhaar number holder. Before collecting identity information for the purpose of authentication, the requesting entity is to obtain consent of an individual and also to ensure that the identity information of that individual is only used for submission to the Central Identities Data Repository (CIDR) for authentication. Sections 7 and 8 read as under:
“7. Proof of Aadhaar number necessary for receipt of certain subsidies, benefits and services, etc.— The Central Government or, as the case may be, the State Government may, for the purpose of establishing identity of an individual as a condition for receipt of a subsidy, benefit or service for which the expenditure is incurred from, or the receipt therefrom forms part of, the Consolidated Fund of India, require that such individual undergo authentication, or furnish proof of possession of Aadhaar number or in the case of an individual to whom no Aadhaar number has been assigned, such individual makes an application for enrolment:
Provided that if an Aadhaar number is not assigned to an individual, the individual shall be offered alternate and viable means of identification for delivery of the subsidy, benefit or service.
8. Authentication of Aadhaar number.— (1) The Authority shall perform authentication of the Aadhaar number of an Aadhaar number holder submitted by any Writ Petition (Civil) No. 494 of 2012 & connected matters Page 33 of 567 requesting entity, in relation to his biometric information or demographic information, subject to such conditions and on payment of such fees and in such manner as may be specified by regulations.
(2) A requesting entity shall—
(a) unless otherwise provided in this Act, obtain the consent of an individual before collecting his identity information for the purposes of authentication in such manner as may be specified by regulations; and
(b) ensure that the identity information of an individual is only used for submission to the Central Identities Data Repository for authentication.
(3) A requesting entity shall inform, in such manner as may be specified by regulations, the individual submitting his identity information for authentication, the following details with respect to authentication, namely—
(a) the nature of information that may be shared upon authentication;
(b) the uses to which the information received during authentication may be put by the requesting entity; and
(c) alternatives to submission of identity information to the requesting entity.
(4) The Authority shall respond to an authentication query with a positive, negative or any other appropriate response sharing such identity information excluding any core biometric information.”
33) Under Section 10, the Authority is given power to engage one or more entities to establish and maintain the CIDR and to perform any other functions as may be specified by regulations.
34) Chapter IV deals with the Establishment of the Authority. As per Section 11, the Central Government, by notification, shall Writ Petition (Civil) No. 494 of 2012 & connected matters Page 34 of 567 establish an Authority to be known as the Unique Identification Authority of India. Notification dated July 12, 2016 was issued by the Central Government establishing the Authority. Other provisions in this Chapter deal with the composition of the Authority, qualifications for appointment of the Chairperson and Members of Authority; term of their office and their removal; and restrictions on their employment after cessation of office. It also provides for the functions of Chairperson as well as office of the Chief Executive Officer (CEO) and his functions and the meetings of the Authority etc. Powers and functions of the Authority are stipulated in Section 23.
35) Chapter V talks of grants to the Authority by the Central Government as well as accounts and audit and annual report of the Authority.
36) Chapter VI deals with the important aspects pertaining to ‘protection of information’. Section 28 of the Aadhaar Act puts an obligation on the Authority to ensure the security of identity information and authentication records of individuals. Likewise, Section 29 imposes certain restrictions on sharing information i.e. core biometric information collected or created under the Act or the identity information. The biometric information collected and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 35 of 567 stored in electronic form, in accordance with this Act and regulations made thereunder, is treated as ‘electronic record’ and ‘sensitive personal data or information’ by virtue of Section 30 of the Act. As these are very material and significant provisions of the Act, the same are reproduced verbatim in their entirety:
“28. Security and confidentiality of information.— (1) The Authority shall ensure the security of identity information and authentication records of individuals.
(2) Subject to the provisions of this Act, the Authority shall ensure confidentiality of identity information and authentication records of individuals.
(3) The Authority shall take all necessary measures to ensure that the information in the possession or control of the Authority, including information stored in the Central Identities Data Repository, is secured and protected against access, use or disclosure not permitted under this Act or regulations made thereunder, and against accidental or intentional destruction, loss or damage.
(4) Without prejudice to sub-sections (1) and (2), the Authority shall—
(a) adopt and implement appropriate technical and organisational security measures;
(b) ensure that the agencies, consultants, advisors or other persons appointed or engaged for performing any function of the Authority under this Act, have in place appropriate technical and organisational security measures for the information; and
(c) ensure that the agreements or arrangements entered into with such agencies, consultants, advisors or other persons, impose obligations equivalent to those imposed on the Authority under this Act, and require such agencies, consultants, advisors and other persons to act only on instructions from the Authority.Writ Petition (Civil) No. 494 of 2012 & connected matters Page 36 of 567
29. Restriction on sharing information.— (1) No core biometric information, collected or created under this Act, shall be—
(a) shared with anyone for any reason whatsoever; or
(b) used for any purpose other than generation of Aadhaar numbers and authentication under this Act. (2) The identity information, other than core biometric information, collected or created under this Act may be shared only in accordance with the provisions of this Act and in such manner as may be specified by regulations. (3) No identity information available with a requesting entity shall be—
(a) used for any purpose, other than that specified to the individual at the time of submitting any identity information for authentication; or
(b) disclosed further, except with the prior consent of the individual to whom such information relates. (4) No Aadhaar number or core biometric information collected or created under this Act in respect of an Aadhaar number holder shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations.
30. Biometric information deemed to be sensitive personal information.— The biometric information collected and stored in electronic form, in accordance with this Act and regulations made thereunder, shall be deemed to be “electronic record” and “sensitive personal data or information”, and the provisions contained in the Information Technology Act, 2000 (21 of 2000) and the rules made thereunder shall apply to such information, in addition to, and to the extent not in derogation of the provisions of this Act.
Explanation.—For the purposes of this section, the expressions—
(a) “electronic form” shall have the same meaning as assigned to it in clause (r) of sub-section (1) of Section 2 of the Information Technology Act, 2000 (21 of 2000); Writ Petition (Civil) No. 494 of 2012 & connected matters Page 37 of 567
(b) “electronic record” shall have the same meaning as assigned to it in clause (t) of sub-section (1) of Section 2 of the Information Technology Act, 2000 (21 of 2000);
(c) “sensitive personal data or information” shall have the same meaning as assigned to it in clause (iii) of the Explanation to Section 43-A of the Information Technology Act, 2000 (21 of 2000).”
37) Section 32 provides that the Authority shall maintain authentication records in such manner and for such period as may be specified by regulations and enables every Aadhaar number holder to obtain his authentication record in such manner as may be specified by regulations. This provision also puts an embargo upon the Authority to collect, keep or maintain any information about ‘purpose of authentication’. Section 33, however, creates an exception to the provisions of Section 28(ii) and (v) as well as Section 29(ii) by stipulating that the information can be disclosed pursuant to an order of a court not inferior to that of a District Judge. It also carves out another exception in those cases where it becomes necessary to disclose the information in the interest of national security in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government of India specially authorised in this behalf by an order of the Central Government.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 38 of 567
38) Sections 34 to 47 in Chapter VII of the Act enumerate various kinds of offences and provide penalties for such offences. For our purposes, relevant Section is Section 37 which makes act of disclosing identity information as offence which is punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees. In the case of a company, this fine can extend to one lakh rupees. Likewise, Section 38 provides for penalty for unauthorised access to the CIDR. Penalties for tampering with data in CIDR (Section 39) and unauthorised use by requesting entity (Section 40) are also stipulated.
Cognizance of offences under this Chapter can be taken by a court only on a complaint made by the Authority or any officer or person authorised by it.
39) Section 50 of the Act empowers the Central Government to issue directions to the Authority in writing from time to time and the Authority shall be bound to carry out such directions on questions of policy. Section 53 empowers the Central Government to make rules to carry out the provisions of the Act generally as well as the specific matters enumerated in sub-section (2) thereof. Section 54 empowers the Authority to make regulations consistent with the Act and Rules made thereunder, for carrying out the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 39 of 567 provisions of the Act and, in particular, the matters mentioned in sub-section (2). Such Rules and Regulations are to be laid before the Parliament, as provided in Section 55.
40) Section 57 provides that the Aadhaar Act would not prevent the use of Aadhaar number for establishing the identity of an individual for any purpose and reads as under:
“57. Act not to prevent use of Aadhaar number for other purposes under law.— Nothing contained in this Act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect:
Provided that the use of Aadhaar number under this section shall be subject to the procedure and obligations under Section 8 and Chapter VI.”
41) If any difficulty arises in giving effect to the provisions of the Act, the Central Government is empowered to make provisions to remove those difficulties, provided that such provisions are not inconsistent with the provisions of the Act. Section 59, which is the last provision in the Act, is an attempt to save all the acts and actions of the Central Government under Notification dated January 28, 2009 vide which the Authority was established or the Department of Electronics and Information Technology under the Cabinet Secretariat Notification dated September 12, 2015. This Writ Petition (Civil) No. 494 of 2012 & connected matters Page 40 of 567 provision is couched in the following language:
“59. Savings.— Anything done or any action taken by the Central Government under the Resolution of the Government of India, Planning Commission bearing Notification Number A-43011/02/2009-Admin. I, dated the 28th January, 2009, or by the Department of Electronics and Information Technology under the Cabinet Secretariat Notification bearing Notification Number S.O. 2492(E), dated the 12th September, 2015, as the case may be, shall be deemed to have been validly done or taken under this Act.”
42) Regulations have been framed under the Act, namely, (1) The Aadhaar (Enrolment and Update) Regulations, 2016; (2) The Aadhaar (Authentication) Regulations, 2016; (3) The Aadhaar (Data Security) Regulations, 2016; and (4) The Aadhaar (Sharing of Information) Regulations, 2016. The relevant provisions in these Regulations are reproduced below:
“The Aadhaar (Enrolment and Update) Regulations, 2016
4. Demographic information required for enrolment. — (1) The following demographic information shall be collected from all individuals undergoing enrolment (other than children below five years of age):
(i) Name;
(ii) Date of Birth;
(iii) Gender;
(iv) Residential Address.
(2) The following demographic information may also additionally be collected during enrolment, at the option of the individual undergoing enrolment:
(i) Mobile number
(ii) Email address (3) In case of Introducer-based enrolment, the following additional information shall be collected:
(i) Introducer name;Writ Petition (Civil) No. 494 of 2012 & connected matters Page 41 of 567
(ii)Introducer’s Aadhaar number.
(4) In case of Head of Family based enrolment, the following additional information shall be collected:
(i) Name of Head of Family;
(ii) Relationship;
(iii) Head of Family’s Aadhaar number;
(iv) One modality of biometric information of the Head of Family.
(5) The standards of the above demographic information shall be as may be specified by the Authority for this purpose.
(6) The demographic information shall not include race, religion, caste, tribe, ethnicity, language, record of entitlement, income or medical history of the resident.
The Aadhaar (Authentication) Regulations, 2016
3. Types of Authentication.— There shall be two types of authentication facilities provided by the Authority, namely—
(i) Yes/No authentication facility, which may be carried out using any of the modes specified in regulation 4(2); and
(ii) e-KYC authentication facility, which may be carried out only using OTP and/ or biometric authentication modes as specified in regulation 4(2).
4. Modes of Authentication. — (1) An authentication request shall be entertained by the Authority only upon a request sent by a requesting entity electronically in accordance with these regulations and conforming to the specifications laid down by the Authority.
(2) Authentication may be carried out through the following modes:
(a) Demographic authentication: The Aadhaar number and demographic information of the Aadhaar number holder obtained from the Aadhaar number holder is matched with the demographic information of the Aadhaar number holder in the CIDR.
(b) One-time pin based authentication: A One Time Pin (OTP), with limited time validity, is sent to the mobile Writ Petition (Civil) No. 494 of 2012 & connected matters Page 42 of 567 number and/ or e-mail address of the Aadhaar number holder registered with the Authority, or generated by other appropriate means. The Aadhaar number holder shall provide this OTP along with his Aadhaar number during authentication and the same shall be matched with the OTP generated by the Authority.
(c) Biometric-based authentication: The Aadhaar number and biometric information submitted by an Aadhaar number holder are matched with the biometric information of the said Aadhaar number holder stored in the CIDR. This may be fingerprints-based or iris-based authentication or other biometric modalities based on biometric information stored in the CIDR.
(d) Multi-factor authentication: A combination of two or more of the above modes may be used for authentication. (3) A requesting entity may choose suitable mode(s) of authentication from the modes specified in sub-regulation (2) for a particular service or business function as per its requirement, including multiple factor authentication for enhancing security. For the avoidance of doubt, it is clarified that e-KYC authentication shall only be carried out using OTP and/ or biometric authentication.
xx xx xx
7. Capturing of biometric information by requesting entity.— (1) A requesting entity shall capture the biometric information of the Aadhaar number holder using certified biometric devices as per the processes and specifications laid down by the Authority.
(2) A requesting entity shall necessarily encrypt and secure the biometric data at the time of capture as per the specifications laid down by the Authority. (3) For optimum results in capturing of biometric information, a requesting entity shall adopt the processes as may be specified by the Authority from time to time for this purpose.
xx xx xx
9. Process of sending authentication requests.— (1) After collecting the Aadhaar number or any other identifier Writ Petition (Civil) No. 494 of 2012 & connected matters Page 43 of 567 provided by the requesting entity which is mapped to Aadhaar number and necessary demographic and / or biometric information and/ or OTP from the Aadhaar number holder, the client application shall immediately package and encrypt these input parameters into PID block before any transmission, as per the specifications laid down by the Authority, and shall send it to server of the requesting entity using secure protocols as may be laid down by the Authority for this purpose.
(2) After validation, the server of a requesting entity shall pass the authentication request to the CIDR, through the server of the Authentication Service Agency as per the specifications laid down by the Authority. The authentication request shall be digitally signed by the requesting entity and/or by the Authentication Service Agency, as per the mutual agreement between them. (3) Based on the mode of authentication request, the CIDR shall validate the input parameters against the data stored therein and return a digitally signed Yes or No authentication response, or a digitally signed e-KYC authentication response with encrypted e-KYC data, as the case may be, along with other technical details related to the authentication transaction.
(4) In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the input parameters specified in sub-regulation (1) above such that authentication is always reduced to a 1:1 match. (5) A requesting entity shall ensure that encryption of PID Block takes place at the time of capture on the authentication device as per the processes and specifications laid down by the Authority.
xx xx xx
18. Maintenance of logs by requesting entity. — (1) A requesting entity shall maintain logs of the authentication transactions processed by it, containing the following transaction details, namely:—
(a) the Aadhaar number against which authentication is sought;
(b) specified parameters of authentication request submitted;
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 44 of 567
(c) specified parameters received as authentication response;
(d) the record of disclosure of information to the Aadhaar number holder at the time of authentication; and
(e) record of consent of the Aadhaar number holder for authentication, but shall not, in any event, retain the PID information.
(2) The logs of authentication transactions shall be maintained by the requesting entity for a period of 2 (two) years, during which period an Aadhaar number holder shall have the right to access such logs, in accordance with the procedure as may be specified.
(3) Upon expiry of the period specified in sub-regulation (2), the logs shall be archived for a period of five years or the number of years as required by the laws or regulations governing the entity, whichever is later, and upon expiry of the said period, the logs shall be deleted except those records required to be retained by a court or required to be retained for any pending disputes.
(4) The requesting entity shall not share the authentication logs with any person other than the concerned Aadhaar number holder upon his request or for grievance redressal and resolution of disputes or with the Authority for audit purposes. The authentication logs shall not be used for any purpose other than stated in this sub-regulation. (5) The requesting entity shall comply with all relevant laws, rules and regulations, including, but not limited to, the Information Technology Act, 2000 and the Evidence Act, 1872, for the storage of logs.
(6) The obligations relating to authentication logs as specified in this regulation shall continue to remain in force despite termination of appointment in accordance with these regulations.
xx xx xx
26. Storage and Maintenance of Authentication Transaction Data. — (1) The Authority shall store and maintain authentication transaction data, which shall contain the following information:—
(a) authentication request data received including PID block;
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 45 of 567
(b) authentication response data sent;
(c) meta data related to the transaction;
(d) any authentication server side configurations as necessary Provided that the Authority shall not, in any case, store the purpose of authentication.
The Aadhaar (Data Security) Regulations, 2016
3. Measures for ensuring information security. — (1) The Authority may specify an information security policy setting out inter alia the technical and organisational measures to be adopted by the Authority and its personnel, and also security measures to be adopted by agencies, advisors, consultants and other service providers engaged by the Authority, registrar, enrolling agency, requesting entities, and Authentication Service Agencies.
(2) Such information security policy may provide for:—
(a) identifying and maintaining an inventory of assets associated with the information and information processing facilities;
(b) implementing controls to prevent and detect any loss, damage, theft or compromise of the assets;
(c) allowing only controlled access to confidential information;
(d) implementing controls to detect and protect against virus/malwares;
(e) a change management process to ensure information security is maintained during changes;
(f) a patch management process to protect information systems from vulnerabilities and security risks;
(g) a robust monitoring process to identify unusual events and patterns that could impact security and performance of information systems and a proper reporting and mitigation process;
(h) encryption of data packets containing biometrics, and enabling decryption only in secured locations;
(i) partitioning of CIDR network into zones based on risk and trust;
(j) deploying necessary technical controls for protecting CIDR network;
(k) service continuity in case of a disaster;
(l) monitoring of equipment, systems and networks;
(m) measures for fraud prevention and effective remedies in case of fraud;
(n) requirement of entering into non-disclosure agreements with the personnel;Writ Petition (Civil) No. 494 of 2012 & connected matters Page 46 of 567
(o) provisions for audit of internal systems and networks;
(p) restrictions on personnel relating to processes, systems and networks.
(q) inclusion of security and confidentiality obligations in the agreements or arrangements with the agencies, consultants, advisors or other persons engaged by the Authority.
(3) The Authority shall monitor compliance with the information security policy and other security requirements through internal audits or through independent agencies.
(4) The Authority shall designate an officer as Chief Information Security Officer for disseminating and monitoring the information security policy and other security-related programmes and initiatives of the Authority.
xx xx xx
5. Security obligations of service providers, etc. — The agencies, consultants, advisors and other service providers engaged by the Authority for discharging any function relating to its processes shall:
(a) ensure compliance with the information security policy specified by the Authority;
(b) periodically report compliance with the information security policy and contractual requirements, as required by the Authority;
(c) report promptly to the Authority any security incidents affecting the confidentiality, integrity and availability of information related to the Authority’s functions;
(d) ensure that records related to the Authority shall be protected from loss, destruction, falsification, unauthorised access and unauthorised release;
(e) ensure confidentiality obligations are maintained during the term and on termination of the agreement;
(f) ensure that appropriate security and confidentiality obligations are provided for in their agreements with their employees and staff members;
(g) ensure that the employees having physical access to CIDR data centers and logical access to CIDR data centers undergo necessary background checks;
(h) define the security perimeters holding sensitive information, and ensure only authorised individuals are allowed access to such areas to prevent any data leakage or misuse; and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 47 of 567
(i) where they are involved in the handling of the biometric data, ensure that they use only those biometric devices which are certified by a certification body as identified by the Authority and ensure that appropriate systems are built to ensure security of the biometric data.
The Aadhaar (Sharing of Information) Regulations, 2016.
3. Sharing of information by the Authority. — (1) Core biometric information collected by the Authority under the Act shall not be shared with anyone for any reason whatsoever.
(2) The demographic information and photograph of an individual collected by the Authority under the Act may be shared by the Authority with a requesting entity in response to an authentication request for e-KYC data pertaining to such individual, upon the requesting entity obtaining consent from the Aadhaar number holder for the authentication process, in accordance with the provisions of the Act and the Aadhaar (Authentication) Regulations, 2016.
(3) The Authority shall share authentication records of the Aadhaar number holder with him in accordance with regulation 28 of the Aadhaar (Authentication) Regulations, 2016.
(4) The Authority may share demographic information and photograph, and the authentication records of an Aadhaar number holder when required to do so in accordance with Section 33 of the Act.
xx xx xx
6. Restrictions on sharing, circulating or publishing of Aadhaar number. — (1) The Aadhaar number of an individual shall not be published, displayed or posted publicly by any person or entity or agency.
(2) Any individual, entity or agency, which is in possession of Aadhaar number(s) of Aadhaar number holders, shall ensure security and confidentiality of the Aadhaar numbers and of any record or database containing the Aadhaar numbers.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 48 of 567 (3) Without prejudice to sub-regulations (1) and (2), no entity, including a requesting entity, which is in possession of the Aadhaar number of an Aadhaar number holder, shall make public any database or record containing the Aadhaar numbers of individuals, unless the Aadhaar numbers have been redacted or blacked out through appropriate means, both in print and electronic form. (4) No entity, including a requesting entity, shall require an individual to transmit his Aadhaar number over the Internet unless such transmission is secure and the Aadhaar number is transmitted in encrypted form except where transmission is required for correction of errors or redressal of grievances.
(5) No entity, including a requesting entity, shall retain Aadhaar numbers or any document or database containing Aadhaar numbers for longer than is necessary for the purpose specified to the Aadhaar number holder at the time of obtaining consent.”
43) To sum up broadly, the Authority is established under the Act as a statutory body which is given the task of developing the policy, procedure and system for issuing Aadhaar numbers to individuals and also to perform authentication thereof as per the provisions of the Act. For the purpose of enrolment and assigning Aadhaar numbers, enrolling agencies are recruited by the Authority. All the residents in India are eligible to obtain an Aadhaar number. To enable a resident to get Aadhaar number, he is required to submit demographic as well as biometric information i.e., apart from giving information relating to name, date of birth and address, biometric information in the form of photograph, fingerprint, iris scan is also to be provided. Aadhaar number given to a particular Writ Petition (Civil) No. 494 of 2012 & connected matters Page 49 of 567 person is treated as unique number as it cannot be reassigned to any other individual.
Insofar as subsidies, benefits or services to be given by the Central Government or the State Government, as the case may be, is concerned, these Governments can mandate that receipt of these subsidies, benefits and services would be given only on furnishing proof of possession of Aadhaar number (or proof of making an application for enrolment, where Aadhaar number is not assigned). An added requirement is that such individual would undergo authentication at the time of receiving such benefits etc. A particular institution/body from which the aforesaid subsidy, benefit or service is to be claimed by such an individual, the intended recipient would submit his Aadhaar number and is also required to give her biometric information to that agency. On receiving this information and for the purpose of its authentication, the said agency, known as Requesting Entity, would send the request to the Authority which shall perform the job of authentication of Aadhaar number. On confirming the identity of a person, the individual is entitled to receive subsidy, benefit or service. Aadhaar number is permitted to be used by the holder for other purposes as well.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 50 of 567
44) In this whole process, any resident seeking to obtain an Aadhaar number is, in the first instance, required to submit her demographic information and biometric information at the time of enrolment. She, thus, parts with her photograph, fingerprint and iris scan at that stage by giving the same to the enrolling agency, which may be a private body/person. Likewise, every time when such Aadhaar holder intends to receive a subsidy, benefit or service and goes to specified/designated agency or person for that purpose, she would be giving her biometric information to that requesting entity, which, in turn, shall get the same authenticated from the Authority before providing a subsidy, benefit or service. Whenever request is received for authentication by the Authority, record of such a request is kept and stored in the CIDR. At the same time, provisions for protection of such information/data have been made, as indicated above. Aadhaar number can also be used for purposes other than stated in the Act i.e. purposes other than provided under Section 7 of the Act, as mentioned in Section 57 of the Act, which permit the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect, to use the Aadhaar number for establishing the identity of an individual. It can be used as a proof of identity, like other identity Writ Petition (Civil) No. 494 of 2012 & connected matters Page 51 of 567 proofs such as PAN card, ration card, driving licence, passport etc.
45) Piercing into the aforesaid Aadhaar programme and its formation/structure under the Aadhaar Act, foundational arguments are that it is a grave risk to the rights and liberties of the citizens of this country which are secured by the Constitution of India. It militates against the constitutional abiding values and its foundational morality and has the potential to enable an intrusive state to become a surveillance state on the basis of information that is collected in respect of each individual by creation of a joint electronic mesh. In this manner, the Act strikes at the very privacy of each individual thereby offending the right to privacy which is elevated and given the status of fundamental right by tracing it to Articles 14, 19 and 21 of the Constitution of India by a nine Judge Bench judgment of this Court in K.S. Puttaswamy & Anr. v. Union of India & Ors.6. Most of the counsel appearing for different petitioners (though not all) conceded that there cannot be a serious dispute insofar as allotment of Aadhaar number, for the purpose of unique identification of the residents, is concerned. However, apprehensions have been expressed about the manner in which the Scheme has been rolled out and 6 (2017) 10 SCC 1 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 52 of 567 implemented. The entire edifice of the aforesaid projection is based on the premise that it forces a person, who intends to enrol for Aadhaar, to part with his core information namely biometric information in the form of fingerprints and iris scan. These are to be given to the enrolment agency in the first instance which is a private body and, thus, there is risk of misuse of this vital information pertaining to an individual. Further, it is argued that the most delicate and fragile part, susceptible to misuse, is the authentication process which is to be carried out each time the holder of Aadhaar number wants to establish her identity. At that stage, not only the individual parts with the biometric information again with the RE (which may again be a private agency as well), the purpose for which such a person approaches the RE would also be known i.e. the nature of transaction which is supposed to be undertaken by the said person at that time. Such information relating to different transactions of a person across the life of the citizen is connected to a central database. This record may enable the State to profile citizens, track their movements, assess their habits and silently influence their behaviour. Over a period of time, the profiling would enable the State to stifle dissent and influence political decision making. It may also enable the State to act as a surveillant state and there is a propensity for it to Writ Petition (Civil) No. 494 of 2012 & connected matters Page 53 of 567 become a totalitarian state. It is stressed that at its core, Aadhaar alters the relationship between the citizen and the State. It diminishes the status of the citizen. Rights freely exercised, liberties freely enjoyed, entitlements granted by the Constitution and laws are all made conditional, on a compulsory barter. The barter compels the citizen to give up her biometrics ‘voluntarily’, allow her biometrics and demographic information to be stored by the State and private operators and then used for a process termed ‘authentication’.
To put it in nutshell, provisions of the Aadhaar Act are perceived by the petitioners as giving away of vital information about the residents to the State not only in the form of biometrics but also about the movement as well as varied kinds of transactions which a resident would enter into from time to time. The threat is in the form of profiling the citizens by the State on the one hand and also misuse thereof by private agencies whether it is enrolling agency or requesting agency or even private bodies mentioned in Section 57 of the Act. In essence, it is stated that not only data of aforesaid nature is stored by the CIDR, which has the threat of being leaked, it can also be misused by non-State actors. In other words, it is sought to be highlighted that there is no assurance of any data protection at Writ Petition (Civil) No. 494 of 2012 & connected matters Page 54 of 567 any level.
46) The respondents, on the other hand, have attempted to shake the very foundation of the aforesaid structure of the petitioners’ case. They argue that in the first instance, minimal biometric information of the applicant, who intends to have Aadhaar number, is obtained which is also stored in CIDR for the purpose of authentication. Secondly, no other information is stored. It is emphasised that there is no data collection in respect of religion, caste, tribe, language records of entitlement, income or medical history of the applicant at the time of Aadhaar enrolment. Thirdly, the Authority also claimed that the entire Aadhaar enrolment eco- system is foolproof inasmuch as within few seconds of the biometrics having been collected by the enrolling agency, the said information gets transmitted the Authorities/CIDR, that too in an encrypted form, and goes out of the reach of the enrolling agency. Same is the situation at the time of authentication as biometric information does not remain with the requesting agency. Fourthly, while undertaking the authentication process, the Authority simply matches the biometrics and no other information is received or stored in respect of purpose, location or nature or transaction etc. Therefore, the question of profiling does Writ Petition (Civil) No. 494 of 2012 & connected matters Page 55 of 567 not arise at all. A powerpoint presentation was given by Dr. Ajay Bhushan Pandey, CEO of the Authority, in the Court, while explaining various nuances of the whole process. In this presentation, the enrolment process has been projected in the following manner:
47) Insofar as Aadhaar authentication service is concerned, it was explained that the same is e-KYC wherein following process is involved:
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 56 of 567
48) It was asserted with all vehemence that while doing the aforesaid authentication, no other information is collected or stored by the Authority/CIDR, specifically pointing that:
(a) The Authority does not collect purpose, location or details of transaction. Thus, it is purpose blind.
(b) The information collected as aforesaid remains in silos.
(c) Merging of silos is prohibited. (d) The RE is provided answer only in Yes or No about the authentication of the person concerned. (e) The authentication process is not exposed to the internet world. (f) Security measures as per the provisions of Section 29(3)
read with Section 38(g) as well as Regulation 17(1)(d) of the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 57 of 567 Authentication Regulations are strictly followed and adhere to.
The Aadhaar Authentication Security has been described in the following manner:
49) In this hue, the Authority has projected that the Aadhaar design takes full care of privacy and security of the persons. It is sought to be demonstrated by pointing out the following features:
(i) Privacy is ensured by the very design of Aadhaar which was conceived by the Authority from very inception and is now even incarnated in the Aadhaar Act because : (a) it is backed by minimal data, federated databases, optimal ignorance; and (b) there is no transaction/pooling data coupled with the fact that resident authorised access to identity data is available.
(ii) Aadhaar is designed for inclusion inasmuch as : (a) there is flexibility of demographic data, multi-modal biometrics, and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 58 of 567 flexible processes; (b) DDSVP Committee by Dr. V.N. Vittal, former CVC; and (c) Biometric design and Standards Committee by Dr. Gairola, Former DG, NIC.
(iii) All security numbers are followed which can be seen from:
(a) PKI-2048 encryption from the time of capture, (b) adoption of best-in-class security standards and practices, and (c) strong audit and traceability as well as fraud detection.
50) It was explained that the security and data privacy is ensured in the following way:
(i) The data sent to ABIS is completely anonymised. The ABIS systems do not have access to resident’s demographic information as they are only sent biometric information of a resident with a reference number and asked to de-duplicate. The de-duplication result with the reference number is mapped back to the correct enrolment number by the Authorities own enrolment server.
(ii) The ABIS providers only provide their software and services. The data is stored in UIDAI storage and it never leaves the secure premises.
(iii) The ABIS providers do not store the biometric images (source). They only store template for the purpose of de- Writ Petition (Civil) No. 494 of 2012 & connected matters Page 59 of 567 duplication (with reference number).
(iv) The encrypted enrolment packet sent by the enrolment client software to the CIDR is decrypted by the enrolment server but the decrypted packet is never stored.
(v) The original biometric images of fingerprints, iris and face are archived and stored offline. Hence, they cannot be accessed through an online network.
(vi) The biometric system provides high accuracy of over 99.86%. The mixed biometric have been adopted only t enhance the accuracy and to reduce the errors which may arise on account of some residents either not having biometrics or not having some particular biometric.
51) Above all, there is an oversight by Technology and Architecture Review Board (TARB) and Security Review Committee. This Board and Committee consists of very high profiled officers. The aforesaid security measures are shown by the Authority in the following manner:
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 60 of 567 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 61 of 567
52) We may point out at this stage that to the powerpoint presentation by Dr. Pandey on the aforesaid lines, certain questions were put to him by Mr. Shyam Divan as well as Mr. Vishwanathan, senior advocates, and the answers thereto were given by Dr. Pandey. In order to have the complete picture, we will be well advised to reproduce these questions and their answers as well, which are as follows:
53) Questions and Answers to the queries raised by the petitioners in W.P. (C) No. 1056 of 2017 entitled ‘Nachiket Udupa & Anr. v. Union of India (1) What are the figures for authentication failures, both at the national and state level? Please provide a breakup, between fingerprints and iris.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 62 of 567Ans.: UIDAI cannot provide authentication failure rates at the state level since it does not track the location of the authentication transactions. Authentication failure rate at national level is as below:
Modality Unique UID Failed Unique ID Failed Percentage Participated IRIS 1,08,50,391 9,27,132 8.54% FINGER 61,63,63,346 3,69,62,619 6.00% It must be stated that authentication failures do not mean exclusion or denial from subsidies, benefits or services since the requesting entities are obliged under the law to provide for exception handling mechanisms.
(2) In case a person who is claiming a biometric exception (e.g. a person suffering from leprosy) does not have a mobile phone number, or has not given it in the enrolment form, or if the phone number changes – how will her Aadhaar enrolment and subsequent authentication occur and under which provision of law?
Ans.: Aadhaar enrolment is done for all residents, even of residents with leprosy. Biometric exception process is defined in the UIDAI resident enrolment process. In the case of a leprosy patient, who may not be able to do fingerprint authentication, iris Writ Petition (Civil) No. 494 of 2012 & connected matters Page 63 of 567 authentication can be used for update (and add the mobile number). This was the reason for multi-modal enrolment and authentication being selected for use in Aadhaar.
Only in an unlikely scenario where both iris and fingerprint cannot be used for authentication, the mobile number is one of the methods for authentication. In cases where authentication through mobile number is not possible or feasible, the requesting entities have to provide their own exception and backup mechanism to ensure services to Aadhaar holders. As part of the exception handling mechanism, UIDAI has already implemented a digitally signed QR code into e-Aadhaar which allows agencies to verify the Aadhaar card in an off-line manner and trust the data (based on digital signature validation) without accessing e-KYC API service of UIDAI. This is a simple off-line mechanism to quickly verify the legitimacy of the Aadhaar card. But, it does not ensure that the person holding the card is the owner of that Aadhaar number. It needs either manual check of photo against the face of the individual (like the way ID is verified at the entry of airports) or some form of electronic authentication using Aadhaar authentication API or agency specific authentication scheme. QR code based verification allows Aadhaar number holders to use their ID on a day-to-day purpose without using online e-KYC Writ Petition (Civil) No. 494 of 2012 & connected matters Page 64 of 567 authentication. The verification through offline QR code can be used for those purposes or cases where proof of presence or proof of ownership of card is not required.
The Aadhaar Act and Aadhaar (Enrolment and Update) Regulations, 2016 define special provision for enrolment of residents with biometric exception. Further, as per Regulation 14(i) of the Authentication Regulations, RE shall implement exception-handling mechanisms and backup identity authentication mechanisms to ensure seamless provision of authentication services to Aadhaar number holders. Accordingly, DBT Mission Cabinet Secretariat has issued a detailed circular dated December 19, 2017 regarding exception handling during use of Aadhaar in the benefit schemes of the Government. (3) Are there any surprise checks, field studies done to check the authenticity of the exemption registers? Ans.: As per Regulation 14(i) of the Authentication Regulations, this exception handling mechanism is to be implemented and monitored by the requesting entities and in case of the Government, their respective Ministries. Further, the DBT Mission Cabinet Secretariat had issued Circular dated December 19, 2017 on exception handling and audit of exceptions. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 65 of 567 (4) Between the ages of 5-15 years, can a school, as an ‘introducer’, enrol a child without parental consent? Ans.: School officials, if permitted to act as ‘introducer’, can enrol only when there is a parental consent to enrol. The disclosure requirement as per Section 3(2) of the Aadhaar Act and the Aadhaar (Enrolment and Update) Regulations, 2016 (Schedule-I) is implemented through the enrolment form which is signed by the resident making it informed disclosure. In case of children, the consent form will be signed by the parent/guardian. (5) Once a child attains the age of 18 years, is there any way for them to opt out or revoke consent?
Ans.: It is not permissible under the Aadhaar Act. However, residents have the option of permanently locking their biometrics and only temporarily unlock it when needed for biometric authentication as per Regulation 11 of the Authentication Regulations.
(6) What is the status of the enrolments done by the 49,000 blacklisted enrolment operators? Please provide the number of enrolments done by them?
Ans.: UIDAI has a policy to enforce the process guidelines and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 66 of 567 data quality check during the enrolment process. 100% of the enrolment done by operators undergoes a quality assurance check, wherein every enrolment passes through a human eye. Any Aadhaar enrolment found to be contrary to the UIDAI process, the enrolment itself gets rejected and Aadhaar is not generated. The resident is advised to re-enroll. Once an operator is blacklisted or suspended, further enrolments cannot be carried out by him during the time the order of blacklisting/suspension is valid.
(7) What are the total number of biometric De-duplication rejections that have taken place till date? In case an enrolment is rejected either for: (a) duplicate enrolment and (b) other technical reason under Regulation 14 of the Aadhaar Enrolment Regulations, what happens to the data packet that contains the stored biometric and demographic information? Ans.: The total number of biometric de-duplication rejections that have taken place are 6.91 crores as on March 21, 2018. These figures do not pertain to the number of unique individuals who have been denied Aadhaar enrolment resulting in no Aadhaar issued to them. This figure merely pertains to the number of applications which have been identified by the Aadhaar de- Writ Petition (Civil) No. 494 of 2012 & connected matters Page 67 of 567 duplication system as having matching biometrics to an existing Aadhaar number holder. The biometric de-duplication system is designed to identify as duplicate those cases where any one of the biometrics (ten fingers and two irises) match. However, very often it is found that all the biometrics match. It is highly improbable for the biometrics to match unless the same person has applied again. There are a number of reasons why the same person might apply more than once. For instance, many individuals innocently apply for enrolment multiple times because of the delay in getting their Aadhaar cards due to postal delays, loss or destruction of their cards or confusion about how the system works. Each time one applies for Aadhaar, the system identifies her as a new enrolment but when it recognises that the individual’s biometrics match with already those in the database, thereafter further checks, including manual check through experienced personnels, are done. After that exercise, if it is found that the person is already registered, it rejects the enrolment application. One of their main reasons for rejection is that multiple people would put their biometric details like fingerprints for Aadhaar generation either as a fraudulent exercise or by mistake, which also would get rejected. There were many fakes and frauds in the earlier systems and several reports have Writ Petition (Civil) No. 494 of 2012 & connected matters Page 68 of 567 found that almost 50% of the subsidies were getting pilfered away by fakes and duplicates in the system. Then, there would also be several such people who may have tried to defraud the Aadhaar enrolment system as well but failed get multiple Aadhaar numbers due to the stringent Aadhaar de-duplication process. Thus, the mere fact that 6.23 crore enrolments have been rejected as biometric duplicates does not mean that 6.23 crore people have been denied an Aadhaar number as has been alleged by the petitioners. Any genuine person who does not have an Aadhaar number and whose enrolment has been rejected can always apply again for enrolment. It is worth noting that none of the de- duplication rejects have come forward to lodge complaints either with the Authority or with the Government about denial of Aadhaar number. None of them have even approached any Court of law. Evidently, the genuine residents have got themselves re-enrolled and the rest are those who were trying to reach the Aadhaar system by fraudulent means. That explains why no one has approached a court of law complaining denial of Aadhaar number. All the enrolment packets received by UIDAI (accepted/rejected) are archived in the CIDR irrespective of its status. (8) If the figure of rejection of enrolment packets was 8 crore, Writ Petition (Civil) No. 494 of 2012 & connected matters Page 69 of 567 as on 2015, what is the total rejection figure for enrolment packets as on date? How many field studies/physical verification have been done to ensure that these persons (who have been rejected) are indeed “False or duplicate” enrolments? Ans.: The total rejection figure for enrolment packets is 18.0 cr. as on March 26, 2018. These rejections are due to various technical reasons like: (i) data quality reject such as address incomplete, name incomplete, use of expletives in names, address etc. photo is of object, photo of photo, age photo mismatch etc.; and (ii) OSI validation reject such as operator / supervisor / introducer validation failed, operator / supervisor / introducer / Head of Family biometric validation failed etc. Those whose enrolments have been rejected for any reason and who do not have Aadhaar can re-enrol and obtain Aadhaar. Rejection of enrolments do not mean that the person will never be able to get Aadhaar.
(9) What does “any other appropriate response” under Section 8(4) of the Aadhaar Act include?
Ans.: “Any other appropriate responses” includes e-KYC or limited e-KYC data. As per Regulation 3 of Authentication Regulations, UIDAI provides two types of authentication facilities, Writ Petition (Civil) No. 494 of 2012 & connected matters Page 70 of 567 namely -
(i) Yes/No authentication facility; and (ii) e-KYC authentication facility.
In Yes/No authentication, UIDAI provides the response as Yes or No along with relevant error codes, if any.
In e-KYC authentication, UIDAI provides the demographic data along with photograph and in case of mismatch/error, the relevant error codes.
54) Questions and Answers to the queries raised by the petitioners in W.P. (C) No. 829 of 2013 entitled ‘S.G. Vombatkere & Anr. v. Union of India (1) Please confirm that no UIDAI official verifies the correctness of documents offered at the stage of enrolment/updating. Ans.: As per UIDAI process, the verification of the documents is entrusted to the Registrar. For Verification based on Documents, the verifier present at the Enrolment Centre will verify the documents. Registrars/Enrolment agency must appoint personnel for the verification of documents.
(2) Please confirm that UIDAI does not know whether the documents shown at the time of enrolment/updating are genuine or false.
Ans.: The answer is same as in (1) above.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 71 of 567
(3) Please confirm: (a) UIDAI does not identify the persons it only matches the
biometric information received at the time of authentication with its records and provides a Yes/No response; Ans.: Biometric authentication of an Aadhaar number holder is always performed as 1:1 biometric match against his/her Aadhaar number (identity) in CIDR. Based on the match, UIDAI provides Yes or No response. A “Yes” response means a positive identification of the Aadhaar number holder.
Each enrolment is biometrically de-duplicated against all (1.2 billion) residents to issue the Aadhaar number (or Unique Identity).
(b) UIDAI takes no responsibility with respect to the correctness of the name, date of birth or address of the person enrolled. Ans.: The Name/Address/DOB are derived from the Proof of Identity (POI)/Proof of Address (POA) documents submitted during enrolments.
The enrolment/update packet (encrypted) retains a scanned copy of the POI/POA documents used for the enrolment which can be reviewed in case of dispute.
UIDAI maintains the update history of each Aadhaar Writ Petition (Civil) No. 494 of 2012 & connected matters Page 72 of 567 number related to changes in name, address, date of birth etc. (4) Please confirm:
(a) UIDAI takes no responsibility with respect to the correct identification of a person.
Ans.: Please refer to Answer (1) above. Additionally, it may be stated that enrolment of Aadhaar is done through a resident enrolment process and verification of the POI/POA document is done against the acceptable documents, as per the UIDAI valid list of documents as provided in Schedule II and III Aadhaar (Enrolment and Update) Regulations, 2016 read with Regulation
10. UIDAI takes responsibility in creating and implementing standards, ensuring matching systems installed in CIDR work as they are designed to do, and providing options to Aadhaar holders in terms of controlling their identity (such as updating their data, locking their biometrics, etc.) and accessing their own authentication records. One of the key goals of Aadhaar is to issue a unique identity for the residents of India. Hence, each enrolment is biometrically de-duplicated against all (1.2 billion) residents to issue the Aadhaar number (or Unique Identity).
Section 4 of Aadhaar lays down the properties of an Writ Petition (Civil) No. 494 of 2012 & connected matters Page 73 of 567 Aadhaar number. Sub-section (3) of Section 4 reads as under:
“(3) An Aadhaar number, in physical or electronic form subject to authentication and other conditions, as may be specified by regulations, may be accepted as proof of identity of the Aadhaar number holder for any purpose.” The requesting entities are at liberty to use any or multiple of authentication mode available under Regulation 4 of Aadhaar (Authentication) Regulation, 2016 as per their requirements and needs of security etc.
(b) The biometric authentication is based on a probabilistic match of the biometric captured during authentication and the record stored with CIDR.
Ans.: Biometric authentication is based on 1:1 matching and, therefore, in that sense it is not probabilistic. If biometrics are captured it will lead to successful authentication. If biometrics are not well captured during authentication or an impostor tries authentication, it will lead to authentication failure. Aadhaar Proof of Concept studies show that a vast majority of residents (>98%) can successfully authenticate using biometric modalities such fingerprints and/or iris.
However, the Aadhaar Act and Regulations provides that an Aadhaar number holder cannot be denied service due to the failure of Aadhaar authentication. Hence, all Aadhaar Writ Petition (Civil) No. 494 of 2012 & connected matters Page 74 of 567 applications must implement exception processes. Possible methods to implement the exception process include:
(i) Family Based Authentication: Family based applications such as PDS or Health applications may allow authentication by family members to allow resident to avail services.
(ii) Alternate Modalities: Some applications may use different modalities for exception handling. Alternate modalities include:
(a) Iris Authentication
(b) OTP Authentication (if allowed by policy)
(iii) Biometric Fusion: UIDAI is introducing face authentication as secondary authentication factor to reduce the rate of authentication failures, especially for senior citizens. At this time, face authentication will be used only conjunction with another authentication factor such as finger/iris/OTP.
(a) Face + Finger Fusion
(b) Face + Iris Fusion
(c) Face + OTP Fusion
(iv) Non Aadhaar Based Exception process: Applications may implement non-Aadhaar based exception process to ensure that no resident is denied service. Applications need to monitor the use of exceptions in their applications to prevent misuse of the exception process.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 75 of 567
(v) Accordingly, DBT Mission Cabinet Secretariat had issued a detailed circular dated December 19, 2017 regarding use of Aadhaar in benefit schemes of Government – exception handling. (5) Please confirm that with respect to individuals under 15 years and over 60 years of age, biometric authentication is likely to fail due to changes in/fading of biometrics such as fingerprints. Ans.: Though there is no conclusive evidence to say that biometric authentication success is dependent upon age, slightly higher authentication failure rates have been observed only for fingerprints for senior citizens above the age of 70. A number of exception processes are provided in answer to Question 4(b) above to prevent denial of service for failure of authentication. Further, in case of any issue in biometric authentication, an Aadhaar number holder may update his/her biometric at any of the Aadhaar enrolment centres, which is also provided for in the Aadhaar Act.
(6) Please confirm that the reasons why over 49000 enrolment operators were blacklisted include: (i) failure to verify documents presented; (ii) failure to maintain records of documents submitted;
(iii) misuse of information submitted; and (iv) aiding or abetting false enrolments?
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 76 of 567 Ans.: UIDAI has a policy to enforce the process guidelines and data quality check during the enrolment process. 100% of the enrolments done by operators undergoes a quality assurance check. If any Aadhaar enrolment is found to be not as per the UIDAI process, the enrolment itself gets rejected and Aadhaar is not generated. If such mistake by an operator crosses a threshold defined in the policy, the operator is blacklisted/ removed from the UIDAI ecosystem. As such, of the 49,000 operators who have been blacklisted/removed from the UIDAI eco-system, all the enrolments which were in violation of the process were rejected in the QA stage. Enrolment operators may be blacklisted for the following reasons:
illegally charging the resident for Aadhaar enrolment poor demographic data quality invalid biometric exceptions other process malpractice (7) Please confirm:
(a) At the stage of enrolment, there is no verification as to whether a person is an illegal immigrant.
(b) At the stage of enrolment, there is no verification about a person being resident in India for 182 days or more in the past 12 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 77 of 567 months.
(c) Foreign nationals may enrol and are issued Aadhaar numbers.
(d) Persons retain their Aadhaar number even after they cease to be resident. This is true of foreign nationals as well. Ans.:
(a) At the time of enrolment, verification is done based upon documents provided by the resident. In case any violation of prescribed guidelines comes to light, the concerned Aadhaar is omitted/deactivated.
(b) This has been included through the enrolment form where resident undertakes and signs the disclosure:
“Disclosure under Section 3(2) of the Aadhaar (Targeted Delivery of Financial And Other Subsidies, Benefits and Services) Act, 2016 I confirm that I have been residing in India for at least 182 days in the preceding 12 months & information (including biometrics) provided by me to the UIDAI is my own and is true, correct and accurate. I am aware that my information (including biometrics) will be used for generation of Aadhaar and authentication. I understand that my identity information (except core biometric) may be provided to an agency only with my consent during authentication or as per the provisions of the Aadhaar Act. I have a right to access my identity information (except core biometrics) following the procedure laid down by UIDAI.”
(c) Aadhaar is issued to the resident of India and the word ‘resident’ is defined in Section 2(v) of the Aadhaar Act. Aadhaar numbers may be issued to foreign nationals who are resident in Writ Petition (Civil) No. 494 of 2012 & connected matters Page 78 of 567 India. Section 2(v) reads as under:
“ ‘resident’ means an individual who has resided in India for a period or periods amounting in all to one hundred and eighty-two days or more in the twelve months immediately preceding the date of application for enrolment;” A foreign national fulfilling the above criteria is eligible for Aadhaar, provided he submits the acceptable POI/POA document as per the UIDAI valid list of documents.
(d) As per the Aadhaar Act, an Aadhaar number is issued to a resident who has been residing in India for at least 182 days in the preceding 12 months. An Aadhaar number is issued to an individual for life and may be omitted/deactivated in case of violation of prescribed guidelines only. Ineligibility of a person to retain an Aadhaar number owing to become non-resident may be treated as a ground for deactivation of Aadhaar number and Regulation 28(l)(f) of the Aadhaar Enrolment Regulations. This is in keeping with Section 31(1) and (3) of the Aadhaar Act wherein it is an obligation on an Aadhaar number holder to inform the UIDAI of changes in demographic information and for the Authority to make the necessary alteration.
(8) Please confirm the Points Of Service (POS) biometric readers are capable of storing biometric information.
Ans.: UIDAI has mandated use of Registered Devices (RD) for Writ Petition (Civil) No. 494 of 2012 & connected matters Page 79 of 567 all authentication requests. With RDs, biometric data is signed within the device/RD service using the provider key to ensure it is indeed captured live. The device provider RD service encrypts the PID block before returning to the host application. This RD service encapsulates the biometric capture, signing and encryption of biometrics all within it. Therefore, introduction of RD in Aadhaar authentication system rules out any possibility of use of stored biometric and replay of biometrics captured from other source. Requesting entities are not legally allowed to store biometrics captured for Aadhaar authentication under Regulation 17(1)(a) of the Authentication Regulations.
(9) Referring to slide/page 13, please confirm that the architecture under the Aadhaar Act includes: (i) authentication user agencies (e.g. Kerala Dairy Farmers Welfare Fund Board);
(ii) authentication service agencies (e.g. Airtel); and (iii) CIDR. Ans.: UIDAI appoints Requesting Entities (AUA/KUA) and Authentication Service Agency (ASA) as per Regulation 12 of Authentication Regulations. List of Requesting Entitles (AUA/KUA) and Authentication Service Agency appointed by UIDAI is available on UIDAI’s website. An AUA/KUA can do authentication on behalf of other entities under Regulation 15 and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 80 of 567 Regulation 16.
(10) Please confirm that one or more entitles in the Aadhaar architecture described in the previous paragraph record the date and time of the authentication, the client IP, the device ID and purpose of authentication.
Ans.: UIDAI does not ask requesting entities to maintain any logs related to IP address of the device, GPS coordinates of the device and purpose of authentication. However, AUAs like banks, telecom etc., in order to ensure that their systems are secure, frauds are managed, they may store additional information as per their requirement under their respective laws to secure their system. Section 32(3) of the Aadhaar Act specifically prevents the UIDAI from either by itself or through any entity under its control to keep or maintain any information about the purpose of authentication.
Requesting entities are mandated to maintain following logs as per Regulation 18 of the Authentication Regulations. These are:
(i) the Aadhaar number against which authentication is sought;
(ii) specified parameters of authentication request Writ Petition (Civil) No. 494 of 2012 & connected matters Page 81 of 567 submitted;
(iii) specified parameters received as authentication response;
(iv) the record of disclosure of information to the Aadhaar number holder at the time of authentication; and
(v) record of consent of the Aadhaar number holder for authentication, but shall not, in any event, retain the PID information.
Further, even if a requesting entity captures any other data as per their own requirement, UIDAI will only audit the authentication logs maintained by the requesting entity as per Regulation 18(1) of the Authentication Regulations.
ASAs are not permitted to maintain any logs related to IP address of the device, GPS coordinates of the device etc. ASAs are mandated to maintain logs as per Regulation 20 of the Authentication Regulations:
(i) identity of the requesting entity;
(ii) parameters of authentication request submitted; and
(iii) parameters received as authentication response.
Provided that no Aadhaar number, PID information, device identity related data and e-KYC response data, where applicable, shall be retained.Writ Petition (Civil) No. 494 of 2012 & connected matters Page 82 of 567
(11) Referring to slide/page 7 and 14, please confirm that ‘traceability’ features enable UIDAI to track the specific device and its location from where each and every authentication takes place.
Ans.: UIDAI gets the AUA code, ASA code, unique device code, registered device code used for authentication. UIDAI does not get any information related to the IP address or the GPS location from where authentication is performed as these parameters are not part of authentication (v2.0) and e-KYC (v2.1) API UIDAI would only know from which device the authentication has happened, through which AUA/ASA etc. This is what the slides meant by traceability. UIDAI does not receive any information about at what location the authentication device is deployed, its IP address and its operator and the purpose of authentication. Further, the UIDAI or any entity under its control is statutorily barred from collecting, keeping or maintaining any information about the purpose of authentication under Section 32(3) of the Aadhaar Act.
Summing up the Scheme:
55) The whole architecture of Aadhaar is devised to give unique identity to the citizens of this country. No doubt, a person can Writ Petition (Civil) No. 494 of 2012 & connected matters Page 83 of 567 have various documents on the basis of which that individual can establish her identify. It may be in the form of a passport, Permanent Account Number (PAN) card, ration card and so on. For the purpose of enrolment itself number of documents are prescribed which an individual can produce on the basis of which Aadhaar card can be issued. Thus, such documents, in a way, are also proof of identity. However, there is a fundamental difference between the Aadhaar card as a mean of identity and other documents through which identity can be established. Enrolment for Aadhaar card also requires giving of demographic information as well as biometric information which is in the form of iris and fingerprints. This process eliminates any chance of duplication. It is emphasised that an individual can manipulate the system by having more than one or even number of PAN cards, passports, ration cards etc. When it comes to obtaining Aadhaar card, there is no possibility of obtaining duplicate card. Once the biometric information is stored and on that basis Aadhaar card is issued, it remains in the system with the Authority. Wherever there would be a second attempt for enrolling for Aadhaar and for this purpose same person gives his biometric information, it would immediately get matched with the same biometric information already in the system and the second Writ Petition (Civil) No. 494 of 2012 & connected matters Page 84 of 567 request would stand rejected. It is for this reason the Aadhaar card is known as Unique Identification (UID). Such an identity is unparalleled.
56) There is, then, another purpose for having such a system of issuing unique identification cards in the form of Aadhaar card. A glimpse thereof is captured under the heading ‘Introduction’ above while mentioning how and under what circumstances the whole project was conceptualised. To put it tersely, in addition to enabling any resident to obtain such unique identification proof, it is also to empower marginalised section of the society, particularly those who are illiterate and living in abject poverty or without any shelter etc. It gives identity to such persons also. Moreover, with the aid of Aadhaar card, they can claim various privileges and benefits etc. which are actually meant for these people.
Identity of a person has a significance for every individual in his/her life. In a civilised society every individual, on taking birth, is given a name. Her place of birth and parentage also becomes important as she is known in the society and these demographic particulars also become important attribute of her personality. Throughout their lives, individuals are supposed to provide such information: be it admission in a school or college or at the time of Writ Petition (Civil) No. 494 of 2012 & connected matters Page 85 of 567 taking job or engaging in any profession or business activity, etc. When all this information is available in one place, in the form of Aadhaar card, it not only becomes unique, it would also qualify as a document of empowerment. Added with this feature, when an individual knows that no other person can clone her, it assumes greater significance.
57) Thus, the scheme by itself can be treated as laudable when it comes to enabling an individual to seek Aadhaar number, more so, when it is voluntary in nature. Howsoever benevolent the scheme may be, it has to pass the muster of constitutionality. According to the petitioners, the very architecture of Aadhaar is unconstitutional on various grounds, glimpse whereof can be provided at this stage:
Gist of the challenge to the Aadhaar Scheme as well as the Act:
58) The petitioners accept that the case at hand is unique, simply because of the reason that the programme challenged here is itself without precedent. According to them, no democratic society has adopted a programme that is similar in its command and sweep. The case is about a new technology that the Government seeks to deploy and a new architecture of governance that it seeks to build on this technology. The Writ Petition (Civil) No. 494 of 2012 & connected matters Page 86 of 567 petitioners are discrediting the Government’s claim that biometric technology employed and the Aadhaar Act is greatly beneficial. As per the petitioners, this is an inroad into the rights and liberties of the citizens which the Constitution of India guarantees. It is intrusive in nature. At its core, Aadhaar alters the relationship between the citizen and the State. It diminishes the status of the citizens. Rights freely exercised, liberties freely enjoyed, entitlements granted by the Constitution and laws are all made conditional, on a compulsory barter. The barter compels the citizens to give up their biometrics ‘voluntarily’, allow their biometrics and demographic information to be stored by the State and private operators and then used for a process termed ‘authentication’. According to them, by the very scheme of the Act and the way it operates, it has propensity to cause ‘civil death’ of an individual by simply switching of Aadhaar of that person. It is the submission of the petitioners that the Constitution balances rights of individuals against State interest. The Aadhaar completely upsets this balance and skews the relationship between the citizen and the State enabling the State to totally dominate the individual.
59) The challenge is directed at the constitutional validity of the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 87 of 567 following facets of Aadhaar:
(i) The Aadhaar programme that operated between January 28, 2009 until the bringing into force of the Aadhaar Act on July 12, 2016.
(ii) The Aadhaar Act (and alternatively certain provisions of that Act).
(iii) Elements of the Aadhaar project or programme that continues to operate, though not within the cover of the Aadhaar Act.
(iv) Specific Regulations framed under the Aadhaar Act, illustratively the Aadhaar (Authentication) Regulations, 2016.
(v) A set of subordinate legislation in the form of statutory rules/regulations including the Money Laundering (Amendment) Rules, 2017.
(vi) All notifications (nearly 139) issued under Section 7 of the Aadhaar Act (assuming the Act is upheld) insofar as they make Aadhaar mandatory for availing certain benefits/services/subsidies, including PDS, MGNREGA and social security pension.
(vii) Actions on the part of the authorities to make Aadhaar mandatory even where not covered by Section 7, inter Writ Petition (Civil) No. 494 of 2012 & connected matters Page 88 of 567 alia: Actions by CBSE, NEET, JEE and UGC requirements for scholarship.
(viii) Specifically, actions on part of the Government mandating linking of mobile phones and Aadhaar vide DoT circular dated March 23, 2017.
(ix) Section 139AA of the Income Tax Act, 1961 insofar as it violates Article 21 by mandating linking Aadhaar to PAN and requiring Aadhaar linkage for filing returns.
60) Apart from the declaratory reliefs regarding ultra vires and certiorari to quash the provisions/actions enumerated above, there are certain other reliefs that are also sought, including:
(i) Suitable declarations regarding the physical autonomy of a person over her own body qua the Indian State.
(ii) Mandatory directions requiring the respondents to give an option to persons who are enrolled with the Aadhaar programme to opt out and to delete the data with suitable certification for compliance.
(iii) Mandatory directions to all concerned authorities that should the Aadhaar Act, etc. be upheld, nevertheless, every person must be entitled to avail services, benefits etc. through alternative means of identification. Negatively, nothing can be withheld from a citizen merely Writ Petition (Civil) No. 494 of 2012 & connected matters Page 89 of 567 because he/she does not have an Aadhaar Card or does not wish to use their Aadhaar Card.
(iv) Mandatory directions consistent with the fundamental right to privacy and the right of a citizen to be let alone that no electronic trial or record of his/her authentication be maintained.
61) On the aforesaid premise, the petitioners point out following heads of challenge:
Surveillance:
62) The project creates the architecture for pervasive surveillance and unless the project is stopped, it will lead to an Orwellian State where every move of the citizen is constantly tracked and recorded by the State. The architecture of the project comprises a Central Identities Data Repository (CIDR) which stores and maintains authentication transaction data. The authentication record comprises the time of authentication and the identity of the requesting entity. Based on this architecture it is possible for the State to track down the location of the person seeking authentication. Since the requesting entity is also identified, the activity that the citizen is engaging in is also known. Violation of Fundamental Right to Privacy: Writ Petition (Civil) No. 494 of 2012 & connected matters Page 90 of 567
63) The fundamental right to privacy is breached by the Aadhaar project and the Aadhaar Act in numerous ways. Following are the illustrations given by the petitioners:
(a) Between 2009-10 and July 2016 the project violated the right to privacy with respect to personal demographic as well as biometric information collected, stored and shared as there was no law authorising these actions.
(b) During both the pre-Act and post-Act periods, the project continues to violate the right to privacy by requiring individuals to part with demographic as well as biometric information to private enrolling agencies.
(c) By enabling private entities to use the Aadhaar authentication platform, the citizen’s right to informational privacy is violated inasmuch as the citizen is compelled to ‘report’ his/her actions to the State.
(d) Even where a person is availing of a subsidy, benefit or service from the State, mandatory authentication through the Aadhaar platform (without an option to the citizen to use an alternative mode of identification) violates the right to informational privacy.
(e) With Aadhaar being made compulsory for holding a bank account, operating a cell phone, having a valid PAN, holding Writ Petition (Civil) No. 494 of 2012 & connected matters Page 91 of 567 mutual funds, securing admission to school, taking a board examination, etc. the citizen has no option but to obtain Aadhaar. Compelling the citizen to part with biometric information violates individual autonomy and dignity.
(f) In a digital society an individual has the right to protect himself by controlling the dissemination of personal information, including biometric information. Compelling an individual to establish his identity by planting her biometric at multiple points of service violates privacy involving the person.
(g) The seeding of Aadhaar in distinct databases enables the content of information about an individual that is stored in different silos to be aggregated. This enables the State to build complete profiles of individuals violating privacy through the convergence of data.
Limited Government:
64) A fundamental feature of the Constitution is the sovereignty of the people with limited Government authority. The Constitution limits governmental authority in various ways, amongst them Fundamental Rights, the distribution of powers amongst organs of the State and the ultimate check by way of judicial review. The Aadhaar project is destructive of the limited Government. The Writ Petition (Civil) No. 494 of 2012 & connected matters Page 92 of 567 Constitution is not about the power of the State, but about the limits on the power of the State. Post Aadhaar, the State will completely dominate the citizen and alter the relationship between citizen and the State. The features of a totalitarian state is seen from: