90 The institutional structure of the Rajya Sabha has been developed to reflect the pluralism of the nation and its diversity of language, culture, perception and interest. The Rajya Sabha was envisaged by the makers of the Constitution to ensure a wider scrutiny of legislative proposals. As a second chamber of Parliament, it acts as a check on hasty and ill-conceived legislation, providing an opportunity for scrutiny of legislative business. The role of the Rajya Sabha is intrinsic to ensuring executive accountability and to preserving a balance of power. The Upper Chamber complements the working of the Lower Chamber in many ways. The Rajya Sabha acts as an institution of balance in relation to the Lok Sabha and represents the federal structure148 of India. Both the existence and the role of the Rajya Sabha constitute a part of the basic structure of the Constitution. The architecture of our Constitution envisions the Rajya Sabha as an institution of federal bicameralism and not just as a part of a simple bicameral legislature. Its nomenclature as the ‘Council of States’ rather than the ‘Senate’ appropriately justifies its federal importance.149 Seervai has observed that the federal principle is dominant in our Constitution. While adverting to several of its 147 Sidharth Chauhan, Bicameralism: comparative insights and lessons, Seminar (February, 2013) available at http://india-seminar.com/2013/642/642_sidharth_chauhan.html 148 In SR Bommai v Union of India (AIR 1994 SC 1998), a seven-judge Bench of this Court held: “Democracy and federalism are the essential features of our Constitution and are part of its basic structure.” 149 Rajya Sabha Secretariat, Second Chamber In Indian Parliament: Role and Status of Rajya Sabha, (2009), at page 2. See also M.N. Kaul and S.L. Shakdher, Practice and Procedure of Parliament, Lok Sabha Secretariat (2001) 145 PART E federal features, Seervai emphasises the position of the Rajya Sabha as an integral element:
“First and foremost, Parliament (the Central Legislature) is dependent upon the States, because one of its Houses, the Council of States, is elected by the Legislative Assemblies of the States. Where the ruling party, or group of parties, in the House of the People has a majority but not an overwhelming majority, the Council of States can have a very important voice in the passage of legislation other than financial Bills. Secondly, a Bill to amend the Constitution requires to be passed by each House of Parliament separately by an absolute majority in that House and by not less than two-
thirds of those present and voting. Since the Council of States is indirectly elected by the State Legislatures, the State Legislatures have an important say in the amendment of the Constitution because of the requirement of special majorities in each House. Thirdly, the very important matters mentioned in the proviso to Article 368 (Amendment of the Constitution) cannot be amended unless the amendments passed by Parliament are ratified by not less than half the number of Legislatures of the States… Fourthly, the amendment of Article 352 by the 44th Amendment gives the Council of States a most important voice in the declaration of Emergency, because a proclamation of emergency must be approved by each House separately by majorities required for an amendment of the Constitution… Fifthly, the executive power of the Union is vested in the President of India who is not directly elected by the people but is elected by an electoral college consisting of (a) the elected members of the Legislative Assemblies of the States and (b) the elected members of both Houses of Parliament… Directly the State Legislatures have substantial voting power in electing the President; that power is increased indirectly through the Council of States, which is elected by the Legislative Assemblies of States.”150 91 The Rajya Sabha represents the constituent states of India. It legitimately holds itself as the guardian of the interest of the component states in a federal polity. It endeavours to remain concerned and sensitive to the aspirations of the states, thereby strengthening the country’s “federal fabric” 150 H M Seervai, Constitutional Law of India, Universal Law Co. Pvt. Ltd, Vol. 1, (1991), at pages 299-300. 146 PART E and “promotes national integration”.151 Being the federal chamber of Parliament, the Rajya Sabha enjoys some special powers, which are not even available to the Lok Sabha, under the Constitution152:
“(i) Article 249 of the Constitution provides that Rajya Sabha may pass a resolution, by a majority of not less than two- thirds of the Members present and voting to the effect that it is necessary or expedient in the national interest that Parliament should make a law with respect to any matter enumerated in the State List. Then, Parliament is empowered to make a law on the subject specified in the resolution for the whole or any part of the territory of India. Such a resolution remains in force for a maximum period of one year but this period can be extended by one year at a time by passing a further resolution;
(ii) Under Article 312 of the Constitution, if Rajya Sabha passes a resolution by a majority of not less than two-thirds of the Members present and voting declaring that it is necessary or expedient in the national interest to create one or more All India Services common to the Union and the States, Parliament has the power to create by law such services; and
(iii) Under the Constitution, President is empowered to issue Proclamations in the event of national emergency (Article
352), in the event of failure of constitutional machinery in a State (Article 356), or in the case of financial emergency (Article 360). Normally, every such Proclamation has to be approved by both Houses of Parliament within a stipulated period. Under certain circumstances, however, Rajya Sabha enjoys special powers in this regard. If a Proclamation is issued at a time when the dissolution of the Lok Sabha takes place within the period allowed for its approval, then the Proclamation can remain effective if a resolution approving it, is passed by Rajya Sabha.” 92 The Rajya Sabha is a permanent body as it is not subject to dissolution.153 Being an indirectly elected House, it has no role in the making or unmaking of the Government and therefore it is comparatively “free from 151 Rajya Sabha Secretariat, Second Chamber In Indian Parliament: Role and Status of Rajya Sabha, (2009), at page 6.
152 Rajya Sabha Secretariat, Structure and Functions of Rajya Sabha Secretariat, (2009), at pages 2-3 153 Under Article 83(1), the Rajya Sabha is a permanent body with members being elected for 6 year terms and one-third of the members retiring every 2 years. 147 PART E compulsions of competitive party politics”.154 As a revising chamber, the Constitution makers envisioned that it will protect the values of the Constitution, even if it is against the popular will. The Rajya Sabha is a symbol against majoritarianism.
A Constitution Bench of this Court in Kuldip Nayar v Union of India155 highlighted the importance of the Rajya Sabha:
“47. The Rajya Sabha is a forum to which experienced public figures get access without going through the din and bustle of a general election which is inevitable in the case of Lok Sabha. It acts as a revising chamber over the Lok Sabha. The existence of two debating chambers means that all proposals and programmes of the Government are discussed twice. As a revising chamber, the Rajya Sabha helps in improving Bills passed by the Lok Sabha...”156 93 Participatory governance is the essence of democracy. It ensures responsiveness and transparency. An analysis of the Bills revised by the Rajya Sabha reveals that in a number of cases, the changes recommended by the Rajya Sabha in the Bills passed by the Lok Sabha were eventually carried out.157 The Dowry Prohibition Bill is an example of a legislation in which the Rajya Sabha’s insistence on amendments led to the convening of a joint sitting158 of the two Houses and in that sitting, one of the amendments 154 Rajya Sabha Secretariat, Second Chamber In Indian Parliament: Role and Status of Rajya Sabha, (2009), at pages 7-8 155 (2006) 7 SCC 1 156 Ibid, at page 47 157 Rajya Sabha Secretariat, Second Chamber In Indian Parliament: Role and Status of Rajya Sabha, (2009), at page 5 158 Dr Ambedkar explained that the joint sitting had been kept at the centre because of the federal character of the Central Legislature. See Granville Austin, The Indian Constitution: Cornerstone of a Nation, Oxford University Press (1966), at page 202 148 PART E suggested by the Rajya Sabha was adopted without a division. 159 The Rajya Sabha has a vital responsibility in nation building, as the dialogue between the two houses of Parliament helps to address disputes from divergent perspectives. The bicameral nature of Indian Parliament is integral to the working of the federal Constitution. It lays down the foundations of our democracy. That it forms a part of the basic structure of the Constitution, is hence based on constitutional principle. The decision of the Speaker on whether a Bill is a Money Bill is not a matter of procedure. It directly impacts on the role of the Rajya Sabha and, therefore, on the working of the federal polity.
94 There is a constitutional trust which attaches to the empowerment of the Speaker of the Lok Sabha to decide whether a legislative measure is a Money Bill. Entrustment of the authority to decide is founded on the expectation that the Speaker of the Lok Sabha will not dilute the existence of a co-ordinate institution in a bicameral legislature. A constitutional trust has been vested in the office of the Speaker of the Lok Sabha. By declaring an ordinary Bill to be a Money Bill, the Speaker limits the role of the Rajya Sabha. This power cannot be unbridled or bereft of judicial scrutiny. If the power of the Speaker is exercised contrary to constitutional norms, it will not only limit the role of the Rajya Sabha, but denude the efficacy of a legislative body created by the Constitution. Such an outcome would be inconsistent 159 Rajya Sabha Secretariat, Second Chamber In Indian Parliament: Role and Status of Rajya Sabha, (2009), at page 5 149 PART E with the scheme of the Indian Constitution. Judicial review is necessary to ensure that the federal features of the Constitution are not transgressed. E.2 Aadhaar Act as a Money Bill This Court must now deal with whether the Aadhaar Act was validly passed as a Money Bill.
95 Article 110(1) of the Constitution defines a Money Bill. For a Bill to be a Money Bill, it must contain “only provisions” dealing with every or any one of the matters set out in sub-clauses (a) to (g) of clause 1 of Article 110. The expression “if it contains only provisions dealing with all or any of the following matters, namely...” is crucial. Firstly, the expression “if” indicates a condition and it is only upon the condition being fulfilled that the deeming fiction of a Bill being a Money Bill for the purposes of the Chapter will arise. Secondly, to be a Money Bill, the Bill should have only those provisions which are referable to clauses (a) to (g). The condition is much more stringent than stipulating that the Bill should incorporate any of the matters spelt out in clauses (a) to (g). The words “only provisions” means that besides the matters in sub clauses (a) to (g), the Bill shall not include anything else. Otherwise, the expression “only” will have no meaning. The word “only” cannot be treated to be otiose or redundant. Thirdly, the two expressions “if it contains only provisions” and “namely” indicate that sub-clauses (a) to (g) are exhaustive of what a Money Bill may contain. The contents of a Money Bill have to be confined to all or any 150 PART E of the matters specified in sub-clauses (a) to (g). Fourthly, sub-clause (g) covers any matter incidental to sub-clauses (a) to (f). A matter is incidental when it is ancillary to what is already specified. Sub-clause (g) is not a residuary entry which covers all other matters other than those specified in sub-clauses (a) to (f). If sub-clause (g) were read as a catch-all residuary provision, it would defeat the purpose of defining a class of Bills as Money Bills. What is incidental under sub-clause (g) is that which is ancillary to a matter which is already specified in sub-clauses (a) to (f). The test is not whether it is incidental to the content of a Bill but whether it is incidental to any of the matters specifically enumerated in sub-clauses (a) to (f). The Attorney General would request the court to read the word “only” before “if” and not where it occurs. If the submission were to be accepted, it would lead to the consequence that the Bill would be a Money Bill if it contained provisions dealing with clause (a) to (g), even if it contained other provisions not relatable to these clauses. We cannot rewrite the Constitution, particularly where it is contrary to both text, context and intent.
Clause (2) of Article 110 provides that a Bill shall not be deemed to be a Money Bill just for the reason that it provides for the imposition of fines or other pecuniary penalties, or for the demand or payment of fees for licences or fees for services rendered, or by reason that it provides for the imposition, abolition, remission, alteration or regulation of any tax by any local authority or body for local purposes. Like in the Parliament Act of 1911, the definition of a 151 PART E Money Bill provided under Article 110(1) is exhaustive in nature. A Bill can be a Money Bill if it contains “only provisions” dealing with all or any of the matters listed under sub-clauses (a) to (g) of Article 110(1). 96 A Financial Bill is different from a Money Bill. Article 117 provides for special provisions relating to Financial Bills. Clause (1) of Article 117 states:
“(1) A Bill or amendment making provision for any of the matters specified in sub-clauses (a) to (f) of clause (1) of article 110 shall not be introduced or moved except on the recommendation of the President and a Bill making such provision shall not be introduced in the Council of States.” A Financial Bill does not need to have “only provisions” dealing with Sub-
clauses (a) to (f) of Article 110. The provisions of Article 110(1) are therefore narrow and exhaustive.
97 As a matter of interpretation, the use of the word “only” indicates that a particular entry is exhaustive and is inapplicable to anything which falls outside its scope. This Court has interpreted the expression “only” as a word of exclusion and restriction.160 The interpretation of Article 110(1) as being restrictive in nature is also supported by the proceedings in the Constituent Assembly of India. Article 110 corresponds to Article 90 of the Draft Constitution. On 20 May 1949, a member of the Constituent Assembly, Ghanshyam Singh Gupta, proposed an amendment in clause (1) of Article 90 160Hari Ram v. Baby Gokul Prasad, (1991) Supp (2) SCC 608; M/s Saru Smelting (P) Ltd. v. Commissioner of Sales Tax, Lucknow, (1993) Supp (3) SCC 97.
152 PART E to delete the word “only”. He stated that a Bill can be a Money bill even while containing other provisions. Gupta argued:
“This article is a prototype of Section 37 of the Government of India Act which says that a Bill or amendment providing for imposing or increasing a tax or borrowing money, etc. shall not be introduced or moved except on the recommendation of the Governor-General. This means that the whole Bill need not be a money Bill: it may contain other provisions, but if there is any provision about taxation or borrowing, etc. It will come under this Section 37, and the recommendation of the Governor-General is necessary. Now article 90 says that a Bill shall be deemed to be a money Bill if it contains only provisions dealing with the imposition, regulation, etc., of any tax or the borrowing of money, etc. This can mean that if there is a Bill which has other provisions and also a provision about taxation or borrowing etc., it will not become a money Bill. If that is the intention I have nothing to say; but that if that is not the intention I must say the word "only" is dangerous, because if the Bill does all these things and at the same time does something else also it will not be a money Bill. I do not know what the intention of the Drafting Committee is but I think this aspect of the article should be borne in mind.”161 (Emphasis supplied) Another member Naziruddin Ahmad also emphasized on the deletion of the word “only”. The concern of these two members was that the word “only” restricts the scope of a Bill being passed as a Money Bill. Their apprehension was that if a Bill has other provisions which are unrelated to the clauses mentioned in draft Article 90, the Bill would not qualify to be a Money Bill in view of the word “only”. The amendment suggested by these members was listed to be put to vote on a later date. The amendment was rejected when it was put to vote on 8 June 1949. The framers of the Indian Constitution consciously rejected the said amendment.
161 Constituent Assembly Debates (20 May 1949) 153 PART E 98 When a Bill is listed as a Money Bill, it takes away the power of the Rajya Sabha to reject or amend the Bill. The Rajya Sabha can only make suggestions to a Money Bill, which are not binding on the Lok Sabha. The Constitution makers would have been aware about the repercussions of a Bill being introduced as a Money Bill. As the role of the Rajya Sabha is limited in the context of Money Bills, the scope of what constitutes a Money Bill was restricted by adopting the word “only” in Draft Article 90. A Bill to be a Money Bill must not contain any provision which falls outside clauses (a) to (g) of Article 110(1). The Constitution has carefully used the expression “dealing with” in Article 110 (1) and not the wider legislative form “related to”. A Bill, which has both − certain provisions which fall within sub-clauses (a) to (g) of Article 110(1) and other provisions which fall outside will not qualify to be a Money Bill. It is for this reason that there cannot also be any issue of the severability of the provisions of a Bill, which has certain provisions relating to sub-clauses (a) to (g) of Article 110(1), while also containing provisions which fall beyond. Any other interpretation would result in rewriting the Constitution. If a Bill contains provisions which fall outside sub-clauses (a) to (g), it is not a Money Bill. The Rajya Sabha is entitled as part of its constitutional function to legislative participation. The entirety of the Bill cannot be regarded as a Money Bill, once it contains any matters which fall beyond sub-clauses (a) to (g). Once that is the position, it could be impossible to sever those parts which fall within sub-clauses (a) to (g) and those that lie outside. The presence of matters which travel beyond sub-clauses (a) to (g) has consequences in terms 154 PART E of the nature of the Bill and the legislative participation of the Rajya Sabha. If the constitutional function of the Rajya Sabha has been denuded on the hypothesis that this Bill was a Money Bill, the consequence of a finding in judicial review that the Bill is not a Money Bill must follow. Any other construction will reduce bicameralism to an illusion. This interpretation is also supported by the judgment of a Bench of seven judges of this Court in Krishna Kumar Singh v State of Bihar162, where it held that the ordinance making power conferred upon the President and the Governors is limited by the requirements set out by Articles 123 and 213. This Court had held:
“59…The constitutional conferment of a power to frame ordinances is in deviation of the normal mode of legislation which takes place through the elected bodies comprising of Parliament and the state legislatures. Such a deviation is permitted by the Constitution to enable the President and Governors to enact ordinances which have the force and effect of law simply because of the existence of circumstances which can brook no delay in the formulation of legislation. In a parliamentary democracy, the government is responsible collectively to the elected legislature. The subsistence of a government depends on the continued confidence of the legislature. The ordinance making power is subject to the control of the legislature over the executive. The accountability of the executive to the legislature is symbolised by the manner in which the Constitution has subjected the ordinance making power to legislative authority. This, the Constitution achieves by the requirements of Article 213...”163 (Emphasis supplied) 99 The authority of the Lok Sabha to pass a Money Bill is based on the requirements set out under Article 110. The framers of the Indian Constitution 162 (2017) 3 SCC 1 163 Ibid, at page 61 155 PART E deliberately restricted the scope of Article 110(1) to ensure that the provision is not an avenue to supersede the authority of the Rajya Sabha. The intention of the Constitution makers is clear. The Lok Sabha cannot introduce and pass a legislative measure in the garb of a Money Bill, which could otherwise have been amended or rejected by the Rajya Sabha. Bicameralism is a founding value of our democracy. It is a part of the basic structure of the Constitution.
Introduction and passing of a Bill as a Money Bill, which does not qualify to be a Money Bill under Article 110(1) of the Constitution, is plainly unconstitutional. The Lok Sabha is not entrusted with the entire authority of Parliament. The Lok Sabha, the Rajya Sabha and the President together constitute the Parliament of India. The Lok Sabha is a body of elected representatives and represents the aspirations of citizens. Yet, like every constitutional institution, it is part of this basic structure of the Constitution. A political party or a coalition which holds the majority in the Lok Sabha cannot subvert the working of the Constitution, against which Dr B R Ambedkar had warned164 in the Constituent Assembly. A ruling government has to work within constitutional parameters and has to abide by constitutional morality. 100 The Constitution of India is not a mere parchment of paper. It was written with the vision of those who gave blood and sweat to freedom: political personalities, social reformers and constitution framers. It symbolises a faith in institutions, justice and good governance. That vision cannot be belied. The 164 Constituent Assembly Debates (4 November, 1948). Dr Ambedkar had remarked: “… it is perfectly possible to pervert the Constitution, without changing its form by merely changing the form of the administration and to make it inconsistent and opposed to the spirit of the Constitution.” 156 PART E Speaker of the Lok Sabha has an onerous constitutional duty to ensure that a Bill, which is not a Money Bill is not passed as a Money Bill. The Speaker of the Lok Sabha, the Chairman of the Rajya Sabha, the members of the Lok Sabha and the Rajya Sabha, and the President need to work in constitutional solidarity to ensure that no provision of the Constitution is diluted or subverted. 101 The Aadhaar Act was passed as a Money Bill. The provisions of the Act need to be analysed to determine whether the Act is a Money Bill. The Preamble of the Act states that it is:
“An Act to provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto.” The Preamble focuses on the delivery of subsidies, benefits and services for which the expenditure is borne from the Consolidated Fund of India. But the essential issue is whether the Act confines itself to matters which fall within the ambit of Article 110.
102 Section 3 entitles every resident165 in India to obtain an Aadhaar number by submitting his or her demographic information, by undergoing the process of enrolment. Section 2(m) defines “enrolment” as the process to 165 Section 2(v) provides: “resident” means an individual who has resided in India for a period or periods amounting in all to one hundred and eighty-two days or more in the twelve months immediately preceding the date of application for enrolment.
157 PART E collect demographic and biometric information from individuals by the enrolling agencies for the purpose of issuing Aadhaar numbers to such individuals. After receiving the demographic and biometric information of the individual, the Unique Identification Authority of India (UIDAI) would verify the information and shall issue an Aadhaar number to such an individual.166 Section 4(3) provides that the Aadhaar number may be accepted as proof of identity for “any purpose”. Section 5 requires UIDAI to take special measures to issue Aadhaar numbers to “women, children, senior citizens, persons with disability, unskilled and unorganised workers, nomadic tribes or to such other persons who do not have any permanent dwelling house and such other categories of individuals”. Under Section 6, UIDAI may require Aadhaar number holders to update their demographic information and biometric information, from time to time so as to ensure continued accuracy of their information in the Central Identities Data Repository (“CIDR”). The Aadhaar Act defines CIDR as a centralised database containing all Aadhaar numbers issued to Aadhaar number holders along with the corresponding demographic information and biometric information of such individuals and other related information.167 103 Section 7 requires proof of an Aadhaar number as a necessary condition to avail subsidies, benefits and services, for which the expenditure is borne from the Consolidated Fund of India. The proviso to Section 7 states that if an Aadhaar number is not assigned to an individual, the individual shall 166 Section 3(3), Aadhaar Act 167 Section 2(h), Aadhaar Act 158 PART E be offered alternate and viable means of identification for delivery of the subsidy, benefit or service. Section 8(1) requires UIDAI to perform authentication168 of the Aadhaar number of an Aadhaar number holder, in relation to his or her biometric information or demographic information submitted by any requesting entity169. Under Section 8(2), a requesting entity is required to obtain the consent of an individual before collecting his or her identity information for the purposes of authentication. The requesting entity must ensure that the identity information of an individual collected by it is only used for submission to the CIDR for authentication. Section 8(3) requires a requesting entity to inform the individual submitting identity information for authentication certain details with respect to authentication. 104 Chapter IV of the Act deals with UIDAI. Section 11 establishes UIDAI as the body responsible for the processes of enrolment and authentication and for performing functions assigned to it under the Act. The Act provides for the composition of UIDAI170, qualifications of its members171, terms of office172 of its chairperson and members, their removal173 and functions174. Section 23, which deals with the powers and functions of UIDAI, authorizes it to develop the policy, procedure and systems for issuing Aadhaar numbers to individuals 168 Section 2(c) provides: “authentication” means the process by which the Aadhaar number alongwith demographic information or biometric information of an individual is submitted to the Central Identities Data Repository for its verification and such Repository verifies the correctness, or the lack thereof, on the basis of information available with it.
169 Section 2 (u) provides: “requesting entity” means an agency or person that submits the Aadhaar number, and demographic information or biometric information, of an individual to the Central Identities Data Repository for authentication 170 Section 12, Aadhaar Act 171 Section 13, Aadhaar Act 172 Section 14, Aadhaar Act 173 Section 15, Aadhaar Act 174 Section 17, Aadhaar Act 159 PART E and to perform authentication. Section 23(h) states that UIDAI has the power to specify the “manner of use of Aadhaar numbers” for the purposes of providing or availing of various subsidies, benefits, services and “other purposes” for which Aadhaar numbers may be used. Under Section 23(3), UIDAI may enter into a Memorandum of Understanding or agreement with the Central Government or State Governments or Union territories or other agencies for the purpose of performing any of the functions in relation to collecting, storing, securing or processing of information or delivery of Aadhaar numbers to individuals or performing authentication. 105 Chapter V deals with grants, accounts and audit and annual reports of UIDAI. Section 25 provides that the fees or revenue collected by UIDAI shall be credited to the Consolidated Fund of India. Chapter VI deals with protection of information collected from individuals for authentication. Section 28(3) requires UIDAI to take all necessary measures to ensure that the information in its possession or control, including information stored in the CIDR, is secured and protected against access, use or disclosure (not permitted under the Act or the regulations), and against accidental or intentional destruction, loss or damage. Section 29 imposes restrictions on sharing of core biometric information, collected or created under the Act. Section 32(2) entitles every Aadhaar number holder to obtain his or her authentication record in such manner as may be specified by regulations. Section 33 provides for disclosure of information pursuant to a court order or in the interest of national security. 160 PART E 106 Chapter VII of the Act (Sections 34 to 47) provides for offences and penalties. Section 34 provides for penalty for impersonation at the time of enrolment. Section 35 provides a penalty for impersonation of an Aadhaar number holder by changing demographic or biometric information. Under Section 37, a penalty for disclosing identity information (which was collected in the course of enrolment or authentication) is provided. Section 38 provides a penalty for unauthorised access to the CIDR. Section 39 imposes a penalty for tampering with data in the CIDR. Under Sections 40 and 41, a penalty has been provided for requesting entities and enrolment agencies, in case they act in contravention of the obligations imposed upon them under the Act. Section 44 indicates that the provisions of the Act would apply to any offence or contravention committed outside India by any person, irrespective of nationality.
107 Section 48 empowers the Central Government to supersede UIDAI in certain situations. Section 50 states that UIDAI is bound by directions on questions of policy given by the Central Government. Section 51 authorizes the UIDAI to delegate to any member, officer of the Authority or any other person, such of its powers and functions (except the power under section 54) as it may deem necessary. Section 53 empowers the Central Government to make rules to carry out the provisions of the Act. Under Section 54(2)(m), UIDAI can make regulations providing the manner of use of Aadhaar numbers for the purposes of providing or availing of various subsidies, benefits, 161 PART E services and “other purposes” for which Aadhaar numbers may be used. Section 57 authorizes the State or any body corporate or person to use an Aadhaar number for establishing the identity of an individual “for any purpose”, subject to the procedure and obligations under Section 8 and Chapter VI of the Act. Section 59 seeks to validate the actions taken by the Central Government pursuant to the notifications dated 28 January 2009 and 12 September 2015, and prior to the enactment of the Aadhaar Act. This broad description of the provisions of the Aadhaar Act indicates that the Act creates a framework for obtaining a unique identity number - the Aadhaar number - by submitting demographic and biometric information and undergoing the process of enrolment and authentication. The Act indicates that the Aadhaar number may be accepted as proof of identity for any purpose. The Act, in other words, creates a platform for one pan-India and nationally acceptable identity. It creates a central database (CIDR) for storage of identity information collected from individuals. Sections 3 to 6 specifically deal with the process of enrolment. Section 3 entitles every resident to hold an Aadhaar number. Section 4(3) states that the Aadhaar number so generated may be used as a proof of identity “for any purpose”. The primary object of the legislation is to create one national identity for every resident. It seeks to do so by legislating a process for collecting demographic and biometric information. The Act has created an authority to oversee the fulfilment of its provisions. In its primary focus and initiatives, the law traverses 162 PART E beyond the territory reserved by Article 110 for a Money Bill. Sections 7 to 10 deal with authentication of information submitted at the time of enrolment. Section 8 creates obligations on requesting entities to ensure that consent is obtained from individuals before collecting their identity information and that the identity information of such individual is only used for submission to the CIDR for authentication. Sections 11 to 23 create a statutory authority (UIDAI) and assign responsibilities to it for the processes of enrolment and authentication and to discharge other functions assigned to it under the Act, including developing the policy, procedure and systems for issuing Aadhaar numbers to individuals. Section 23(2)(h) provides that apart from availing of various subsidies, benefits, and services, Aadhaar numbers may be used for “other purposes”. Sections 28 to 33 deal with protection of information, and provide for security and confidentiality of identity information and restrictions on sharing of information. Section 28 imposes obligations on the UIDAI to ensure the security and confidentiality of identity information and authentication records of individuals, which are in its possession or control, including information stored in CIDR. Disclosure of identity information and authentication records can be made under Section 33, pursuant to a court order (not below the rank of District Judge) or in the interest of national security in pursuance of a direction of an officer (not below the rank of Joint Secretary to the Government of India). Sections 34 to 47 deal with substantive offences and penalties created under the Act. Sections 54(2)(m) states that regulations can be made by UIDAI specifying the manner of use of Aadhaar 163 PART E numbers for the purposes of providing or availing of various subsidies, benefits, services and “other purposes” for which Aadhaar numbers may be used. Section 57 authorizes the use of Aadhaar number by anyone (whether by the State or any body corporate or person under law or contract) for establishing the identity of an individual “for any purpose”. 108 Section 7 makes the use of the Aadhaar number mandatory for availing subsidies, benefits or services, for which expenditure is incurred from the Consolidated Fund of India. The scheme of the Act deals with several aspects relating to the unique identity number. The unique identity is capable of being used for multiple purposes: availing benefits, subsidies and services, for which expenses are incurred from the Consolidated Fund of India, is just one purpose, among others. The Preamble to the Aadhaar Act indicates that the main objective was to achieve an efficient and “targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India”. The substantive provisions of the Act are, however, not confined to the object specified in the Preamble. Indeed, they travel far beyond the boundaries of a money bill under Article 110(1). The enrolment on the basis of demographic and biometric information, generation of Aadhaar number, obtaining consent of individuals before collecting their individual information, creation of a statutory authority to implement and supervise the process, protection of information collected during the process, disclosure of information in certain circumstances, creation of offences and 164 PART E penalties for disclosure or loss of information, and the use of the Aadhaar number for any purpose lie outside the ambit of Article 110. These themes are also not incidental to any of the matters covered by sub-clauses (a) to (f) of Article 110(1). The provisions of Section 57 which allow the use of an Aadhaar number by bodies corporate or private parties for any purpose do not fall within the ambit of Article 110. The legal framework of the Aadhaar Act creates substantive obligations and liabilities which have the capability of impacting on the fundamental rights of residents. 109 A Bill, to be a Money Bill, must contain only provisions which fall within the ambit of the matters mentioned in Article 110. Section 7 of the Act allows the Aadhaar number to be made mandatory for availing of services, benefits and subsidies for which expenditure is incurred from the Consolidated Fund of India. Under clause (e) of Article 110(1) the money bill must deal with the declaring of any expenditure to be expenditure charged on the Consolidated Fund of India (or increasing the amount of expenditure). Significantly, Section 7 does not declare the expenditure incurred on services, benefits or subsidies to be a charge on the Consolidated Fund of India. What Section 7 does is to enact a provision allowing for Aadhaar to be made mandatory, in the case of services, benefits or subsidies which are charged to the Consolidated Fund. Section 7 does not declare them to be a charge on the Consolidated Fund. It provides that in the case of services, benefits or subsidies which are already charged to the Consolidated Fund, Aadhaar can be made mandatory to avail 165 PART E of them. Section 7, in other words, is a provision for imposing a requirement of authentication and not declaring any expenditure to be a charge on the Consolidated Fund of India. Hence, even Section 7 is not within the ambit of Article 110(1)(e). However, even if Section 7 were to be held to be referable to Article 110, that does not apply to the other provisions of the Act. The other provisions of the Act do not in any event fall within the ambit of Article 110(1). Introducing one provision – Section 7 – does not render the entirety of the Act a Money Bill where its other provisions travel beyond the parameters set out in Article 110. Section 57 of the Act in particular (which creates a platform for the use of the Aadhaar number by the private entities) can by no stretch of logic be covered under Article 110(1). The other provisions of the Act do not deal with that which has been provided under Sub-clauses (a) to (g) of Article 110. As regards the ‘incidental’ provision under Article 110(1)(g), the provisions of the Aadhaar Act are not “incidental to any of the matters specified in sub- clauses (a) to (f)”. Even if it is assumed that there is one provision (Section 7) which is relatable to sub-clause (e) of Article 110(1), the other provisions of the Act are unrelated to Article 110(1).
110 This Court must also advert to the legislative history prior to the enactment of the Aadhaar Act. An attempt to provide a legislative framework governing the Aadhaar project was first made by introducing the National Identification Authority of India Bill, 2010 (“NIA Bill”). The NIA Bill was 166 PART E introduced in the Rajya Sabha on 3 December 2010. The Preamble of the Bill indicated its purpose:
“A Bill to provide for the establishment of the National Identification Authority of India for the purpose of issuing identification numbers to individuals residing in India and to certain other classes of individuals and manner of authentication of such individuals to facilitate access to benefits and services to such individuals to which they are entitled and for matters connected therewith or incidental thereto.” The main objective of the Bill was to establish the National Identification Authority of India to issue unique identification numbers (called ‘Aadhaar’) to residents of India and to any other category of people for the purpose of facilitating access to benefits and services. Chapter II (Clauses 3 to 10) of the Bill dealt with Aadhaar numbers. Clause 3 of the Bill entitled every resident to obtain an Aadhaar number on providing demographic and biometric information to the Authority in such manner as may be specified. Clause 4(3) stated that an Aadhaar number shall be accepted, subject to authentication, as proof of identity of the Aadhaar number holder. Chapter III (Clauses 11 to
23) dealt with the National Identification Authority of India. Clause 11 provided for establishment of the Authority by the Central Government. Clause 23 empowered the Authority to develop the policy, procedure and systems for issuing Aadhaar numbers to residents and to perform authentication. Clause 23(2)(h) stated that the Authority may specify the usage and applicability of the Aadhaar number for delivery of various benefits and services.
Establishing, operating and maintaining of the Central Identities Data Repository (CIDR) by the Authority was provided under Clause 23(2)(j). 167 PART E Chapter IV (Clauses 24 to 27) provide for grants, accounts and audit and annual reports related to the Authority. Clause 25 stated that the fees or revenue collected by the Authority shall be credited to the Consolidated Fund of India and the entire amount would be transferred to the Authority. Chapter V (Clauses 28 and 29) dealt with creation of an Identity Review Committee and its functions. The functions of the Review Committee included ascertaining the extent and pattern of usage of Aadhaar numbers across the country and preparing a report annually along with recommendations. Chapter VI (Clauses 30 to 33) dealt with the protection of individual identity information and authentication records. Clause 30(1) required the Authority to ensure the security and confidentiality of identity information and authentication records of individuals. Clause 30(2) required the Authority to take measures (including security safeguards) to ensure that the information in the possession or control of the Authority (including information stored in the Central Identities Data Repository) is secured and protected against any loss or unauthorised access or use or unauthorised disclosure. Clause 33 stated that individual information may be disclosed pursuant a court order or in the interest of national security. Chapter VII (Clauses 34 to 46) created offences and penalties under the law. Clause 47 empowered the Central Government to supersede the Authority. Clause 50 authorized the Authority to delegate to any Member, officer of the Authority or any other person such of its powers and functions (except the power under Clause 53). Clause 57 sought to validate 168 PART E actions taken by the Central Government under the Planning Commission’s notification of 2009.
111 Since the UID programme involved complex issues, the NIA Bill was referred, on 10 December 2010, to the Standing Committee on Finance, chaired by Mr Yashwant Sinha, for examination and report. The Standing Committee comprised of 21 members from the Lok Sabha and 10 members from the Rajya Sabha. The Standing Committee submitted its Report175 on 11 December 2011. The Report raised several objections to the Bill, which included those summarised below:
(i) Since law making was underway, the bill being pending, any executive action is as violative of Parliament’s prerogatives as promulgation of an ordinance while one of the Houses of Parliament is in session;
(ii) While the country is facing a serious problem of illegal immigrants and infiltration from across the borders, the National Identification Authority of India Bill, 2010 proposes to entitle every resident to obtain an Aadhaar number, apart from entitling such other category of individuals as may be notified from time to time. This will, it is apprehended, make even illegal immigrants entitled for an Aadhaar number;
(iii) The issue of a unique identification number to individuals residing in India and other classes of individuals under the Unique Identification (UID) 175Forty-Second Report, Standing Committee on Finance (2011-12), available at http://www.prsindia.org/uploads/media/UID/uid%20report.pdf 169 PART E Scheme is riddled with serious lacunae and concern areas. For example, the full or near full coverage of marginalized sections for issuing Aadhaar numbers could not be achieved mainly due to two reasons viz. (a) the UIDAI doesn’t have the statistical data relating to them; and (b) estimated failure of biometrics is expected to be as high as 15% because a large chunk of population is dependent on manual labour;
(iv) Despite the presence of serious differences of opinion within the Government on the UID scheme, the scheme continues to be implemented in an overbearing manner without regard to legalities and other social consequences;
(v) The UID scheme lacks clarity on many issues including even the basic purpose of issuing an “Aadhaar” number. Although the scheme claims that obtaining an Aadhaar number is voluntary, an apprehension has developed in the minds of people that in future, services / benefits including food entitlements would be denied in case they do not an have an Aadhaar number;
(vi) It is also not clear as to whether possession of an Aadhaar number would be made mandatory in future for availing of benefits and services. Even if the Aadhaar number links entitlements to targeted beneficiaries, it may not ensure that beneficiaries have been correctly identified. Thus, the present problem of proper identification would persist; 170 PART E
(vii) Though there are significant differences between the identity system of other countries and the UID scheme, yet there are lessons from the global experience to be learnt before proceeding with the implementation of the UID scheme, which the Ministry of Planning has ignored completely;
(viii) Considering the huge database and possibility of misuse of information, the enactment of a national data protection law is a pre-requisite for any law that deals with large scale collection of information from individuals and its linkages across separate databases. In the absence of data protection legislation, it would be difficult to deal with issues like access to and misuse of personal information, surveillance, profiling, linking and matching of data bases and securing confidentiality of information;
(ix) The Standing Committee strongly disapproved of the hasty manner in which the UID scheme was approved. Unlike many other schemes / projects, no comprehensive feasibility study, which ought to have been done before approving such an expensive scheme, was done involving all aspects of the UID scheme including a cost-benefit analysis, comparative costs of Aadhaar numbers and various existing forms of identity, financial implications and prevention of identity theft, for example, using hologram enabled ration cards to eliminate fake and duplicate beneficiaries;
(x) The UID scheme may end up being dependent on private agencies, despite contractual agreements made by the UIDAI with several private 171 PART E vendors. As a result, the beneficiaries may be forced to pay over and above the charges to be prescribed by the UIDAI for availing of benefits and services, which are now available free of cost;
(xi) The scheme is full of uncertainty in technology as a complex scheme is built up on untested and unreliable technology and on several assumptions. It is also not known as to whether the proof of concept studies and assessment studies undertaken by the UIDAI have explored the possibilities of maintaining accuracy to a large level of enrolment of 1.2 billion people; and
(xii) The Committee felt that entrusting the responsibility of verification of information of individuals to the registrars to ensure that only genuine residents get enrolled into the system may have far reaching consequences for national security. Given the limitation of any mechanism such as a security audit by an appropriate agency that would be set up for verifying the information, it is not evident as to whether a complete verification of information of all Aadhaar number holders is practically feasible; and whether it would deliver the intended results without compromising national security.
With these apprehensions about the UID scheme, the Standing Committee on Finance categorically conveyed that the National Identification Authority of India Bill, 2010 was not acceptable. The Committee urged the Government to 172 PART E reconsider and review the UID scheme and the proposals contained in the Bill and bring forth a fresh legislation before Parliament. Ultimately, the NIA Bill was withdrawn from the Rajya Sabha on 3 March, 2016. 112 A comparison of the Aadhaar Act 2016 and NIA Bill 2010 reveals that both have a common objective and framework − establishing a system of unique identity numbers, which would be implemented and monitored by a statutory authority. The NIA Bill was not a Money Bill. It was never passed by the Rajya Sabha. The Bill was scrutinized by a Standing Committee on Finance, which had 10 members from the Rajya Sabha and 21 from the Lok Sabha. The NIA Bill did not contain a provision, similar to Section 7 of the Aadhaar Act. Yet, as discussed earlier, the presence of Section 7 does not make the Aadhaar Act a Money Bill. Introducing the Aadhaar Act as a Money Bill deprived the Rajya Sabha of its power to reject or amend the Bill. Since the Aadhaar Act in its current form was introduced as a Money Bill in the Lok Sabha, the Rajya Sabha had no option other than of making recommendations to the Bill. The recommendations made by the Rajya Sabha (which also included deletion of Section 57) were rejected by the Lok Sabha. The legislative history is a clear pointer to the fact that the subsequent passage of the Bill as a Money Bill by-passed the constitutional authority of the Rajya Sabha. The Rajya Sabha was deprived of its legitimate constitutional role by the passage of the Bill as a Money Bill in the Lok Sabha. 173 PART E 113 The Court must also address the contention of the Respondents that the Aadhaar Act is “in pith and substance” a Money Bill. The learned Attorney General for India has submitted that though the Act has ancillary provisions, its main objective is the delivery of subsidies, benefits and services flowing out of the Consolidated Fund of India and that the other provisions are related to the main purpose of the Act which was giving subsidies and benefits. It has been submitted that the real test to be applied in the present dispute is the doctrine of pith and substance.
114 This Court has applied the doctrine of pith and substance when the legislative competence of a legislature to enact a law is challenged. The doctrine is applied to evaluate whether an enactment which is challenged falls within an entry in one of the three Lists in the Seventh Schedule over which the legislature has competence under Article 246 of the Constitution. The Seventh Schedule to the Constitution distributes legislative powers between the Union and the States. When a law enacted by a legislature is challenged on the ground of a lack of legislative competence, the doctrine of pith and substance is invoked. Under the doctrine, the law will be valid if in substance, it falls within the ambit of a legislative entry on which the legislature is competent to enact a law, even if it incidentally trenches on a legislative entry in a separate list. The constitutional rationale for the application of this 174 PART E doctrine has been explained in a Constitution Bench decision of this Court in A S Krishna v State of Madras176:
“8…But then, it must be remembered that we are construing a federal Constitution. It is of the essence of such a Constitution that there should be a distribution of the legislative powers of the Federation between the Centre and the Provinces. The scheme of distribution has varied with different Constitutions, but even when the Constitution enumerates elaborately the topics on which the Centre and the States could legislate, some overlapping of the fields of legislation is inevitable. The British North America Act, 1867, which established a federal Constitution for Canada, enumerated in Sections 91 and 92 the topics on which the Dominion and the Provinces could respectively legislate.
Notwithstanding that the lists were framed so as to be fairly full and comprehensive, it was not long before it was found that the topics enumerated in the two sections overlapped, and the Privy Council had time and again to pass on the constitutionality of laws made by the Dominion and Provincial legislatures. It was in this situation that the Privy Council evolved the doctrine, that for deciding whether an impugned legislation was intra vires, regard must be had to its pith and substance. That is to say, if a statute is found in substance to relate to a topic within the competence of the legislature, it should be held to be intra vires, even though it might incidentally trench on topics not within its legislative competence...” (Emphasis supplied) The decision of a three judge Bench of this Court in State of Maharashtra v Bharat Shanti Lal Shah177 has summarized the process of reasoning which must be followed by the Court while applying the doctrine of pith and substance. The Court held:
“43…If there is a challenge to the legislative competence the courts will try to ascertain the pith and substance of such enactment on a scrutiny of the Act in question. In this process, it is necessary for the courts to go into and examine the true character of the enactment, its object, its scope and effect to find out whether the enactment in 176 1957 SCR 399 177(2008) 13 SCC 5 175 PART E question is genuinely referable to the field of legislation allotted to the respective Legislature under the constitutional scheme. Where a challenge is made to the constitutional validity of a particular State Act with reference to a subject mentioned in any entry in List I, the court has to look to the substance of the State Act and on such analysis and examination, if it is found that in the pith and substance, it falls under an entry in the State List but there is only an incidental encroachment on topics in the Union List, the State Act would not become invalid merely because there is incidental encroachment on any of the topics in the Union List.”178 (Emphasis supplied ) 115 The doctrine of pith and substance is mainly used to examine whether the legislature has the competence to enact a law with regard to any of the three Lists provided under the Constitution. It cannot be applied to sustain as a Money Bill, a Bill which travels beyond the constitutional boundaries set out by Article 110 Whether a Bill is validly passed as a Money Bill has nothing to do with the legislative competence of the legislature under Article 246 of the Constitution. Whether a Bill is a Money Bill has to be tested within the boundaries of Article 110. The submission of the Attorney General boils down to this: ‘ignore the expression “only provisions dealing with all or any of the following matters” and hold the Bill to be a Money Bill by treating Section 7 as its dominant provision’. This cannot be accepted. This would ignore the express and clear language of Article 110. As we have emphasised earlier, the submission of the Attorney General requires the court to transpose the word “only” from its present position to a place before “if”. That would be to rewrite the Constitution to mean that a Bill would be a Money Bill if it contained some provisions which fall under sub-clauses (a) to (g). The 178 Ibid, at page 21 176 PART E Constitution says to the contrary: a Bill is a Money Bill if it contains “only provisions” dealing with one or more of the matters set out in sub-clauses (a) to (g). Looked at in another way, all the provisions of the Aadhaar Act (apart from Section 7) cannot be read as incidental to Section 7. Such a view is belied by a plain reading of the Act, as indicated earlier. Moreover, we have also indicated reasons why even Section 7 cannot be held to be referable to Article 110. Section 7 does not deal with the declaring of any expenditure as expenditure charged to the Consolidated Fund. Section 7 allows for making Aadhaar mandatory for availing of subsidies, benefits or services the expenditure incurred on which is charged to the Consolidate Fund. Section 7 does not charge any expenditure to the Consolidated Fund. It deals with making Aadhaar mandatory.
In support of their contention, the Respondents have also relied upon a two judge Bench decision in Union of India v Shah Goverdhan L Kabra Teachers’ College179 to submit that the doctrine of pith and substance can be used in any context. The Court held:
“7. It is further a well-settled principle that entries in the different lists should be read together without giving a narrow meaning to any of them. Power of the Parliament as well as the State legislature are expressed in precise and definite terms. While an entry is to be given its widest meaning but it cannot be so interpreted as to over-ride another entry or make another entry meaningless and in case of an apparent conflict between different entries, it is the duty of the court to reconcile them. When it appears to the Court that there is apparent overlapping between the two entries the doctrine of "pith and substance" has to be applied to find out the true nature of a legislation and the entry with which it would fall. In 179 (2002) 8 SCC 228 177 PART E case of conflict between entries in List I and List II, the same has to be decided by application of the principle of "pith and substance". The doctrine of "pith and substance" means that if an enactment substantially falls within the powers expressly conferred by the Constitution upon the legislature which enacted it, it cannot be held to be invalid, merely because it incidentally encroaches on matters assigned to another legislature. When a law is impugned as being ultra-vires of the legislative competence, what is required to be ascertained is the true character of the legislation. If on such an examination it is found that the legislation is in substance one on a matter assigned to the legislature then it must be held to be valid in its entirety even though it might incidentally trench on matters which are beyond its competence. In order to examine the true character of the enactment, the entire Act, its object and scope and effect, is required to be gone into. The question of invasion into the territory of another legislation is to be determined not by degree but by substance. The doctrine of "pith and substance' has to be applied not only in cases of conflict between the powers of two legislatures but in any case where the question arises whether a legislation is covered by particular legislative power in exercise of which it is purported to be made.”180 (Emphasis supplied) The decision is of no assistance to the submission in the present dispute. The observations made by the Court are in relation to the power to legislate under Article 246 of the Constitution. It is unconnected to the question of a Money Bill. Therefore, the argument that the Aadhaar Act is “in pith and substance” a Money Bill is rejected.
116 Introducing the Aadhaar Act as a Money Bill has bypassed the constitutional authority of the Rajya Sabha. The passage of the Aadhaar Act as a Money Bill is an abuse of the constitutional process. It deprived the Rajya Sabha from altering the provisions of the Bill by carrying out amendments. On the touchstone of the provisions of Article 110, the Bill could not have been 180 Ibid, at pages 233-234 178 PART E certified as a Money Bill. In his last address to the Constituent Assembly on 25 November 1949, Dr B R Ambedkar had stated:
“The working of a Constitution does not depend wholly upon the nature of the Constitution. The Constitution can provide only the organs of State such as the Legislature, the Executive and the Judiciary. The factors on which the working of those organs of the State depends are the people and the political parties they will set up as their instruments to carry out their wishes and their politics.”181 117 The Rajya Sabha has an important role in the making of laws.
Superseding the authority of the Rajya Sabha is in conflict with the constitutional scheme and the legitimacy of democratic institutions. It constitutes a fraud on the Constitution. Passing of a Bill as a Money Bill, when it does not qualify for it, damages the delicate balance of bicameralism which is a part of the basic structure of the Constitution. The ruling party in power may not command a majority in the Rajya Sabha. But the legislative role of that legislative body cannot be obviated by legislating a Bill which is not a Money Bill as a Money Bill. That would constitute a subterfuge, something which a constitutional court cannot countenance. Differences in a democratic polity have to be resolved by dialogue and accommodation. Differences with another constitutional institution cannot be resolved by the simple expedient of ignoring it. It may be politically expedient to do so. But it is constitutionally impermissible. This debasement of a democratic institution cannot be allowed to pass. Institutions are crucial to democracy. Debasing them can only cause a peril to democratic structures.
181 Constituent Assembly (25 November 1949) 179 PART F The Act thus fails to qualify as a Money Bill under Article 110 of the Constitution. Since the Act was passed as a Money Bill, even though it does not qualify to be so, the passage of the Act is an illegality. The Aadhaar Act is in violation of Article 110 and therefore is liable to be declared unconstitutional.
F Biometrics, Privacy and Aadhaar “Any situation that allows an interaction between man and machine is capable of incorporating biometrics”182 118 The term ‘biometric’ is derived from the Greek nouns ‘βίος’ (life) and ‘μέτρον’ (measure) and means ‘measurement of living species’. 183 Biometric technologies imply that “unique or distinctive human characteristics of a person are collected, measured and stored for the automated verification of a claim made by that person for the identification of that person.”184 These systems thus identify or verify the identity or a claim of persons on the basis of the automated measurement and analysis of their biological traits (such as fingerprints, face and iris) or behavioral characteristics (such as signature and voice).
182 Gary Roethenbaugh, (cited in A. Cavoukian, Privacy and Biometrics, Information and Privacy Commissioner, Ontario, Canada, 1999, page 11, available at http://www.ipc.on.ca/images/Resources/pri- biom.pdf 183 Els J. Kindt, Privacy and Data Protection Issues of Biometric Applications: A Comparative Legal Analysis, Springer (2013) 184 Ibid.
180 PART F 119 The idea that parts of our body can be used to identify our unique selves is not new. Prints of hand, foot and finger have been used since ancient times because of their unique characteristics. Before the advent of biometric systems, however, human characteristics were compared in a manual way. Today’s biometric systems hence differ from manual verification methods in that technology allows for automated comparison of human characteristic(s) in place of a regime of manual verification that existed earlier. It must be understood that biometric systems themselves do not identify individuals. For identification, additional information which is already stored in databases is needed since biometric systems can only compare information which is already submitted.185 Integral to such a system is the matching of a claim of identity with biometric data collected and stored earlier. In general, biometric applications are referred to as systems which allow one to authenticate claims. The verb ‘to authenticate’ can be described as ‘making authentic, legally valid’.186 Originally, fingerprints were the most commonly known and used biometric traits, but with improvements in technology, multiple sources of biometric information have emerged. These include data related to facial features, iris, voice, hand geometry and DNA. Each trait is collected using different technologies and can be used for different purposes 185 Ibid.
186 Ibid.
181 PART F separately or in combination, to strengthen and improve the accuracy and reliability of the identification process.187 In general, biometric information is developed by processing extractable key features of an individual into an ‘electronic digital template’, which is then encrypted and stored in a database. When an individual connects with the system to verify his/her identity for any purpose, the information is used by matching the ‘electronic digital template’ saved with the biometric information presented, based on which comparison, the individual’s identity will be confirmed or rejected. The intended purpose of biometric technology is to confirm the identity of individuals through a “one to one” identification check. This system compares a source of biometric data with existing data for that specific person.
F.I Increased use of biometric technology 120 There had been an initial increase in the usage of biometric technology in both developed and developing countries by both the private and the public sector. However, despite the increased adoption of biometric technologies by developed countries in the 1980s and 1990s, recent trends depict their reluctance to deploy biometric technology - or at least mass storage of biometric data - because of privacy concerns.188 Key instances included the 187Nancy Yue Liu, Bio-Privacy: Privacy Regulations and the Challenge of Biometrics, Routledge (2013). 188Privacy International, Biometrics: Friend or foe of privacy?, available at https://privacyinternational.org/sites/default/files/2017-11/Biometrics_Friend_or_foe.pdf 182 PART F scrapping of the National Identity Register and ID cards in the UK, and Germany’s decision to reject a centralised database when deploying biometric passports.189 By contrast, in developing countries there is a rise in the deployment of biometric technology since it is being portrayed to citizens as a means to establishing their legal identity and providing them access to services, as well as a tool for achieving economic development. However, too often these goals are prioritised at the expense of their right to privacy and other human rights.190 Simon Davies, an eminent privacy expert, points out that it is not an accident or coincidence that biometric systems are most aggressively tried out with welfare recipients since they are not in a position to resist the State-mandated intrusion.191 There has been a particular increase in the use of biometric technology in identification programs in developing countries. This is because “biometrics include a wide range of biological measures which are considered sufficiently unique at a population level to allow individual identification with high rates of accuracy”.192 Lack of formal identification and official identity documentation in the developing world is a serious challenge which impedes the ability of governments as well as development organisations to provide essential goods and services to the populations they serve.193 Further, identification is also 189 Ibid 190 Ibid 191 Simon Davies, as cited in John D. Woodward, Biometric Scanning, Law & Policy: Identifying the Concerns -
Drafting the Biometric Blueprint, University of Pittsburgh Law Review, (1997) 192 Daniel M. L Storisteanu, Toby L. Norman, Alexandra Grigore and Alain B. Labrique, Can biometrics beat the developing world’s challenges?, Biometric Technology Today (2016) 193 Ibid 183 PART F essential to the gathering of accurate data which is required for monitoring the progress of government programmes.194 However, while biometric technology brings many advantages, the flip side is that the same technology can also lead to human rights violations:
“When adopted in the absence of strong legal frameworks and strict safeguards, biometric technologies pose grave threats to privacy and personal security, as their application can be broadened to facilitate discrimination, profiling and mass surveillance. The varying accuracy and failure rates of the technology can lead to misidentification, fraud and civic exclusion.”195 121 The adoption of biometric technologies in developing countries in particular poses unique challenges since the implementation of new technologies in these countries is rarely preceded by the enactment of robust legal frameworks. Assessments of countries where a legal mechanism to regulate new technologies or protect data has followed as an afterthought have shown that there exists a huge risk of mass human rights violations where individuals are denied basic fundamental rights, and in extreme cases, even their identity.196 122 Technology today brings with it tremendous power and is much like two sides of a coin. When applied productively, it allows individuals around the world to access information, express themselves and participate in local and global discussions in real-time in ways previously thought unimaginable. The 194 Ibid 195 Privacy International, Biometrics, available at https://privacyinternational.org/topics/biometrics 196 Privacy International, Biometrics: Friend or foe of privacy?, available at https://privacyinternational.org/sites/default/files/2017-11/Biometrics_Friend_or_foe.pdf 184 PART F flip side is the concern over the abuse of new technology, including biometrics, by the State and private entities by actions such as surveillance and large-scale profiling. This is particularly acute, given the fact that technological advancements have far outpaced legislative change. As a consequence, the safeguards necessary to ensure protection of human rights and data protection are often missing. The lack of regulatory frameworks, or the inadequacy of existing frameworks, has societal and ethical consequences and poses a constant risk that the concepts of privacy, liberty and other fundamental freedoms will be misunderstood, eroded or devalued.197 123 Privacy has been recognized as a fundamental human right in various national constitutions and numerous global and regional human rights treaties.
In today’s digital age, the right to privacy is “the cornerstone that safeguards who we are and supports our on-going struggle to maintain our autonomy and self-determination in the face of increasing state power.”198 124 The proliferation of biometric technology has facilitated the invasion of individual privacy at an unprecedented scale. The raw information at the heart of biometrics is personal by its very nature.199 The Aadhaar Act recognises this as sensitive personal information. Biometric technology is unique in the sense that it uses part of the human body or behaviour as the basis of authentication or identification and is therefore intimately connected to the 197 Ibid 198 Privacy International, Biometrics: Friend or foe of privacy?, available at https://privacyinternational.org/sites/default/files/2017-11/Biometrics_Friend_or_foe.pdf 199 Nancy Yue Liu, Bio-Privacy: Privacy Regulations and the Challenge of Biometrics, Routledge (2013) 185 PART F individual concerned. While biometric technology raises some of the same issues that arise when government agencies or private firms collect any personal information about citizens, there are specific features that distinguish biometric data from other personal data, making concerns about biometric technology of particular importance with regard to privacy protection.200 125 There are two main groups of privacy- related interests that are directly pertinent to the contemporary discussion on the ethical and legal implications of biometrics.201 The first group falls under ‘informational privacy’ and is concerned with control of personal information. The ability to control personal information about oneself is closely related to the dignity of the individual, self- respect and sense of personhood. The second interest group falls under the rubric of ‘physical privacy’. This sense of privacy transcends the purely physical and is aimed essentially at protecting the dignity of the human person. It is a safeguard against intrusions into persons’ physical bodies and spaces. Another issue is of property rights with respect to privacy, which concerns the appropriation and ownership of interests in human personality. In many jurisdictions, the basis of informational privacy is the notion that all information about an individual is in some fundamental way their own property, and it is theirs to communicate or retain as they deem fit. 200 Ibid 201 Ibid 186 PART F 126 The collection of most forms of biometric data requires some infringement of the data subject’s personal space. Iris and fingerprint scanners require close proximity of biometric sensors to body parts such as eyes, hands and fingertips.
Even in the context of law enforcement and forensic identification, the use of fingerprinting is acknowledged to jeopardise physical privacy. Many countries have laws and regulations which are intended to regulate such measures, in order to protect the individual’s rights against infringement by state powers and law enforcement. However, biometrics for the purpose of authentication and identification is different as they do not have a specific goal of finding traces related to a crime but are instead conducted for the purpose of generating identity information specific to an individual. This difference in purpose actually renders the collection of physical biometrics a more serious breach of integrity and privacy. It indicates that there may be a presumption that someone is guilty until proven innocent. This would be contrary to generally accepted legal doctrine that a person is innocent until proven guilty and will bring a lot of innocent people into surveillance schemes. 127 Concerns about physical privacy usually take a backseat as compared to concerns about informational privacy. The reason for this is that physical intrusion resulting from the use of biometric technology usually results from the collection of physical information. However, for some people of specific 187 PART F cultural or religious backgrounds, even the mental harm resulting from physical intrusion maybe quite serious.202 Another concern is that the widespread usage of biometrics substantially undermines the right to remain anonymous.203 People desire anonymity for a variety of reasons, including that it is fundamental to their sense of freedom and autonomy. Anonymity may turn out to be the only tool available for ordinary people to defend themselves against being profiled. Thus, it is often argued that biometric technology should not be the appropriate choice of technology as biometrics by its very nature is inconsistent with anonymity. Given the manner in which personal information can be linked and identified using biometric data, the ability to remain anonymous is severely diminished. While some argue that “it is not obvious that more anonymity will be lost when biometrics are used”, this argument may have to be evaluated in light of the fact that there is no existing identifier that can be readily equated with biometrics.204 No existing identifier can expose as much information as biometric data nor is there any other identifier that is supposed to be so universal, long-lasting and intimately linked as biometrics. To say that the use of biometrics will not cause further loss of anonymity may thus be overly optimistic. Semi-anonymity maybe possible, provided that the biometric system is carefully designed from the inception. 202 Nancy Yue Liu, Bio-Privacy: Privacy Regulations and the Challenge of Biometrics, Routledge (2013). 203 Ibid 204 Ibid 188 PART F Another significant change brought about by biometric technology is the precipitous decline of ‘privacy by obscurity’, which is essentially “a form of privacy afforded to individuals inadvertently by the inefficiencies of paper and 205 other legacy recordkeeping.” Now that paper records worldwide are giving way to more efficient digital record-keeping and identification, this form of privacy is being extinguished, and sometimes without commensurate data privacy protections put in place to remedy the effects of the changes.”206 128 Biometrically enhanced identity information, combined with demographic data such as address, age and gender, among other data, when used in increasingly large, automated systems creates profound changes in societies, particularly in regard to data protection, privacy, and security. Biometrics are at the very heart of identification systems. There are numerous instances in history where the persecution of groups of civilians on the basis of race, ethnicity and religion was facilitated through the use of identification systems. There is hence an alarming need to ensure that the on-going development of identification systems be carefully monitored, while taking into account lessons learnt from history.
129 It is important to justify the usage of biometric technology given the invasion of privacy. When the purpose of collecting the biometric data is just for authentication and there is little or no benefit in having stronger user 205 Pam Dixon, A Failure to Do No Harm – India’s Aadhaar biometric ID program and its inability to protect privacy in relation to measures in Europe and the U.S., Health and Technology (2017), Vol. 7, at pages 539– 567 206 Ibid.
189 PART F identification, it is difficult to justify the collection of biometric information. The potential fear is that there are situations where there are few or no benefits to be gained from strong user verification / identification and this is where biometric technology may be unnecessary.207 (Example: When ascertaining whether an individual is old enough to go to a bar and drink alcohol, it is unnecessary to know who the person is, when all that is needed to be demonstrated is that the individual is of legal age). Fundamental rights are likely to be violated in case biometrics are used for applications merely requiring a low level of security.
130 Biometric data, by its very nature, is intrinsically linked to characteristics that make us ‘humans’ and its broad scope brings together a variety of personal elements. It is argued that the collection, analysis and storage of such innate data is dehumanising as it reduces the individual to but a number. Ultimately, organisations and governmental agencies must demonstrate that there is a compelling legitimate interest in using biometric technology and that an obligatory fingerprint requirement is reasonably related to the objective for which it is required. One way of avoiding unnecessary collection of biometric data is to set strict legal standards to ensure that the intrusion into privacy is commensurate with and proportional to the need for the collection of bio- metric data.208 207 Nancy Yue Liu, Bio-Privacy: Privacy Regulations and the Challenge of Biometrics, Routledge (2013). 208 Ibid 190 PART F F.2 Consent in the collection of biometric data 131 Rules on the collection of physical data by government agencies usually specify under what conditions a person can be required to provide fingerprints and/or bodily tissues. If consent is required, rules are in place to regulate the scope of consent. If forced searches are allowed, specifications are usually provided as to how and by whom the search will be performed. Therefore, the legal questions surrounding the issue should be:
(a) If required, what exactly should be the extent of coverage of the consent?
(b) When is the compulsory collection of biometric information required and who is eligible to conduct it?
(c) What is the procedure to do so?
(d)What exactly should be filed and stored? 132 Biometric technology is far from being a mature technology and a variety of errors inevitably occur. Mature technology is a popular term for any technology for which any improvements in deployment are evolutionary rather than revolutionary.209 Once a biometric system is compromised, it is compromised forever. In the event of biometric identity theft, there would appear to be no alternative but to withdraw the user from the system. Passwords and numbers can be changed, but how does one change the basic biological features that compromise biometrics in the event that there is a theft?
209 Segen’s Medical Dictionary, 2012.
191 PART F All of these parameters need to be applied to test the validity of the Aadhaar legislation in a two-part inquiry: First, reports and steps taken by the Government of India that guided the introduction and role of biometrics before the enactment of the Aadhaar Act will be analysed, which will be followed by an analysis of relevant provisions concerning the intersection of biometric technology and privacy, as they are enshrined in the Aadhaar Act, 2016 and supporting Regulations made under it.
F.3 Position before the Aadhaar legislation Summary of Pre-Enactment Events 133 On 3 March 2006, the Department of Information Technology, Ministry of Communications & Information Technology, gave its approval for implementation of the project ‘Unique ID for Below Poverty Line Families’ (BPL) by the National Informatics Centre over a period of 12 months.210 This was followed by a Processes Committee being set up a few months later on 3 July 2006, to suggest the processes for updation, modification, addition and deletion of data from the core database to be created under the Unique ID (“UID”) for BPL Families Project.211 The Processes Committee prepared a 210 Ministry of Communication & Information Technology, Department of Information Technology, Administrative Approval for the project - “Unique ID for BPL families”, dated March 03, 2006 (Annexure R-1, List of Pre- enactment dates and events for the Aadhaar project submitted by the Learned AG). 211 Department of Information Technology, Notification: Setting up of a Process Committee to suggest the processes for updation, modification, addition & deletion of data and fields from the core database to be created under the Unique ID for BPL families project, dated July 03, 2006 (Annexure R-2, List of Pre- enactment dates and events for the Aadhaar project submitted by the learned AG). 192 PART F paper titled ‘Strategic Vision: Unique Identification of Residents’212. The paper recommended the linkage of the UID database with other databases which would ensure continuous updation and user-based validation and use of the Election Commission’s database as the base database.213 The document inter-alia, also stated that statutory backing would be required for adoption of UID in the long term;214 focus and conviction would be required on security and privacy to ensure adoption by different stakeholders; 215 while ‘transparency vs. right to privacy’ was another challenge that would have to be addressed.216 Biometrics, however, found no mention in the paper at this stage.
Thereafter, on 4 December 2006, an Empowered Group of Ministers (“EGoM”), was constituted with the approval of the Prime Minister to collate the National Population Register (“NPR”) under the Citizenship Act 1955 and the Unique Identification Number Project.217 In its meeting held on 27 April 2007, the Processes Committee decided that the UID database would evolve in three stages: initial, intermediate and final. Biometrics was mentioned for the first time in the context of UID, when the committee agreed that if the infrastructure was available and the photograph and/or biometrics of a 212 Strategic Vision: Unique Identification of Residents, dated 26 November 2006 (Annexure R-3, List of Pre-
enactment dates and events for the Aadhaar project submitted by the learned AG).
213 Ibid 214 Ibid 215 Ibid 216 Ibid
217 Constitution of an Empowered Group of Ministers to collate two schemes - the National Population Register under the Citizenship Act, 1955 and the Unique Identification Number (UID) project of the Department of Information Technology (Annexure R-4, List of Pre-enactment dates and events for the Aadhaar project submitted by the learned AG).193
PART F resident was obtainable along with other information, it would be captured in the initial and intermediate stages as well.218 Subsequently, the EGoM approved the establishment of a UID Authority under the Planning Commission on 28 January 2008.219 while the strategy to collate NPR and UID was also approved. The EGoM also agreed that the collection of data under the NPR exercise could include collection of photographs and biometrics to the extent feasible, while it was also resolved that the data collected under the NPR would be handed over to the UID Authority for maintenance and updation. The EGoM, in its fourth meeting dated 4 November 2008 decided that initially, the UIDAI will be established as an executive body under the Planning Commission for a period of 5 years. UIDAI, it was envisaged, will create its database from the electoral roll of the ECI and verify it through Below Poverty Line and Public Distribution System data, but it would also have the authority to take its own decisions as to how a database should be built.220 Consequently, the Government of India issued a notification on 28 January 2009 constituting the UIDAI as an attached office and executive authority under the aegis of the Planning Commission. 218 Planning Commission, No. 4(4)/56/2005- C&I, Minutes of the Fifth Meeting of the Unique ID project under the Chairmanship of Dr. Arvind Virmani (Annexure R-6, List of Pre-enactment dates and events for the Aadhaar project submitted by the learned AG).
219 Minutes of the Second Meeting of the EGoM to collate two schemes - The National Population Register under the Citizenship Act, 1955 and the Unique Identification number (UID) project of the Department of Information Technology (Annexure R-10, List of Pre-enactment dates and events for the Aadhaar project submitted by the learned AG).
220 Minutes of the Fourth Meeting of the EGoM to collate two schemes - The National Population Register under the Citizenship Act, 1955 and the Unique Identification Number (UID) project of the Department of Information Technology (Annexure R-12, List of Pre-enactment dates and events for the Aadhaar project submitted by the learned AG).
194 PART F 134 Following the constitution of UIDAI, the Secretary, Planning Commission addressed a letter to Chief Secretaries of all States/ UTs on 6 May 2009 enclosing a brief write up on UIDAI and UID numbers for resident Indians. The letter included the concept, implementation strategy, model of the project along with the role and responsibilities of the states/ UTs.221 It was also decided that partner databases for two-way linkages between the UID database and the partner databases for maintenance and continuous updation of the UID databases would be ECI database, Ministry of Rural Development- rural household survey database and the State ration card (PDS) databases. 135 The first meeting of the PM’s Council of UIDAI, was held on 12 August 2009. Various proposals were approved by the Council,222 by which it was decided, among other things, that the proposal to designate UIDAI as an apex body to set standards in the area of biometrics and demographic data structures be approved. On 29 September 2009, UIDAI set up the Biometrics Standards Committee (“BSC”) to frame biometric standards for UIDAI. The Committee was assigned with the following mandate:223 ● To develop biometric standards that will ensure interoperability of devices, systems and processes used by various agencies that use the UID system. 221 Secretary, Government of India, Planning Commission, D.O. No. A-11016/02/09-UIDAI (Annexure R-22, List of Pre-enactment dates and events for the Aadhaar project submitted by the learned AG). 222 Planning Commission, Minutes of the meeting of the PM’s Council of UIDAI (Annexure R-35, List of Pre-
enactment dates and events for the Aadhaar project submitted by the Learned AG). 223 Planning Commission, UIDAI, Office Memorandum, available at https://www.uidai.gov.in/images/resource/Biometric_Standards_Committee_Notification.pdf. 195 PART F ● To review the existing standards of Biometrics and, if required, modify/extend/enhance them so as to serve the specific requirements of UIDAI relating to de-duplication and Authentication. This was followed by the creation of the Demographic Data Standards and Verification Procedure Committee (“DDSVPC”) on 9 October 2009, with the following mandate:224 ● Review/ modify/ extend/ enhance the existing standards of Demographic data and recommend the Demographic Data standards (The data fields and their formats/structure, etc.) that will ensure interoperability and standardization of basic demographic data and their structure used by various agencies that use the UID system; and ● Recommend the Process of Verification of this demographic data in order to ensure that the data captured, at the time of enrolment of the residents into the UID system, is correct.
136 The DDSVPC in its report dated 9 December 2009, stated that UIDAI had selected biometrics features as the primary method to check for duplicate identity. In order to ensure that an individual was uniquely identified in an easy and cost-effective manner, it was necessary to ensure that the captured biometric information was capable of carrying out de-duplication at the time when information was collected.225 The Know Your Resident (“KYR”) 224 DDSVPC (UIDAI), DDSVPC Report, dated 09 December 2009, available at https://uidai.gov.in/images/UID_DDSVP_Committee_Report_v1.0.pdf ,at pages 5-6. 225 Ibid, at page 4 196 PART F verification procedure was introduced to ensure that “key demographic data is verified properly so that the data within UID system can be used for authentication of identity by various systems”. Three distinct methods of verification were to be acceptable under UID. Verification could be based on ● Supporting documents;
● An introducer system under which a network of “approved” introducers can introduce a resident and vouch for the validity of the resident’s information; and (This idea was borrowed from the account opening procedure in the banks.) ● The process adopted for public scrutiny in the National Population Register.
137 In order to verify the correctness of certain mandatory fields, such as name, date-of-birth, and address, a “Proof of Identity” (PoI) and “Proof of Address” (PoA) would be required. This would comprise of documents containing the resident’s name and photograph and the name and address, respectively. On 9 April 2010, the collection of iris biometrics for the NPR exercise was approved.226 138 A strategy overview issued by UIDAI in April 2010 described the features, benefits, revenue model and timelines of the project.227 The survey 226 Annexure R-43, Volume II, List of Pre-enactment dates and events for the Aadhaar project, Submissions by the AG 227 UIDAI, UIDAI Strategy Overview, available at http://www.prsindia.org/uploads/media/UID/UIDAI%20STRATEGY%20OVERVIEW.pdf. 197 PART F outlined that UIDAI would collect the following demographic and biometric information from residents in order to issue a UID number: ● Name ● Date of birth ● Gender ● Father's/ Husband's/ Guardian's name and UID number (optional for adult residents) ● Mother's/ Wife's/ Guardian's name and UID number (optional for adult residents) ● Introducer's name and UID number ( in case of lack of documents) ● Address ● All ten fingerprints, photograph and both iris scans On 12 May 2010, a note outlining the background of UIDAI, and proposing an approach for collection of demographic and biometric attributes of residents for the UID project was submitted to the Cabinet Committee on UIDAI. 228 Permission of the Union Cabinet was sought to ensure that the approach which was proposed should be adhered to by the Registrar General of India for the NPR exercise and by all other Registrars in the UID system. The rationale behind the inclusion of iris biometrics and the need for capturing iris scans at the time of capturing biometric details was also explained. This was followed by the introduction of the National Identification Authority of India Bill, 2010 (NIAI Bill) in the Rajya Sabha on 3 December 2010. On 13 February 2011, the one millionth Aadhaar card was delivered. Thereafter, on 228Annexure R-46, Volume II, List of Pre-enactment dates and events for the Aadhaar project, Submissions by the AG 198 PART F 11 April 2011, the Central Government notified the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 [“IT Rules”] under Section 43A of the IT Act, 2000. On 29 September 2011, the Aadhaar project completed one year. An announcement was made of the generation of ten crore enrolments and of more than 3.75 crore Aadhaar numbers.
Analysis of UIDAI Reports & Rights of Registrars A. Biometrics Standards Committee (BSC) Report 139 BSC in its report dated 30 December 2009 stated that it held extensive meetings and discussions with international experts and technology suppliers. A technical sub-group was formed to collect Indian fingerprints and analyze quality. Over 2,50,000 fingerprint images from 25,000 persons were sourced from the districts of Delhi, UP, Bihar and Orissa. Nearly all the images were from rural regions, and were collected by different agencies using different capture devices, and through different operational processes. The BSC report is silent about the pretext on which fingerprints of 25,000 people were collected. This action of UIDAI raises privacy concerns especially since the fingerprints were collected from rural regions where people may not have been aware or made aware by UIDAI before collection of fingerprints, of the possible privacy harms of giving up biometrics. 199 PART F BSC after reviewing international standards and current national recommendations, concluded that a fingerprints-based biometric system was to be at the core of UIDAI’s de-duplication efforts and that the ISO 19794 series of biometrics standards for fingerprints, face and iris set by the International Standards Organization (ISO) were most suitable for the UID project.229 BSC also observed that while a fingerprints-based biometric system shall be at the core of UIDAI’s de-duplication efforts, its accuracy in the Indian context could not predicted in the absence of empirical data:
“The Committee notes that face is the most commonly captured biometric, and frequently used in manual checking. However, stand-alone, automatic face recognition does not provide a high level of accuracy, and can only be used to supplement a primary biometric modality. Fingerprinting, the oldest biometric technology, has the largest market share of all biometrics modalities globally. … Based on these factors, the Committee recognizes that a fingerprints-based biometrics system shall be at the core of the UIDAI’s de-
duplication efforts… The Committee, however, is also conscious of the fact that de-duplication of the magnitude required by the UIDAI has never been implemented in the world. In the global context, a de-duplication accuracy of 99% has been achieved so far, using good quality fingerprints against a database of up to fifty million. Two factors, however, raise uncertainty about the accuracy that can be achieved through fingerprints. First, retaining efficacy while scaling the database size from fifty million to a billion has not been adequately analyzed. Second, fingerprint quality, the most important variable for determining de-duplication accuracy, has not been studied in depth in the Indian context.”230 140 In its report for discussion titled “Technical Standards for Digital Identity Systems for Digital Identity”, the Identification for Development (ID4D) initiative, a cross-departmental effort report of the World Bank, noted that 229 UIDAI Committee on Biometrics, Biometrics Design Standards For UID Applications, at page 4 230 Ibid.
200 PART F UIDAI had not implemented “an important security standard, ISO 24745, which provides guidance for the protection of biometric information for confidentiality and integrity during storage or managing identities … due to the complexity of applicable compliance procedures” for the Aadhaar system. 231 Proponents of the program argue that in all fairness to UIDAI, it has to be noticed that the ISO 24745 standard was published in August 2011 whereas the report of BSC had already been submitted to UIDAI in January 2010. However, Mr. Myung Geun Chun, the Project Editor of ISO 24745, is reported to have stated that ISO 24745 standard is an ‘invaluable tool’ for addressing ‘unique privacy concerns’ like ‘unlawful processing and use of data’ raised by biometric identification because of its binding nature ‘which links biometrics with personally identifiable information’.232 ISO 24745 seeks to “safeguard the security of a biometric system and the privacy of data subjects with solid countermeasures”.233 ISO 24745 standard specifies:
● “Analysis of threats and countermeasures inherent in biometric and biometric system application models; ● Security requirements for binding between a biometric reference and an identity reference;
● Biometric system application models with different scenarios for the storage and comparison of biometric references;
● Guidance on the protection of an individual’s privacy during the processing of biometric information.”234 231 Identification for Development (World Bank Group), Technical Standards for Digital Identity Systems for Digital Identity Draft for Discussion, available at http://pubdocs.worldbank.org/en/579151515518705630/ID4D- Technical-Standards-for-Digital-Identity.pdf, at page 22. 232 Katie Bird, Is your biometric data safe online? ISO/IEC standard ensures security and privacy, (11 August 2011), available at https://www.iso.org/news/2011/08/Ref1452.html. 233 Ibid.
234 Ibid.
201 PART F B. Strategy Overview of 2010 In this report, a balance was sought to be struck between ‘privacy and purpose’ in respect of the information of the residents which was collected. The report states that ‘agencies’ may store the information of the residents at the time of enrolment, but they will not have access to the information stored in the UID database.235 Further, for the purposes of authentication, requests made by the agencies would be answered through a ‘Yes’ or a ‘No’ response only.236 Under the sub-heading “Protecting Privacy and Confidentiality”, the report stated that the additional information which was being sought from people was only biometric information like fingerprints and iris scans, as other information was already available with public and private agencies in the country.237 Right to privacy and confidentiality were sought to be protected by putting necessary provisions “in place”.238 It was also observed in the context of privacy that loss of biometric information of a resident who is a victim of identity theft, especially when such information is linked to banking, social security and passport records, risks financial and other assets and the reputation of the resident.239 According to the review, the envisaged UIDAI Act (which was still under contemplation at the time of publishing of this report and had not yet been legislated) would have remedies for the following offences: 235 UIDAI, UIDAI Strategy Overview, available at http://www.prsindia.org/uploads/media/UID/UIDAI%20STRATEGY%20OVERVIEW. pdf, at page 4 236 Ibid.
237 Ibid, at page 32 238 Ibid.
239 Ibid, at page 33 202 PART F ● “Unauthorized disclosure of information by anyone in UIDAI, Registrar or the Enrolling agency;
● Disclosure of information violating the protocols set in place by UIDAI;
● Sharing any of the data on the database with anyone; ● Engaging in or facilitating analysis of the data for anyone; ● Engaging in or facilitating profiling of any nature for anyone or providing information for profiling of any nature for anyone;
● All offences under the Information Technology Act shall be deemed to be offences under UIDAI if directed against UIDAI or its database.”240 However, according to the report, UIDAI was to concern itself only with identity fraud and any grievances in respect of document fraud (counterfeit/ misleading documents) were to be left to the Registrar enrolling the resident.241 141 The following conclusions emerge from the UIDAI’s strategy overview: Firstly, the UIDAI was aware of the importance of biometric information before the Aadhaar programme had been rolled out. Secondly, UIDAI had itself contemplated a scenario of identity theft which could occur at the time of enrollment for Aadhaar cards. However, it had no solution to the possible harms which could result after the identity theft of a person, more so when the potential ‘UIDAI Act’ was still in the pipeline and was not eventually enacted until 2016.
240 Ibid.
241 Ibid, at page 34 203 PART F C. Registrars 142 The term ‘Registrar’ was first defined by UIDAI in its DDSVPC Report as “any government or private agency that will partner with UIDAI in order to enroll and authenticate residents”.242 In the Strategy Overview, the term was defined as “agencies such as central and state departments and private sector agencies who will be ‘Registrars’ for the UIDAI”.243 The Strategy Overview also stated that:
“Registrars will process UID applications, and connect to the CIDR to de-duplicate resident information and receive UID numbers. These Registrars can either be enrollers, or will appoint agencies as enrollers, who will interface with people seeking UID numbers. The Authority will also partner with service providers for authentication. If the Registrar issues a card to the resident, the UIDAI will recommend that the card contain the UID number, name and photograph. They will be free to add any more information related to their services (such as Customer ID by bank). They will also be free to print/ store the biometric collected from the applicant on the issued card. If more registrars store such biometric information in a single card format, the cards will become interoperable for offline verification. But the UIDAI will not insist on, audit or enforce this.”244 (Emphasis supplied) 143 In the ‘Aadhaar Handbook for Registrars 2010’ (“2010 Handbook”), following policy guidelines were laid down in respect of Registrars:
1. “Registrars may retain the biometric data collected from residents enrolled by them. However, the Registrar will have to exercise a fiduciary duty of care with respect to the data collected from residents and will be responsible for loss, unauthorized access to and misuse of data in their custody.
2. In order to ensure data integrity and security, the biometrics captured shall be encrypted upon collection by using the 242 DDSVPC (UIDAI), DDSVPC Report, (9 December 2009), available at https://uidai.gov.in/images/UID_DDSVP_Committee_Report_v1.0. pdf , at page 5 243 UIDAI, UIDAI Strategy Overview, available at http://www.prsindia.org/uploads/media/UID/UIDAI%20STRATEGY%20OVERVIEW.pdf, at page 2 244 Ibid, at page 15 204 PART F encryption key defined by the Registrar. It is the responsibility of the Registrar to ensure the safety, security and confidentiality of this data which is in their custody. The Registrar must protect the data from unauthorized access and misuse. The UIDAI will define guidelines for the storage of biometric data in order to give the Registrar some guidance on ensuring security of the data. The Registrar shall have to define their own security policy and protocols to ensure safety of the Biometric data. The Registrars shall bear liability for any loss, unauthorized access and misuse of this data. In the interest of transparency, it is recommended that the Registrar inform the resident that they will be keeping the biometric data and also define how the data will be used and how it will be kept secure.”245 (Emphasis supplied) In the ‘Aadhaar Handbook for Registrars 2013’ (“2013 Handbook”), it was stated that “UIDAI has defined security guidelines for the storage of biometric data”.246 While it is indicated in the handbook that guidelines for storage were defined by UIDAI, it is evident that this took place only after 2010 before which the registrars were functioning without guidelines mandating how the biometric data was to be kept secure.
The following guideline finds mention both in the Handbook of 2010 and 2013:
“In the interest of transparency, it is recommended that the Registrar inform the resident that they will be keeping the biometric data and also define how the data will be used and how it will be kept secure”.247 However, it is apparent from this guideline that it was merely a recommendation to the Registrars, and no obligation was cast upon the 245 UIDAI, Aadhaar Handbook for Registrars, available at http://doitc.rajasthan.gov.in/administrator/Lists/Downloads/Attachments/26/aadhaar_handbook_version. pdf, at page 11 246 Annexure R-74, Volume III, List of Pre-enactment dates and events for the Aadhaar project, Submissions by the AG.
247 UIDAI (Planning Commission), Aadhaar Handbook for Registrars (2010), available at http://indiamicrofinance.com/wp-content/uploads/2010/08/Aadhaar-Handbook. pdf, at page 11; UIDAI (Planning Commission), Aadhaar Handbook for Registrars (2013), at page 16 (Annexure R-74, List of Pre- enactment dates and events for the Aadhaar project submitted by the Learned AG). 205 PART F Registrars, to inform residents that their biometric data will be stored by them and how the data was to be used and kept secure. In contrast, Regulation 5 of the Aadhaar (Sharing of Information) Regulations 2016, states:
“Responsibility of any agency or entity other than requesting entity with respect to Aadhaar number. — (1) Any individual, agency or entity which collects Aadhaar number or any document containing the Aadhaar number, shall: (a) collect, store and use the Aadhaar number for a lawful purpose; (b) inform the Aadhaar number holder the following details:— i. the purpose for which the information is collected; ii. whether submission of Aadhaar number or proof of Aadhaar for such purpose is mandatory or voluntary, and if mandatory, the legal provision mandating it; iii. alternatives to submission of Aadhaar number or the document containing Aadhaar number, if any; (c) obtain consent of the Aadhaar number holder to the collection, storage and use of his Aadhaar number for the specified purposes.
(2) Such individual, agency or entity shall not use the Aadhaar number for any purpose other than those specified to the Aadhaar number holder at the time of obtaining his consent.
(3) Such individual, agency or entity shall not share the Aadhaar number with any person without the consent of the Aadhaar number holder.” (Emphasis supplied) 144 What the Registrar is obliged to do under law after the enactment of the Aadhaar Act, was a recommendation to the Registrar prior to the enactment of the Aadhaar Act. Thus, it is uncertain whether residents were informed about where and how their data would be kept secure since the guidelines to the Registrars were only recommendatory in nature. Similarly, in a UIDAI document titled ‘Roles and Responsibilities of Enrollment Staff, 2017’, one of the ‘Fifteen Commandments that an Operator must remember during Resident Enrollment’ is “Make sure that the resident is well informed that his/her 206 PART F biometric will only be used for Aadhaar Enrolment/Update and no other purpose”.248 However, in the UIDAI document titled ‘Enrollment Process Essentials, 2012’, there is no mention of any such obligation being placed upon the enrolment staff.249 In the absence of informed consent for the collection of data, a shadow of potential illegality is cast.
F.4 Privacy Concerns in the Aadhaar Act 1 Consent during enrolment and authentication & the right to access information under the Aadhaar Act 145 Section 3(2) of the Aadhaar Act requires enrolment agencies to inform
the individual being enrolled about: a) the manner in which information shall be used; b) the nature of recipients with whom the information is to be shared during authentication; and c) the existence of a right to access information. However, the Enrolment Form in Schedule I of the Enrolment Regulations does not offer any clarification or mechanism on how the mandate of Section 3(2) is to be fulfilled.
The right of an individual to access information related to his or her authentication record is recognized in Section 3(2)(c) and Section 32(2) of the 248 UIDAI, Roles and Responsibilities of Enrolment Staff, available at https://idai.gov.in/images/annexure_b_roles_and_responsibility_of_enrolment_staff. Pdf , at page 8 249UIDAI, Enrolment Process Essentials (13 December 2012), available at http://www.nictcsc.com/images/Aadhaar%20Project%20Training%20Module/English%20Training%20Module/ module2_aadhaar_enrolment_process17122012. pdf 207 PART F Aadhaar Act. However, the supplementary regulations that complement the Act are bereft of detail on the procedure to access such information. Similarly, Regulation 9(c) of the Enrolment Regulations states that the procedure for accessing data would be provided to residents through the enrolment form, which is found in Schedule I to the Enrolment Regulations. However, all that Schedule I states is: “I have a right to access my identity information (except core biometrics) following the procedure laid down by UIDAI”, without any such procedure actually being laid down. 146 Section 2(I) of the Act, which defines an enrolling agency read with Regulation 23 of the Aadhaar (Enrolment and Update) Regulations allows for the collection of sensitive personal data (demographic and biometric information) of individuals by private agencies, which also have to discharge the burden of explaining the voluntary nature of Aadhaar registration and obtaining an individual’s informed consent. The Authentication Regulations, framed under sub-section (1), and sub- clauses (f) and (w) of sub-section (2) of Section 54 of the Aadhaar Act deal with the authentication framework for Aadhaar numbers, the governance of authentication agencies and the procedure for collection, storage of authentication data and records. Regulation 5 (1) states what details shall be made available to the Aadhaar number holder at the time of authentication 208 PART F which are a) the nature of information that will be shared by the Authority upon authentication, (b) the uses to which the information received during authentication may be put; and (c) alternatives to submission of identity information. Regulation 6 (2) mandates that a requesting entity shall obtain the consent of an Aadhaar number holder for authentication in physical or, preferably, in electronic form and maintain logs or records of the consent obtained in the manner and form as may be specified by the Authority for this purpose.
Although Regulation 5 mentions that at the time of authentication, requesting entities shall inform the Aadhaar number holder of alternatives to submission of identity information for the purpose of authentication, and Regulation 6 mandates that the requesting entity shall obtain the consent of the Aadhaar number holder for the authentication, in neither of the above circumstances do the regulations specify the clearly defined options that should be made available to the Aadhaar number holder in case they do not wish to submit identity information, nor do the regulations specify the procedure to be followed in case the Aadhaar number holder does not provide consent. This is a significant omission. Measures for providing alternatives must be defined in all identity systems, particularly those that are implemented on a large scale. 209 PART F 2 Extent of information disclosed during authentication & sharing of core biometric information 147 Section 8(4) of the Act permits the Authority to respond to an authentication query with a “positive, negative or any other appropriate response sharing such identity information excluding any core biometric information”. The petitioners have argued that the wide ambit of this provision gives the Authority discretion to respond to the requesting entity with information including an individual’s photograph, name, date of birth, address, mobile number, email address and any other demographic information that was disclosed at the time of enrolment.
Moreover, it must be realized that even if core biometric information cannot be shared, demographic information is nonetheless, sensitive. Regulation 2(j) of the Authentication Regulations250 provides that a digitally signed response with e-KYC data251 [which is defined in Regulation 2(k)] can be returned to the requesting entity, while Regulation 3(ii)252 provides for this form of authentication (e-KYC) by UIDAI.
250 Regulation 2(j) of Aadhaar (Authentication) Regulations: “e-KYC authentication facility” means a type of authentication facility in which the biometric information and/or OTP and Aadhaar number securely submitted with the consent of the Aadhaar number holder through a requesting entity, is matched against the data available in the CIDR, and the Authority returns a digitally signed response containing e-KYC data along with other technical details related to the authentication transaction. 251 Regulation 2(k) of Aadhaar Authentication Regulations: “e-KYC data” means demographic information and photograph of an Aadhaar number holder.
252 Regulation 3(ii) of Aadhaar (Authentication) Regulations, 2016: “3. Types of Authentication-There shall be two types of authentication facilities provided by the Authority, namely— (i) Yes/No authentication facility, which may be carried out using any of the modes, (ii) e-KYC authentication facility, which may be carried out only using OTP and/ or biometric authentication modes as specified in regulation 4(2)”. 210 PART F 148 Section 29(1) of the Aadhaar Act expressly states that ‘core biometric information can never be shared with anyone for any reason whatsoever or be used for any purpose other than generation of Aadhaar numbers and authentication under this Act’. However, this provision which seemingly protects an individual’s core biometric information from being shared is contradicted by Section 29(4)253 of the Act, the proviso to which grants UIDAI the power to publish, display or post core biometric information of an individual for purposes specified by the regulations. The language of this section is overbroad and which could lead to transgressions and abuse of power. Moreover, sub-sections 29(1) and (2), in effect, create distinction between two classes of information (core biometric information and identity information), which are integral to individual identity. Identity information requires equal protection as provided to core biometric information. 3 Expansive scope of biometric information 149 Definitions of biometric information [Section 2(g)], core biometric information [Section 2(j)] and demographic information [Section 2(k)] under the Aadhaar Act are inclusive and expansive. Section 2(g) defines 'biometric information' as “photograph, fingerprint, iris scan, or such other biological attributes of an individual as may be specified by regulations”. Section 2(j) defines ‘core biometric information’ as “fingerprint, Iris scan, or such other 253 Section 29(4) states: “No Aadhaar number or core biometric information collected or created under this Act in respect of an Aadhaar number holder shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations.” 211 PART F biological attribute of an individual as may be specified by regulations”. Section 2(t) explains that the regulations are to be made by UIDAI, which is the supreme authority under the Act. Sections 2(g), (j), (k) and (t) give discretionary power to UIDAI to define the scope of biometric and demographic information. Although the Act specifically provides what information can be collected, it does not specifically prohibit the collection of further biometric information. The scope of what can, in addition, be collected, has been left to regulations. These provisions empower UIDAI to expand on the nature of information already collected at the time of enrolment, to the extent of also collecting ‘such other biological attributes’ that it may deem fit by specifying it in regulations at a future date. The definitions of these sections provide the government with unbridled powers to add to the list of biometric details that UIDAI can require a citizen to part with during enrolment which might even amount to an invasive collection of biological attributes including blood and urine samples of individuals. 4 Other concerns regarding the Aadhaar Act: Misconceptions regarding the efficacy of biometric information 150 The uniqueness of a fingerprint in forensic science remains an assumption without watertight proof. The uniqueness of biometric data is not absolute, it is relative. Not everyone will have a particular biometric trait, or an individual’s biometric trait may be significantly different from the ‘normal’ 212 PART F expected trait. Some people may be missing fingerprints due to skin or other disease, which may cause further problems when enrolling a large population in a fingerprint-based register. Discrimination concerns may also be raised in such a case. Therefore, a large scale biometric scheme will usually need to utilise more than one biometric. For example- both fingerprint and face to ensure all people can be enrolled.254 The stability of even so called stable types of biometric data is not absolute. Each time an individual places a fingerprint on a fingerprint reader, the pattern may appear to be the same from a short distance, but there are actually small differences in the pattern due to dryness, moisture and elasticity of the skin. Moreover, cuts and scratches can alter the pattern. Similarly, even the iris, a popular biometric measurement suffers from difficulties in obtaining a valid image. The iris can also be hindered by specula reflections in uncontrolled lighting situations. These problems also apply to other relatively stable biometric identifiers.255 151 Sections 6256 and 31(2)257 of the Aadhaar Act place an additional onus on individual Aadhaar holders to update their information. These provisions 254Ramesh Subramanian, Computer Security, Privacy & Politics: Current Issues, Challenges & Solutions, IRM Press, at pages 99-100 255Ibid, at page 100 256Section 6 states: “The Authority may require Aadhaar number holders to update their demographic information and biometric information, from time to time, in such manner as may be specified by regulations, so as to ensure continued accuracy of their information in the Central Identities Data Repository.” 257Section 31(2) states: “In case any biometric information of Aadhaar number holder is lost or changes subsequently for any reason, the Aadhaar number holder shall request the Authority to make necessary alteration in his record in the Central Identities Data Repository in such manner as may be specified by regulations.” 213 PART F create a legal mandate on individuals to ensure that their information is accurate within the CIDR. It is an acknowledgement that an individual’s biometric information may change from time to time. Natural factors like ageing, manual labour, injury and illness can cause an individual’s biometric information to be altered over the course of a lifetime. Critics of the Aadhaar program however point to the fact that provisions for updation fly in the face of UIDAI’s repeated advertisements that Aadhaar enrolment is a “one-time” affair, as it is not and will never be. Moreover, there is no way in which a person can estimate that he or she is due for an update, as this is not something that can be discerned by actions as innocuous as looking in the mirror or at one’s fingers, and therefore there remains no objective means of complying with the above sections. In fact, an authentication failure and a subsequent denial of welfare benefits, a subsidy or a service that an individual is entitled to might be the only way one comes to the conclusion that his or her biometrics need to be updated in the CIDR.258 Moreover, since the promise of Aadhaar as a unique identity hinges on the uniqueness of biometrics, it would be logical to assume that any update to biometric data should go through the same rigour as a new enrolment. Regulation 19(a), entitled ‘Modes of Updating Residents Information’ under Chapter IV of the Aadhaar (Enrolment and Update) Regulations, 2016 provides:
258 L. Vishwanath, Four Reasons You Should Worry About Aadhaar's Use of Biometrics, The Wire (28 March, 2017), available at https://thewire.in/rights/real-problem-aadhaar-lies-biometrics 214 PART F “19. Mode of Updating Residents Information:
a) At any enrolment centre with the assistance of the operator and/or supervisor. The resident will be biometrically authenticated and shall be required to provide his Aadhaar number along with the identity information sought to be updated.” This raises the question as to how an individual will update his/her biometric information. If the biometric information stored in CIDR has changed, the present biometrics will lead to mismatch during authentication. This Regulation does not provide any real clarity on how updation should be taking place in practice for the following reasons:
1. As required by the regulation, can an individual be asked to undergo biometric authentication, when the purpose is to update the biometrics?
2. Does the provision amount to an implied expectation that an individual is supposed to revisit the enrolment centre before all ten fingers and two irises (core biometric information) are rendered inaccurate for the purposes of authentication?259 This is also evidence of the fact that an Aadhaar enrolment is not a one-time affair.
5 No access to biometric records in database 152 The proviso to Section 28(5)260 of the Aadhaar Act disallows an individual access to the biometric information that forms the core of his or her 259 Ibid.
260 Section 28(5) states: “Notwithstanding anything contained in any other law for the time being in force, and save as otherwise provided in this Act, the Authority or any of its officers or other employees or any agency 215 PART F unique ID (Aadhaar). The lack of access is problematic for the following reasons: First, verification of whether the biometrics have been recorded correctly or not in the first place is not possible. This becomes critical when that same information forms the basis of identity and is the basis of authentication and subsequent access to welfare benefits and other services. Second, there is a great potential for fraudulently replacing a person’s biometric identity in the database, as the individual has no means to verify the biometric information that has been recorded at the time of enrolment. Even an entity like the enrolment operator (with a software hack) could upload someone else’s biometrics against another person.261 Denial of access to the individual violates a fundamental principle of data protection: ownership of the data must at all times vest with the individual. Overlooking this fundamental principle is manifestly arbitrary and violative of Article 14.
6 Biometric locking 153 Authentication Regulations 11 (1) and (4) provide for the facility of
Biometric Locking. Regulation 11(1) provides:
“The Authority may enable an Aadhaar number holder to permanently lock his biometrics and temporarily unlock it when needed for biometric authentication.” that maintains the Central Identities Data Repository shall not, whether during his service or thereafter, reveal any information stored in the Central Identities Data Repository or authentication record to anyone:
Provided that an Aadhaar number holder may request the Authority to provide access to his identity information excluding his core biometric information in such manner as may be specified by regulations.” 261 L. Vishwanath, Four Reasons You Should Worry About Aadhaar's Use of Biometrics, The Wire (28 March, 2017), available at https://thewire.in/rights/real-problem-aadhaar-lies-biometrics 216 PART F Regulation 11(4) provides:
“The Authority may make provisions for Aadhaar number holders to remove such permanent locks at any point in a secure manner.” The provision allowing biometric locking is salutary to the extent that it allows Aadhaar number holders to permanently lock their biometrics and temporarily unlock them only when needed for biometric authentication. But the regulation is problematic to the extent that it also empowers the UIDAI to make provisions to remove such locking without any specified grounds for doing so.262 7 Key takeaways 154 The use of biometric technology is only likely to grow dramatically both in the private and public sector. On our part, we can only ensure that the strides made in technology are accompanied by stringent legal and technical safeguards so that biometrics do not become a threat to privacy.263 155 There is no unique concept of privacy and there maybe trade-offs between privacy and other objectives.264 The challenge regarding privacy is best put in the following words:
262 The Centre for Internet & Society, Analysis of Key Provisions of the Aadhaar Act Regulations, (31 March, 2017), available at https://cis-india.org/internet-governance/blog/analysis-of-key-provisions-of-aadhaar-act- regulations.