“When balancing the interest of the respondent State in protecting its national security through secret surveillance measures against the seriousness of the interference with an applicant’s right to respect for his or her private life, the national authorities enjoy a certain margin of appreciation in choosing the means for achieving the legitimate aim of protecting national security. However, this margin is subject to European supervision embracing both legislation and decisions applying it. In view of the risk that a system of secret surveillance set up to protect national security may undermine or even destroy democracy under the cloak of defending it, the Court must be satisfied that there are adequate and effective guarantees against abuse. The assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law.
The Court has to determine whether the procedures for supervising the ordering and implementation of the restrictive measures are such as to keep the “interference” to what is “necessary in a democratic society”.”
142) Two other cases of violation of Article of the European Writ Petition (Civil) No. 494 of 2012 & connected matters Page 229 of 567 Convention of Human Rights were cited, namely Digital Rights Ireland Ltd. v. Minister for Communication, Marine and Natural Resources65 and S and Marper v. United Kingdom66. In Digital Ireland, the European Parliament and the Council of the European Union adopted Directive 2006/24/EC (Directive), which regulated Internet Service Providers’ storage of telecommunications data. It could be used to retain data generated or processed in connection with the provision of publicly available electronic communications services or of public communications network for the purpose of fighting serious crime in the European Union (EU). The data included data necessary to trace and identify the source of communication and its destination, to identify the date, time duration, type of communication, IP address, telephone number and other fields. The European Court of Justice (ECJ) evaluated the compatibility of the Directive with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and declared the Directive to be invalid. According to the ECJ, the Directive interfered with the right to respect for private life under Article 7 and with the right to the protection of personal data under Article
8. It allowed very precise conclusion to be drawn concerning the 65 [2014] All ER (D) 66 (Apr) 66 (2008) ECHR 1581 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 230 of 567 private lives of the persons whose data had been retained, such as habits of everyday life, permanent or temporary places of residence, daily and other movements, activities carried out, social relationships and so on. The invasion of right was not proportionate to the legitimate aim pursued.
143) In S and Marper, the storing of DNA profiles and cellular samples of any person arrested in the United Kingdom was challenged before the ECtHR. Even if the individual was never charged, if criminal proceedings were discontinued, or if the person was later acquitted of any crime, their DNA profile could nevertheless be kept permanently on record. It held that there had been a violation of Article 8 of the ECHR. Fingerprints, DNA profiles and cellular samples, constituted personal data and their retention was capable of affecting private life of an individual. Retention of such data without consent, thus, constitutes violation of Article 8 as they relate to identified and identifiable individuals. The Court held that invasion of privacy was not “necessary in a democratic society as it did not fulfill any pressing social need. The blanket and indiscriminate nature of retention of data was excessive and did not strike a balance between private and public interest.
144) The respondents, on the other hand, rebutted the arguments of Writ Petition (Civil) No. 494 of 2012 & connected matters Page 231 of 567 the petitioners that the architecture of the Aadhaar Act enables State surveillance. It was submitted that bare minimal information was obtained from the individual who enrolled for Aadhaar. Insofar as demographic information is concerned, it included name, date of birth, address, gender, mobile number and email address. The latter two are optional and meant for transmitting relevant information to the AMH and for One Time Password (OTP) based authentication. This information was in respect of an individual and is always in public domain. Section 2(k) of the Aadhaar Act specifically provides that regulations cannot include race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Therefore, sensitive information specifically stands excluded. This specific exclusion, in the context, ensures that the scope of including additional demographic information is very narrow and limited. It was also argued that even the biometric information was limited to the fingerprints and iris scan, which is considered to be the core biometric information. Such information is, again, frequently utilised globally to ascertain the identity of a person. The argument was, thus, that the information gathered was non- invasive and non-intrusive identity information. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 232 of 567
145) It was also argued that the very scheme of the Aadhaar and the manner in which it operates excludes every possibility of data profiling and, therefore, the question of State surveillance would not arise. The powerpoint presentation which was given by Dr. Pandey, as has been stated above, was referred to, on the basis of which it was argued that the Aadhaar design takes full care of security of persons.
146) It was also argued by the respondents that identity information data resides in the CIDR which is not in the control of the Government or the police force. The Authority is a body constituted as a body corporate having perpetual succession and a common seal. It is regulated by substantive and procedural checks to protect the identity information and authentication record. This information cannot be published, displayed or posted publicly. It does not have the authority to carry out surveillance. The State Governments and the police forces cannot obtain the information contained in the CIDR or the authentication records except in two situations contemplated by Section 33 – (i) When the District Judge orders so after giving an opportunity of hearing to the authority (even in this situation core biometric information will not be shared; and (ii) in the interest of National Security Writ Petition (Civil) No. 494 of 2012 & connected matters Page 233 of 567 where a Joint Secretary or a superior officer of the Government of India specially authorizes in this behalf, and in this case every direction is reviewed by an oversight committee chaired by the Cabinet Secretary. Further, this direction is limited for three months and extendable by a further period of 3 months.
147) It was submitted that surveillance, if at all, can only be carried out by unauthorised use of CIDR information, despite its statutory prohibition and punitive injunctions or by other means such as physical surveillance. That is, however, an illegal surveillance. The architecture of the Act does not allow surveillance. It was submitted that the petitioners have not made out a case of surveillance by the Authority but points out a mere possibility of surveillance.
148) We may reiterate that the argument of surveillance also has the reflections of privacy and in fact the argument is structured on the basis that the vital information which would be available with the Government can be utilised to create the profiling of individuals and retention of such information in the hands of the respondents is a risky affair which may enable the State to do the surveillance of any individual it wants.
149) Insofar as the aspect of privacy of individual is concerned, that Writ Petition (Civil) No. 494 of 2012 & connected matters Page 234 of 567 would be dealt with in detail while addressing that issue. To segregate issue of surveillance from privacy, we are focusing the discussion to the aspect whether there is sufficient data available with the respondents which may facilitate the profiling and misuse thereof or whether there are sufficient safeguards to ward off the same. In the process, we would be discussing the issues pertaining to data protection as well. At the same time, there would be some overlapping of discussion inasmuch as it will have to be seen as to the collection, storage and use of biometric data satisfies the proportionality principle.
150) It is clear that the argument of the petitioners is that on the basis of the data available with the Authority, there can be a profiling of an individual which may make the surveillance state. And such a mass surveillance is not permitted by the Constitution of India. The entire foofaraw about the Aadhaar architecture is the so- called enormous information that would be available to the Government on using Aadhaar card by residents. Two issues arise from the respective arguments of the parties:
(a) whether the architecture of the Aadhaar project enables the Sate to create a regime of surveillance?; and
(b) whether there are adequate provisions for data protection? Writ Petition (Civil) No. 494 of 2012 & connected matters Page 235 of 567
151) Insofar as issue (a) above is concerned, after going through the various aspects of the Aadhaar project, the provisions of the Aadhaar Act and the manner in which it operates, it is difficult to accept the argument of the petitioners. The respondents have explained that the enrolment and authentication processes are strongly regulated so that data is secure. The enrolment agency, which collects the biometric and demographic of the individuals during enrolment, is appointed either by UIDAI or by a Registrar [Section 2(s)]. The Registrars are appointed through MoUs or agreements for enrolment and are to abide by a code of conduct and processes, policies and guidelines issued by the Authority. They are responsible for the process of enrolment. Categories of persons eligible for appointment are limited by the Regulations. The agency employs a certified supervisor, an operator and a verifier under Enrolment and Update Regulations. Registrars and the enrolling agencies are obliged to use the software provided or authorized by UIDAI for enrolment purpose. The standard software has security features as specified by the Authority. All equipment used is as per the specification issued by the Authority. The Registrars are prohibited from using the information collected for any purpose other than uploading the information to CIDR. Sub-contracting of enrolment function is not Writ Petition (Civil) No. 494 of 2012 & connected matters Page 236 of 567 allowed. The Code of Conduct contains specific directions for following the confidentiality, privacy and security protocols and submission of periodic reports of enrolment. Not only there are directions prohibiting manipulation and fraudulent practices but the Act contains penal provisions for such violations in Chapter VII of the Regulations. The enrolment agencies are empanelled by the Authority. They are given an enrolling agency code using which the Registrar can onboard such agency to the CIDR. The enrolment data is uploaded to the Central Identities Data Repository (CIDR) certified equipment and software with a digital signature of the Registrar/enrolling agency. The data is encrypted immediately upon capture. The decryption key is with the UIDAI solely. Section 2(ze) of the Information Technology Act, 2000 (hereinafter referred to as the ‘IT Act’) which defines ‘secure systems’ and Section 2(w) of the Act, which defines ‘intermediaries’ apply to the process. Authentication only becomes available through the Authentication Service Agency (ASA). They are regulated by the Aadhaar (Authentication) Regulations, 2016. Their role and responsibilities are provided by Regulation 19 of the Authentication Regulations. They are to use certified devices. The equipment or software has to be duly registered with or approved or certified by the Authority/agency. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 237 of 567 The systems and operations are audited by information system auditor. The requesting entities pass the encrypted data to the CIDR through the ASA and the response (Yes/No authentication or e-KYC information) also takes the same route back. The server of the ASA has to perform basic compliance and completeness checks on the authentication data packet before forwarding it to the CIDR. The Act prohibits sharing and disclosure of core biometric data under Section 8 and 29. Other identity information is shared with requesting entity (AUAs and KUAs) only for the limited purpose of authentication. The data is transferred from the requesting entity to the ASA to the CIDR in an encrypted manner through a leased line circuitry using secure Protocols (Regulation 9 of the Authentication Regulations). The storage of data templates is in safely located servers with no public internet inlet/outlet, and offline storage of original encrypted data (PID blocks). There are safety and security provisions such as audit by Information Systems Auditor. Requesting entities are appointed through agreement. They can enter into agreement with sub-AUA or sub-KUA with permission of the UIDAI. Whatever identity information is obtained by the requesting entity is based on a specific consent of the Aadhaar number holder. The e-KYC data shared with the requesting entity Writ Petition (Civil) No. 494 of 2012 & connected matters Page 238 of 567 can only be after prior consent of the Aadhaar holder. Such data cannot be shared and has to be stored in encrypted form. The biometric information used is not permitted to be stored. Only the logs of authentication transactions are maintained for a short period. Full identity information is never transmitted back to the requesting entity. There is a statutory bar from sharing biometric information (Section 29(1)(a)/Section 29(4)). Data centres of ASA, requesting entities and CIDR should be within the territory of India. There are various other provisions for monitoring, auditing, inspection, limits on data sharing, data protection, punishments etc., grievance redressal mechanism, suspension and termination of services, etc. so that all actions the entities involved in the process are regulated. Regulation 3(i) & (j) of Aadhaar (Data Security) Regulation, 2016 enables partitioning of CIDR network into zones based on risk and trust and other security measures. CIDR being a computer resource is notified to be a “Protected System” under Section 70 of the IT Act by the Central Government on December 11, 2015. Anyone trying to unlawfully gain access into this system is liable to be punished with 10 years imprisonment and fine. The storage involves end to end encryption, logical partitioning, firewalling and anonymisation of decrypted biometric data. Breaches of penalty are made Writ Petition (Civil) No. 494 of 2012 & connected matters Page 239 of 567 punitive by Chapter VII of the Act. Biometric information is deemed to be an “electronic record”, and “Sensitive personal data or information” under the IT Act. There are further guards under the Aadhaar (Data Security) Regulations, 2016.
152) That apart, we have recorded in detail the powerpoint presentation that was given by Dr. Ajay Bhushan Pandey, CEO of the Authority, which brings out the following salient features:
(a) During the enrolment process, minimal biometric data in the form of iris and fingerprints is collected. The Authority does not collect purpose, location or details of transaction. Thus, it is purpose blind. The information collected, as aforesaid, remains in silos. Merging of silos is prohibited. The requesting agency is provided answer only in ‘Yes’ or ‘No’ about the authentication of the person concerned. The authentication process is not exposed to the Internet world. Security measures, as per the provisions of Section 29(3) read with Section 38(g) as well as Regulation 17(1)(d) of the Authentication Regulations are strictly followed and adhered to.
(b) There are sufficient authentication security measures taken as well, as demonstrated in Slides 14, 28 and 29 of the presentation.
(c) The Authority has sufficient defence mechanism, as Writ Petition (Civil) No. 494 of 2012 & connected matters Page 240 of 567 explained in Slide 30. It has even taken appropriate protection measures as demonstrated in Slide 31.
(d) There is an oversight by Technology and Architecture Review Board (TARB) and Security Review Committee.
(e) During authentication no information about the nature of transaction etc. is obtained.
(f) The Authority has mandated use of Registered Devices (RD) for all authentication requests. With these, biometric data is signed within the device/RD service using the provider key to ensure it is indeed captured live. The device provider RD service encrypts the PID block before returning to the host application. This RD service encapsulates the biometric capture, signing and encryption of biometrics all within it. Therefore, introduction of RD in Aadhaar authentication system rules out any possibility of use of stored biometric and replay of biometrics captured from other source. Requesting entities are not legally allowed to store biometrics captured for Aadhaar authentication under Regulation 17(1)(a) of the Authentication Regulations.
(g) The Authority gets the AUA code, ASA code, unique device code, registered device code used for authentication. It does not get any information related to the IP address or the GPS location from where authentication is performed as these parameters are Writ Petition (Civil) No. 494 of 2012 & connected matters Page 241 of 567 not part of authentication (v2.0) and e-KYC (v2.1) API. The Authority would only know from which device the authentication has happened, through which AUA/ASA etc. It does not receive any information about at what location the authentication device is deployed, its IP address and its operator and the purpose of authentication. Further, the authority or any entity under its control is statutorily barred from collecting, keeping or maintaining any information about the purpose of authentication under Section 32(3) of the Aadhaar Act.
153) After going through the Aadhaar structure, as demonstrated by the respondents in the powerpoint presentation from the provisions of the Aadhaar Act and the machinery which the Authority has created for data protection, we are of the view that it is very difficult to create profile of a person simply on the basis of biometric and demographic information stored in CIDR. Insofar as authentication is concerned, the respondents rightly pointed out that there are sufficient safeguard mechanisms. To recapitulate, it was specifically submitted that there were security technologies in place (slide 28 of Dr. Pandey’s presentation), 24/7 security monitoring, data leak prevention, vulnerability management programme and independent audits (slide 29) as Writ Petition (Civil) No. 494 of 2012 & connected matters Page 242 of 567 well as the Authority’s defence mechanism (slide 30). It was further pointed out that the Authority has taken appropriate pro- active protection measures, which included disaster recovery plan, data backup and availability and media response plan (slide
31). The respondents also pointed out that all security principles are followed inasmuch as: (a) there is PKI-2048 encryption from the time of capture, meaning thereby, as soon as data is given at the time of enrolment, there is an end to end encryption thereof and it is transmitted to the Authority in encrypted form. The said encryption is almost foolproof and it is virtually impossible to decipher the same; (b) adoption of best-in-class security standards and practices; and (c) strong audit and traceability as well as fraud detection. Above all, there is an oversight of Technology and Architecture Review Board (TARB) and Security Review Committee. This Board and Committee consist of very high profiled officers. Therefore, the Act has endeavoured to provide safeguards67.
67 We may also take on record responsible statements of the learned Attorney General and Mr. Dwivedi who appeared for UIDAI that no State would be interested in any mass surveillance of 1.2 Billion people of the country or even the overwhelming majority of officers and employees or professionals. The very idea of mass surveillance by State which pursues what an ANH does all the time and based on Aadhaar is an absurdity and an impossibility. According to them, the petitioners submission is based on too many imaginary possibilities, viz.:
(i) Aadhaar makes it possible for the State to obtain identity information of all ANH. It is possible that UIDAI would share identity information/authentication records in CIDR notwithstanding statutory prohibition and punitive injunctions in the Act. It is possible that the State would unleash its investigators to surveil a sizeable section of the ANH, if not all based on the authentication records. It is submitted that given the architecture of the Aadhaar Act, there are no such possibilities and in any event, submission based on imaginary possibility do not provide any basis for questioning the validity of Aadhaar Act. (ii) None of the writ petitions set forth specific facts and even allegations that any Aadhaar number holder is being subjected to Writ Petition (Civil) No. 494 of 2012 & connected matters Page 243 of 567
154) Issue (b) relates to data protection. According to the petitioners there is no data protection and there is a likelihood of misuse of data/personal information of the individuals.
155) The question to be determined is whether the safeguards provided for the protection of personal biometric data in the Aadhaar Act and Rules are sufficient. The crucial tasks that the Court needs to undertake are – (i) to discuss the significance of data in the world of technology and its impact; (ii) to determine the magnitude of protection that should be accorded to collection, storage and use of sensitive biometric data, so that they can qualify as proportionate; and (iii) to determine whether the Aadhaar Act and Rules provide such data protection, thereby obviating any possibility of surveillance.
(i) Significance of Data:
156) Alvin Toffler in his illuminating article titled ‘What will our future be like?’ has presented mind boggling ideas. Toffler traces the transition – from agriculture society to industry society to knowledge based society. If we go back to the beginnings of time, surveillance by UIDAI or the Union/States. The emphasis during the argument was only on the possibility of surveillance based on electronic track trails and authentication records. It was asserted that there are tools in the market for track back. The entire case was speculative and conjectural. In Clapper, Director of National Intelligence v. Amnesty International USA, the majority judgment did not approve the submissions in the context of Foreign Intelligence Surveillance Act and one of the reason was that the allegations were conjectural and speculative. There were no facts pleaded on the basis of which the asserted threat could be fairly traced to. However, we have not deliberated on this argument. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 244 of 567 agriculture was the prime source and the entire mankind was based on agriculture. 350 years later with the invention of steam engines came the industrialized age and now what we are living through is the third gigantic wave, which is way more powerful than industrialized age. An age that is based on knowledge. Toffler emphasises that in today’s society the only thing that leads to creation of wealth is knowledge. Unlike the past wherein economics was described as the science of the allocation of scarce resources, today we are primarily dependent on knowledge and that is not a scarce resource. Times are changing, we can no longer trust the straight line projection. His view is that we are going from a society which is more and more uniform to a highly de-massified society. Knowledge is power. We are in the era of information. Probably what Toffler is hinting is that access to this vast reservoir of information is available in digital world. Information is available online, at the touch of a button. With this, however, we usher into the regime of data.
157) In a recent speech by Mr. Benjamin Netanyahu, Prime Minister of Israel, while talking about innovation and entrepreneurship, he brought out an interesting phenomena in the world of free market principles, i.e. in the era of globalisation, in the following words: Writ Petition (Civil) No. 494 of 2012 & connected matters Page 245 of 567 “Look at the ten leading companies in 2006, five energy companies, one IT company Microsoft and a mere ten years later, in 2016, a blink of an eye, in historical terms, its completely reversed, five IT companies one energy company left. The true wealth is in innovation - you know these companies - Apple, Google, Microsoft, Amazon, Facebook.”
158) He adds by making a significant statement as the reason behind this change:
“...there is a reason something is going on, it’s a great change - you want to hear a jargan – it’s a one sentence, this is a terrible sentence, but I have no other way to say, it’s a confluence of big data, connectivity and artificial intelligence. Ok, you get that? You know what that does – it revolutionises old industries and it creates entirely new industries, so here is an old industry that Israel was always great in – Agriculture. We are always good in agriculture but now we have precision agriculture. You know what that is? See that drone in the sky is connected to a big database and there is sensor at the field and in the field there is drip irrigation and drip fertilization and now we can target with this technology the water that we give, the fertilizer that we give down to the individual plant that needs it. That’s precision agriculture, that’s Israel.
Unbelievable.”
159) This brings us to the world of data – big data. It has its own advantages of tremendous nature. It is making life of people easier. People can connect with each other even when they are located at places far away from each other. Not only they can converse with each other but can even see each other while talking. There is a wealth of information available on different networks to which they can easily access and satisfy their quest for knowledge within seconds by getting an answer. People can Writ Petition (Civil) No. 494 of 2012 & connected matters Page 246 of 567 move from one place to the other with the aid of Global Positioning System (GPS). They can hear music and watch movies on their handy gadgets, including smart cellphones. We are in the age of digital economy which has enabled multiple avenues for a common man. Internet access is becoming cheaper by the day, which can be accessed not only through the medium of desktop computers or laptops and even other handy gadgets like smart phones. Electronic transactions like online shopping, bill payments, movie/train/air ticket bookings, funds transfer, e-wallet payments, online banking and online insurance etc. are happening with extreme ease at the touch of a finger. Such tasks can be undertaken sitting in drawing rooms. Even while travelling from one place to the other in their car, they can indulge in all the aforesaid activities. In that sense, technology has made their life so easy.
160) However, there is another side to do as well, like any coin which has two sides. The use of such technologies is at the cost of giving away personal information, which is in the realm of privacy. In order to connect with such technologies and avail their benefits, the users are parting with their biometric information like fingerprints and iris as well as demographic information like their Writ Petition (Civil) No. 494 of 2012 & connected matters Page 247 of 567 names, parentage, family members, their age, even personal information like their sex, blood group or even the ailments they are suffering from. Not only this, use of aforesaid facilities on net or any portal like Apple, Google, Facebook etc. involves tracking their movements, including the nature of activities, like the kind of shopping, the places from where shopping is done, the actual money spent thereon, the nature of movies watched etc. All this data is there with the companies in respect of its users which may even turn into metadata. In fact, cases after cases are reported where such data of users is parted with various purposes. Interestingly, for using such facilities, people knowingly and willingly, are ready to part with their vital personal information. Every transaction on a digital platform is linked with some form of sensitive personal information. It can be an individual’s user name, password, account number, PAN number, biometric details, e-mail ID, debit/credit card number, CVV number and transaction OTP etc.
161) These have raised concerns about the privacy and protection of data, which has become a matter of great concern. Problem is not limited to data localisation but has become extra-territorial. There are issues of cross-border transfers of personal data, Writ Petition (Civil) No. 494 of 2012 & connected matters Page 248 of 567 regulation whereof is again a big challenge with which various opinions are grappling. There are even talks of convergence of regulatory regime in this behalf so that uniform approach is adopted in providing a legal ecosystem to regulate cross-border data transfer. Asian Business Law Institute (ABLI), in collaboration with Singapore Academy of Law (SAL) has, after undertaking in-depth study, compiled 14 country reports in their respective jurisdictions on the regulation of cross-border data transfer and data localisation in Asia.
162) In the aforesaid scenario, interesting issue is posed by the respondents, viz., when so much personal information about people is already available in public domain, how can there be an expectancy of data privacy. That aspect is dealt with while discussing the issue of privacy. Here, we are concerned with data protection under Aadhaar that is available with the State. As pointed out above, even in respect of private players, the data protection has become a matter of serious concern. When it comes to the State or the instrumentality of the State, the matter has to be taken with all seriousness, on the touchstone of constitutionalism and the concept of limited Government.
(ii) Law on Data Protection:
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 249 of 567
163) In order to determine this aspect, i.e. the nature and magnitude of data protection that is required to enable legal collection and use of biometric data, reliance can be placed on – (a) various existing legislations – both in India and across the world; and (b) case law including the judgment in K.S. Puttaswamy.
(a) Legislation in India: (i) Information Technology Act, 2000
The only existing legislation covering data protection related to biometric information are Section 43A and Section 72A of the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (hereinafter “Sensitive Personal Data Rules”). Although the IT Act and Rules do not determine the constitutionality of use of biometric data and information by the Aadhaar Act and Rules, they are instructive in determining the safeguards that must be taken to collect biometric information 68.
164) Following are the provisions which cover biometric information under the IT Act:
Section 43A of the IT Act attaches liability to a body corporate, which is possessing, handling and dealing with any 68 A challenge to the Aadhaar project for violation of IT Act and Rules has been filed in the Delhi High Court in the matter of Shamnad Basheer v UIDAI and Ors. Therefore, we are not dealing with this aspect, nor does it arise for consideration in these proceedings. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 250 of 567 ‘sensitive personal information or data’ and is negligent in implementing and maintaining reasonable security practices resulting in wrongful loss or wrongful gain to any person. ‘Sensitive personal information or data’ is defined under Rule 3 of the Sensitive Personal Data Rules to include information relating to biometric data. Section 43A reads as follows:
“43A. Compensation for failure to protect data. -Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.
Explanation. -For the purposes of this section,-
(i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;
(ii) "reasonable security practices and procedures" means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit;
(iii) "sensitive personal data or information" means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.]” Writ Petition (Civil) No. 494 of 2012 & connected matters Page 251 of 567
165) Similarly, Section 72A of the IT Act makes intentional disclosure of ‘personal information’ obtained under a contract, without consent of the parties concerned and in breach of a lawful contract, punishable with imprisonment and fine. Rule 2(i) of the Sensitive Personal Data Rules define "personal information" to mean any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person. Thus, biometrics will form a part of “personal information”. The Section reads as under-
“72A. Punishment for disclosure of information in breach of lawful contract - Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person, shall be punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both.”
166) The Sensitive Personal Data Rules provide for additional requirements on commercial and business entities (body corporates as defined under Section 43A of the IT Act) relating to the collection and disclosure of sensitive personal data (including biometric information). The crucial requirements, which are Writ Petition (Civil) No. 494 of 2012 & connected matters Page 252 of 567 indicative of the principles for data protection that India adheres to, inter alia include:
(i) The body corporate or any person who on behalf of body corporate collects, receives, possesses, stores, deals or handle information of provider of information, shall provide a privacy policy for handling of or dealing in personal information including sensitive personal data or information and ensure that the same are available for view.
(ii) Body corporate or any person on its behalf shall obtain consent in writing from the provider of the sensitive personal data or information regarding purpose of usage before collection of such information.
(iii) Body corporate or any person on its behalf shall not collect sensitive personal data or information unless — (a) the information is collected for a lawful purpose connected with a function or activity of the body corporate or any person on its behalf; and (b) the collection of the sensitive personal data or information is considered necessary for that purpose
(iv) The person concerned has the knowledge of — (a) the fact that the information is being collected; (b) the purpose for which the information is being collected; (c) the intended recipients of the information; and (d) name and address of the agency Writ Petition (Civil) No. 494 of 2012 & connected matters Page 253 of 567 collecting and retaining the information.
(v) Body corporate or any person on its behalf holding sensitive personal data or information shall not retain that information for longer than is required for the purposes for which the information may lawfully be used or is otherwise required under any other law for the time being in force.
(vi) Information collected shall be used for the purpose for which it has been collected.
(vii) Body corporate or any person on its behalf shall, prior to the collection of information, including sensitive personal data or information, provide an option to the provider of the information to not to provide the data or information sought to be collected.
(viii) Body corporate shall address any discrepancies and grievances of their provider of the information with respect to processing of information in a time bound manner.
(ix) Disclosure of sensitive personal data or information by body corporate to any third party shall require prior permission from the provider of such information, who has provided such information under lawful contract or otherwise, unless such disclosure has been agreed to in the contract between the body corporate and provider of information, or where the disclosure is necessary for compliance of a legal obligation.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 254 of 567
(x) A body corporate or a person on its behalf shall comply with reasonable security practices and procedure i.e. implement such security practices and standards and have a comprehensive documented information security programme and information security policies that contain managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected with the nature of business. In the event of an information security breach, the body corporate or a person on its behalf shall be required to demonstrate, as and when called upon to do so by the agency mandated under the law, that they have implemented security control measures as per their documented information security programme and information security policies.
The above substantive and procedural safeguards are required for legal collection, storage and use of biometric information under the IT Act. They indicate the rigour with which such processes need to be carried out.
Position in other countries:
(a) EUGDPR (European Union General Data Protection Regulation)69 69 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Writ Petition (Civil) No. 494 of 2012 & connected matters Page 255 of 567 EUGDPR which was enacted by the EU in 2016 came into force on May 25, 2018 replacing the Data Protection Directive of 1995. It is an exhaustive and comprehensive legal framework that is aimed at protection of natural persons from the processing of personal data and their right to informational privacy. It deals with all kinds of processing of personal data while delineating rights of data subjects and obligations of data processors in detail. The following fundamental principles of data collection, processing, storage and use reflect the proportionality principle underpinning the EUGDPR -
(i) the personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject (principle of lawfulness, fairness, and transparency);
(ii) the personal data must be collected for specified, explicit, and legitimate purposes (principle of purpose limitation);
(iii) processing must also be adequate, relevant, and limited to what is necessary (principle of data minimization) as well as accurate and, where necessary, kept up to date (principle of accuracy);
(iv) data is to be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for Writ Petition (Civil) No. 494 of 2012 & connected matters Page 256 of 567 which the personal data are processed (principle of storage limitation);
(v) data processing must be secure (principle of integrity and confidentiality); and
(vi) data controller is to be held responsible (principle of accountability).
167) The EUGDPR under Article 9 prohibits the collection of biometric data unless except in few circumstances which include (but are not limited to) -
(a) there is an explicit consent by the party whose data is being collected. The consent should be freely given, which is clearly distinguishable in an intelligible and easily accessible form, using clear and plain language. This consent can be withdrawn at any time without affecting the actions prior to the withdrawal;
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law;
(c) processing relates to personal data which is manifestly made public by the data subject; and
(d) processing is necessary for reasons of substantial public Writ Petition (Civil) No. 494 of 2012 & connected matters Page 257 of 567 interest, and it shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
168) The Regulation also institutes rights of the data subject (the person whose data is collected), subject to exceptions, which include the data subject’s right of access to information about the purpose of collection of data, details of data controller and subsequent use and transfer of data, the data subject’s right to rectification of data, right to erasure or right to be forgotten, the data subject’s right to restriction of processing, the right to be informed, the right to data portability and the data subject’s right to object to illegitimate use of data.
(b) Biometric Privacy Act in the United States of America
169) Some States in the United States of America have laws regulating collection and use of biometric information. Illinois has passed Biometric Information Privacy Act (740 ILCS 14/1 or BIPA) in 2008. Texas has also codified the law for capture of use of biometric identifier (Tex. Bus. & Com. Code Ann. §503.001) in 2009. The Governor of the Washington State signed into law House Bill 1493 (“H.B. 1493”) on May 16, 2017, which sets forth Writ Petition (Civil) No. 494 of 2012 & connected matters Page 258 of 567 requirements for businesses who collect and use biometric identifiers for commercial purposes. BIPA, Illinois, for example makes it unlawful for private entities to collect, store, or use biometric information, such as retina/iris scans, voice scans, face scans, or fingerprints, without first obtaining individual consent for such activities. BIPA also requires that covered entities take specific precautions to secure the information.
(b) Case Laws:
170) In K.S. Puttaswamy’s judgment, all the Judges highlighted the importance of informational privacy in the age of easy access, transfer, storage and mining of data. The means of aggregation and analysis of data of individuals through various tools are explained. Chandrachud, J. observed that with the increasing ubiquity of electronic devices, information can be accessed, stored and disseminated without notice to the individual. Metadata and data mining make the individual’s personal information subject to private companies and the state. In this background, His Lordship discusses the necessity of a data protection regime for safeguarding privacy and protecting the autonomy of the individual. The following observations in the conclusion of the judgment are worth quoting: Writ Petition (Civil) No. 494 of 2012 & connected matters Page 259 of 567 “328. Informational privacy is a facet of the right to privacy.
The dangers to privacy in an age of information can originate not only from the state but from non-state actors as well. We commend to the Union Government the need to examine and put into place a robust regime for data protection. The creation of such a regime requires a careful and sensitive balance between individual interests and legitimate concerns of the state. The legitimate aims of the state would include for instance protecting national security, preventing and investigating crime, encouraging innovation and the spread of knowledge, and preventing the dissipation of social welfare benefits. These are matters of policy to be considered by the Union government while designing a carefully structured regime for the protection of the data. Since the Union government has informed the Court that it has constituted a Committee chaired by Hon’ble Shri Justice B N Srikrishna, former Judge of this Court, for that purpose, the matter shall be dealt with appropriately by the Union government having due regard to what has been set out in this judgment.”
171) S.K. Kaul, J. cited the European Union General Data Protection Regulations70 to highlight the importance of data protection and the circumstances in which restrictions on the right to privacy may be justifiable subject to the principle of proportionality. These include balance against other fundamental rights, legitimate national security interest, public interest including scientific or historical research purposes or statistical purposes, criminal offences, tax purposes, etc.
172) There are numerous case laws – both American and European – presented by the petitioners and the respondents with respect to 70 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Writ Petition (Civil) No. 494 of 2012 & connected matters Page 260 of 567 the collection, storage and use of biometric data which have been taken note of above. They are illustrative of the method and safeguards required to satisfy the proportionality principle while dealing with biometric data. The first set of cases cited by the petitioners are cases from European Human Rights Courts.
173) The European Human Rights legislations have both explicitly and through case laws recognized the right to informational privacy and data protection. The EU Charter of Fundamental Rights states in Article 7 that ‘everyone has the right to respect for his or her private and family life, home and communications’ and in Article 8 it grants a fundamental right to protection of personal data. The first article of the EU Charter affirms the right to respect and protection of human dignity. The ECHR also recognises the right to respect for private and family life, home and his correspondence which have been read to include protection of right to control over personal biometric information.
174) As pointed out above as well, a prominent case which addresses the question of storage of biometric data, i.e. whether storage and retention of DNA samples and fingerprints violates Article 8 of the ECHR, is S and Marper71. In this case, the storing of DNA 71 S and Marper v. United Kingdom [2008] ECHR 1581 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 261 of 567 profiles and cellular samples of any person arrested in the United Kingdom was challenged before the ECtHR. Even if the individual was never charged or if criminal proceedings were discontinued or if the person was later acquitted of any crime, their DNA profile could nevertheless be kept permanently on record without their consent.
175) In a unanimous verdict, the seventeen-judge bench held that there had been a violation of Article 8 of the ECHR. Fingerprints, DNA profiles and cellular samples, constituted personal data and their retention was capable of affecting private life of an individual. The retention of such data without consent, thus, constitutes violation of Article 8 as they relate to identified and identifiable individuals. It held that:
“84. …fingerprints objectively contain unique information about the individual concerned allowing his or her identification with precision in a wide range of circumstances. They are thus capable of affecting his or her private life and retention of this information without the consent of the individual concerned cannot be regarded as neutral or insignificant.”
176) It articulated the proportionality principle in the following words:
“101. An interference will be considered “necessary in a democratic society” for a legitimate aim if it answers a “pressing social need” and, in particular, if it is proportionate to the legitimate aim pursued and if the reasons adduced by the national authorities to justify it are "relevant and sufficient xx xx xx Writ Petition (Civil) No. 494 of 2012 & connected matters Page 262 of 567 The protection of personal data is of fundamental importance to a person's enjoyment of his or her right to respect for private and family life, as guaranteed by Article 8 of the Convention. The domestic law must afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article. The need for such safeguards is all the greater where the protection of personal data undergoing automatic processing is concerned, not least when such data are used for police purposes. The domestic law should notably ensure that such data are relevant and not excessive in relation to the purposes for which they are stored; and preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored … The domestic law must also afford adequate guarantees that retained personal data was efficiently protected from misuse and abuse.”
177) The issue in the case according to the Court was whether the retention of the fingerprints and DNA data of the applicants, as persons who had been suspected but not convicted of certain criminal offences, was justified under Article 8 of the Convention.
178) The Court held that such invasion of privacy was not proportionate as it was not “necessary in a democratic society” as it did not fulfill any pressing social need. The blanket and indiscriminate nature of retention of data was excessive and did not strike a balance between private and public interest. It held:
“125. the blanket and indiscriminate nature of the powers of retention of the fingerprints, cellular samples and DNA profiles of persons suspected but not convicted of offences, as applied in the case of the present applicants, fails to strike a fair balance between the competing public and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 263 of 567 private interests and that the respondent State has overstepped any acceptable margin of appreciation in this regard. Accordingly, the retention at issue constitutes a disproportionate interference with the applicants' right to respect for private life and cannot be regarded as necessary in a democratic society. This conclusion obviates the need for the Court to consider the applicants' criticism regarding the adequacy of certain particular safeguards, such as too broad an access to the personal data concerned and insufficient protection against the misuse or abuse of such data.”
179) The two crucial aspects of the case that need to be kept in mind are – First, in that case, the fingerprints were collected for criminal purposes and without the consent of the individual to whom the fingerprints belonged. Second, the fingerprints were to be stored indefinitely without the consent of the individual and that the individual did not have an option to seek deletion. These aspects were vital for the Court to decide that the retention violated the citizen’s right to privacy.
180) Similarly, in the Digital Ireland case72, the European Parliament and the Council of the European Union adopted Directive 2006/24/EC (Directive), which regulated Internet Service Providers’ storage of telecommunications data. It could be used to retain data which was generated or processed in connection with the provision of publicly available electronic communications services or of public communications network, for the purpose of 72 Digital Rights Ireland Ltd v Minister for Communication, Marine and Natural Resources [2014] All ER (D) 66 (Apr) Writ Petition (Civil) No. 494 of 2012 & connected matters Page 264 of 567 fighting serious crime in the European Union. The data included data necessary to trace and identify the source of communication and its destination, to identify the date, time duration, type of communication, IP address, telephone number and other fields.
The Court of Justice of European Court (CJEU) evaluated the compatibility of the Directive with Articles 7 and 8 of the Charter and declared the Directive to be invalid.
181) According to the CJEU, the Directive interfered with the right to respect for private life under Article 7 and with the right to the protection of personal data under Article 8 of the Charter of Fundamental Rights of the European Union. It allowed very precise conclusion to be drawn concerning the private lives of the persons whose data had been retained, such as habits of everyday life, permanent or temporary places of residence, daily and other movements, activities carried out, social relationships and so on. The invasion of right was not proportionate to the legitimate aim pursued for the following reasons:
(i) Absence of limitation of data retention pertaining to a particular time period and/or a particular geographical zone and/or to a circle of particular persons likely to be involved.
(ii) Absence of objective criterion, substantive and procedural Writ Petition (Civil) No. 494 of 2012 & connected matters Page 265 of 567 conditions to determine the limits of access of the competent national authorities to the data and their subsequent use for the purposes of prevention, detection or criminal prosecutions. There was no prior review carried out by a court or by an independent administrative body whose decision sought to limit access to the data and their use to what is strictly necessary for attaining the objective pursued.
(iii) Absence of distinction being made between the categories of data collected based on their possible usefulness.
(iv) Period of retention i.e. 6 months was very long being not based on an objective criterion.
(v) Absence of rules to protect data retained against the risk of abuse and against any unlawful access and use of that data.
(vi) Directive does not require the data in question to be retained within the European Union.
182) In Tele2 Sverige AB vs. Post-och telestyrelsen73, the CJEU was seized with the issue as to whether in light of Digital Rights Ireland, a national law which required a provider of electronic communications services to retain meta-data (name, address, telephone number and IP address) regarding users/subscribers for the purpose of fighting crime was contrary to Article 7, 8 and 73 Tele2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson, Peter Brice, Geoffrey Lewis, Joined Cases C-203/15 and C-698/15, 2016 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 266 of 567 11 of the EU Charter. The CJEU struck down the provision allowing collection of such meta data on grounds of lack of purpose limitation, data differentiation, data protection, prior review by a court or administrative authority and consent, amongst other grounds. It held:
“103. While the effectiveness of the fight against serious crime, in particular organised crime and terrorism (…) cannot in itself justify that national legislation providing for the general and indiscriminate retention of all traffic and location data should be considered to be necessary for the purposes of that fight.
xx xx xx
105. Second, national legislation (…) provides for no differentiation, limitation or exception according to the objective pursued. It is comprehensive in that it affects all persons using electronic communication services, even though those persons are not, even indirectly, in a situation that is liable to give rise to criminal proceedings. It therefore applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious criminal offences. Further, it does not provide for any exception, and consequently it applies even to persons whose communications are subject, according to rules of national law, to the obligation of professional secrecy.
xx xx xx if it is to be ensured that data retention is limited to what is strictly necessary, it must be observed that, while those conditions may vary according to the nature of the measures taken for the purposes of prevention, investigation, detection and prosecution of serious crime, the retention of data must continue nonetheless to meet objective criteria, that establish a connection between the data to be retained and the objective pursued. In particular, such conditions must be shown to be such as actually to circumscribe, in practice, the extent of that measure and, thus, the public affected.” Writ Petition (Civil) No. 494 of 2012 & connected matters Page 267 of 567
183) With respect to measures for data security and data protection the court held :
“122. Those provisions require those providers to take appropriate technical and organisational measures to ensure the effective protection of retained data against risks of misuse and against any unlawful access to that data. Given the quantity of retained data, the sensitivity of that data and the risk of unlawful access to it, the providers of electronic communications services must, in order to ensure the full integrity and confidentiality of that data, guarantee a particularly high level of protection and security by means of appropriate technical and organisational measures. In particular, the national legislation must make provision for the data to be retained within the European Union and for the irreversible destruction of the data at the end of the data retention period.”
184) In BVerfG74, the German Constitutional Court rendered on March 02, 2010 a decision by which provisions of the data retention legislation adopted for, inter alia, the prevention of crime were rendered void because of lack of criteria for rendering the data retention proportional.
185) In Maximillian Schrems v. Data Protection Commissioner75, the CJEU struck down the transatlantic US-EU Safe Harbor agreement that enabled companies to transfer data from Europe to the United States on the ground that there was not an adequate level of safeguard to protect the data. It held that the 74 2.03. 2010, 1 BvR 256 / 08 , 1 BvR 263 / 08 , 1 BvR 586 / 08 75 [2016] 2 W.L.R. 873 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 268 of 567 U.S. authorities could access the data beyond what was strictly necessary and proportionate to the protection of national security.
The subject had no administrative or judicial means of accessing, rectifying or erasing their data.
186) In Szabo and Vissy v. Hungary76, the ECtHR held unanimously that there had been a violation of Article 8 (right to respect for private and family life, the home and correspondence) of the European Convention on Human Rights. The case concerned Hungarian legislation on secret anti-terrorist surveillance introduced in 2011. The court held that the legislation in question did not have sufficient safeguards to avoid abuse. Notably, the scope of the measures could include virtually anyone in Hungary, with new technologies enabling the Government to intercept masses of data easily concerning even persons outside the original range of operation. Furthermore, the ordering of such measures was taking place entirely within the realm of the executive and without an assessment of whether interception of communications was strictly necessary. There were no effective remedial measures in place, let alone judicial ones. The court held:
“77. … Rule of law implies, inter alia, that an interference by the executive authorities with an individual right should 76 Eur. Ct. H.R. 2016 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 269 of 567 be subject to an effective control which should normally be assured by the judiciary, at least in the last resort…”
187) Thus, it is evident from various case laws cited above, that data collection, usage and storage (including biometric data) in Europe requires adherence to the principles of consent, purpose and storage limitation, data differentiation, data exception, data minimization, substantive and procedural fairness and safeguards, transparency, data protection and security. Only by such strict observance of the above principles can the State successfully discharge the burden of proportionality while affecting the privacy rights of its citizens.
188) The jurisprudence with respect to collection, use and retention of biometric information in the United States differs from the EU. In the US context, there is no comprehensive data protection regime. This is because of the federal system of American government, there are multiple levels of law enforcement―federal, state, and local. Different states have differing standards for informational privacy. Moreover, the U.S. has a sectoral approach to privacy, i.e. laws and regulations related to data differ in different sectors such as health sector or student sector. In most cases, however, the Fourth Amendment which prohibits “unreasonable searches and seizures” by the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 270 of 567 government has been read by courts to envisage various levels data protection.
189) At this juncture, we are not entering the debate as to whether the jurisprudence developed in United States is to be preferred or E.U. approach would be more suitable. Fact remains that importance to data protection in processing the data of the citizens is an accepted norm.
190) Observance of this fundamental principle is necessary to prevent a disproportionate infringement of the Fundamental Right of Privacy of a citizen. The question which now needs to be addressed is whether the Aadhaar Act and Rules incorporate these principles of data protection. We have already taken note of the provisions in the Act, which relate to data protection. However, a detailed analysis of the provisions of the Act needs to be undertaken for this purpose having regard to the principles that have emerged from case law in other jurisdiction and noted in paragraph 187 above.
Data Minimisation:
191) The petitioners have argued that the Act enables data collection indiscriminately regarding all aspects of a person (biometrics, Writ Petition (Civil) No. 494 of 2012 & connected matters Page 271 of 567 demographic details, authentication records, meta-data related to transaction) even though such data has no nexus to the purported object of subsidies, thus violating the principle of data minimization. The data collected is sufficient to indicate religion, class, social status, income, education and intimate personal details. Under Section 32 of the Act, authentication records are stored in the central database in the manner prescribed under the Regulations. Regulation 26 of the Authentication Regulations requires UIDAI to store “authentication transaction data” consisting of: (a) authentication request data received including PID block; (b) authentication response data sent; (c) meta data related to the transaction; and (d) any authentication server side configurations as necessary. The authentication record affords access to information that can be used and analyzed to systematically track or profile an individual and her activities.
192) As per the respondents, Aadhaar involves minimal identity information for effective authentication. Four types of information collected for providing Aadhaar:
(i) Mandatory demographic information comprising name, date of birth, address and gender [Section 2(k) read with Regulation 4(1) of the Aadhaar (Enrolment and Update) Regulations, 2016];
(ii) Optional demographic information [Section 2(k) read with Writ Petition (Civil) No. 494 of 2012 & connected matters Page 272 of 567 Regulation 4(2) of the Aadhaar (Enrolment and Update) Regulations, 2016];
(iii) Non-core biometric information comprising photograph;
(iv) Core biometric information comprising finger print and iris scan.
193) Demographic information, both mandatory and optional, and photographs does not raise a reasonable expectation of privacy under Article 21 unless under special circumstances such as juveniles in conflict of law or a rape victim’s identity. Today, all global ID cards contain photographs for identification alongwith address, date of birth, gender etc. The demographic information is readily provided by individuals globally for disclosing identity while relating with others and while seeking benefits whether provided by government or by private entities, be it registration for citizenship, elections, passports, marriage or enrolment in educational institutions. Email ids and phone numbers are also available in public domain, For example in telephone directories. Aadhaar Act only uses demographic information which are not sensitive and where no reasonable expectation of privacy exists - name, date of birth, address, gender, mobile number and e mail address. Section 2(k) specifically provides that Regulations Writ Petition (Civil) No. 494 of 2012 & connected matters Page 273 of 567 cannot include race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Thus, sensitive information specifically stand excluded.
194) We find that Section 32 (3) of the Aadhaar Act specifically prohibits the authority from collecting, storing or maintaining, either directly or indirectly any information about the purpose of authentication. The proviso to Regulation 26 of Authentication Regulations is also to the same effect.
195) Thus, the principle of data minimization is largely followed.
196) With this, we advert to some other provisions, challenge whereof is based on threat to security of the data. These are Section 2(c), Section 2(g) and Section 2(h) read with Section 10 of the Aadhaar Act. Section 2(c) pertains to authentication. It is a process by which Aadhaar number along with demographic information or biometric information of an individual is submitted to the CIDR for its verification. On submission thereof, the CIDR verifies the correctness or lack of it. CIDR is defined in Section 2(h). Section 10 lays down that the Authority may engage one or more entities to establish or maintain the CIDR and to perform any other functions as may be specified by regulations. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 274 of 567
197) Insofar as authentication process is concerned, that has already been taken note of above. The manner in which it is explained by the respondent authority, that may not pose much of a problem. As noted earlier, while seeking authentication, neither the location of the person whoso identity is to be verified nor the purpose for which authentication of such identity is needed, comes to the knowledge of the Authority and, therefore, such data collected by the Authority. Therefore, the threat to real time surveillance and profiling may be far-fetched. The respondents have explained that Section 2(d) defines “authentication record” to mean the record of the time of authentication, identity of the RE and the response provided by the authority”, Regulation 26 (a) to (d) does not go beyond the scope of Section 2(d). None of the four clauses of Regulation 26 entitle the authority to store data about the purpose for which authentication is being done. The device can therefore only tell the authority the identity of the RE, the PID, the time and nature of response, the code of the device and the authentication server side configurations. Identity of the RE does not include details of the organization which is seeking authentication as an RE provides authentication service to large number of government organizations who have agreements with it. Such a mechanism preventing the authority from tracking the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 275 of 567 nature of activity for which the authentication was required. To illustrate nic.in is an RE which provides authentication service to large number of Government organisations who have agreements with it. The authentication record would only contain information about the identity about the RE. It will give information only about the RE (nic.in) and not about the organisation which is requiring authentication through the RE. In most cases the authentication is one time. Mr. Dwivedi has also explained that yet again, there may be organisations, which have branches in different part of India. Assuming Apollo Hospital (although in fact it is not an RE) has five branches in India. If Apollo Hospital seeks authentication as an RE, the authentication record will merely tell the identity of Apollo Hospital and its device code, but it will not indicate which branch of Apollo was seeking authentication and from which part of the country. Further, assuming that the Indira Gandhi International Airport is an RE and there is requirement of authentication at the point of entry and/or exit. All that the record will show that the ANH has entered the airport at a particular time but it will not show by which plane he is flying and to what destination. At the time of exit, it will only show that the person has exited the airport at a particular time. It will not show from which flight he has arrived and from which Writ Petition (Civil) No. 494 of 2012 & connected matters Page 276 of 567 destination and at what time he has arrived or with whom he travelled.
198) However, other apprehension of the petitioners is that storing of data for a period of seven years as per Regulations 20 and 26/27 of the Aadhaar (Authentication) Regulations, 2016 is too long a period. We may reproduce Regulations 26 and 27 of the Aadhaar (Authentication) Regulations, 2016 hereunder:
“26. Storage and Maintenance of Authentication Transaction Data – (1) The Authority shall store and maintain authentication transaction data, which shall contain the following information:-
(a) authentication request data received including PID block;
(b) authentication response data sent;
(c) meta data related to the transaction;
(d) any authentication server side configurations as necessary:
Provided that the Authority shall not, in any case, store the purpose of authentication.
27. Duration of storage – (1) Authentication transaction data shall be retained by the Authority for a period of 6 months, and thereafter archived for a period of five years.
(2) Upon expiry of the period of five years specified in sub-
regulation (1), the authentication transaction data shall be deleted except when such authentication transaction data are required to be maintained by a court or in connection with any pending dispute.”
199) It is also submitted that Section 10 which authorises the Authority to engage one or more entities, which may be private entities, to Writ Petition (Civil) No. 494 of 2012 & connected matters Page 277 of 567 establish and maintain CIDR is a serious threat to privacy and it even amounts to compromise on national sovereignty and security. Insofar as first argument is concerned, there appears to be some force in that. If authentication is the only purpose, we fail to understand why this authentication record is needed to be kept for a period of 2+5 years. No satisfactory explanation in this behalf was given.
200) Insofar as information regarding metadata is concerned, we may note that the respondents distinguished between three types of meta-data :technical, business and process metadata. Process metadata describes the results of various operations such as logs key data, start time, end time, CPU seconds used, disk reads, disk writes, and rows processed. This data is valuable for purposes of authenticating transaction, troubleshooting , security, compliance and monitoring and improving performance. They submit that the metadata contemplated under this Regulation is Process metadata.
201) However, metadata is not defined in the Aadhaar Act. In common parlance, it is understood as information about data, example whereof was given by Mr. Sibal that the text of a message exchanged between two persons would be the data itself. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 278 of 567 However, surrounding circumstances like when the message was sent; from whom and to whom the message was sent; and location from which the message was sent would include meta data. As noted above, Mr. Dwivedi had tried to explain it away by stating that there are three types of meta data, namely, technical, business and process meta data. According to him, meta data under the Aadhaar Act refers to only process meta data. In support, he had referred to Section 2(d) of the Aadhaar Act which defines ‘authentication record’ to mean the record of the time of authentication, identity of requesting entity and the response provided by the Authority. He, thus, submitted that Regulation 26 would not go beyond Section 2(d). However, aforesaid explanation that meta data refers to process data only does not find specific mention. There is, thus, need to amend Regulation 26 to restrict it to process meta data, and to exclude other type of meta data specifically.
Purpose Limitation:
202) As per the petitioners, there is no purpose limitation. Identity information collected for one purpose under the Act can be used for any other (new) purpose. Definition of “benefit” (Section 2(f)) and “service” (Section 2(w)) and “subsidy” (Section Writ Petition (Civil) No. 494 of 2012 & connected matters Page 279 of 567 2(x)), to which the personal data collected is supposed to be applied is not identifiable. It is open to the executive to notify that any advantage, gift, reward, relief, payment, provision, facility, utility or any other assistance aid, support, grant subvention, or appropriation may be made conditional on Aadhaar Authentication. Moreover, under Section 57, the State, a body corporate or any person can avail authentication facility and access information under CIDR. This creates an open ended and unspecified set of laws and contracts for which Aadhaar can be used and defeats the principle of informed consent at the time of enrolment and purpose limitation.
203) Respondents controvert the aforesaid submission by arguing that there is purpose limitation under the Aadhaar Act as purpose of use of biometric data in the CIDR is limited to authentication for identification. The Aadhaar holder is made aware of such use of the Aadhaar card at the time of enrolment. The enrolling agency is obliged under the Enrolment Regulations to inform the individual about the manner in which the information shall be used, the nature of recipients with whom the information is to be shared during authentication; and the existence of a right to access information, the procedure for making request for such Writ Petition (Civil) No. 494 of 2012 & connected matters Page 280 of 567 access and details of the person/ department to whom request can be made. This information to individual is the basis for his consent for enrolment.
204) As per the respondents, Section 57 is not an enabling provision which allows Aadhaar to be used for purposes other than Section 7, but is a limiting provision. It limits its use by State, Body Corporate or a person by requiring it to be sanctioned by any law in force or any contract and making the use subject to the proviso to Section 57. The proviso requires the use of Aadhaar under this Section to be subject to procedure and obligations under Section 8 and Chapter VI of penalties. Section 8(2)(a) requires Requesting Entities (RE) (parties authorized to carry out authentication under Section 57) to obtain the consent of an individual before collecting her identity information for the purposes of authentication in such manner as may be specified by regulations. Section 8(3) enables this consent to be informed consent by requiring that an individual submitting her identity information for authentication shall be informed of the nature and the use of the information that may be shared upon authentication and the alternatives to submission of identity information to the requesting entity. This aspect is discussed in Writ Petition (Civil) No. 494 of 2012 & connected matters Page 281 of 567 detail at a later stage, as it touches upon privacy aspects as well.
Suffice it is to mention here that we have found some portion of Section 57 as offending and declared that unconstitutional.
Insofar as Sections 2(f), (w) and (x) are concerned, these provisions are discussed at a later stage 77. We would like to mention here that we have read down these provisions. The aforesaid measure would subserve the purpose limitation as well. Time Period for Data Retention:
205) We have touched upon this aspect hereinabove. According to petitioners, the data is allowed to be retained for an unreasonable long period of time. Regulation 27 of the Authentication Regulations requires the UIDAI to retain the “authentication transaction data” (which includes the meta data) for a period of 6 months and to archive the same for a period of 5 years thereafter. Regulation 18(3) and 20(3) allow Requesting entities (RE) and Authentication Service Agencies to retain the authentication logs for a period of 2 years and then archive them for 5 years. It is required to be deleted only after 7 years unless retained by a court. The right of the citizen to erasure of data or right to be forgotten is severely affected by such regulation. There is no provision to delete the biometric information in any 77 See paragraphs 320 to 322 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 282 of 567 eventuality once a person is enrolled.
We do not find any reason for archiving the authentication transaction data for a period of five years. Retention of this data for a period of six months is more than sufficient after which it needs to be deleted except when such authentication transaction data are required to be maintained by a Court or in connection with any pending dispute. Regulations 26 and 27 shall, therefore, be amended accordingly.
Data Protection and Security:
206) Petitioners argued that there are not enough safeguards for data protection and security in the Act. Section 28 of the Act which addresses security and confidentiality of information is vague and fails to lay down any standard of data security or prescribe any cogent measures which are to be taken to prevent data breaches. Section 54 empowers UIDAI to make regulations related to various data management processes, security protocol and other technology safeguards. The Aadhaar (Data Security) Regulations, 2016 passed by UIDAI under Section 54, vest in the authority a discretion to specify “an information security policy” (Regulation 3). This leads to excessive delegation. Alternatively, it has not been subject to parliamentary oversight which Writ Petition (Civil) No. 494 of 2012 & connected matters Page 283 of 567 Regulations under Section 54 require. Further, the CIDR central database, unlike the ASAs and REs (under Authentication Regulation 22(1)), are not required to be located in data centres. The personal data is accessible by private entities such as AUAs and KUAs and other private entities such as banks, insurance companies and telecom service providers. There have been numerous data breaches in the Aadhaar system. These establish its vulnerability. There are not enough safeguards from data hack and data leak. The data is being used by private parties to build comprehensive databases containing information and profiles of individuals. Thus the project also lacks transparency of data and its use.
207) The Respondents contend that strong measures for data protection and security, taken at all stages of data collection, transfer, storage and use.
After deliberating over respective contentions, we are of the opinion that the following explanation furnished by the respondents on various facets ensures data protection and security to a considerable extent:
(a) CIDR
208) Regulation 3(i) & (j) of Aadhaar (Data Security) Regulation 2016 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 284 of 567 enables partitioning of CIDR network into zones based on risk and trust and other security measures. CIDR being a computer resource is notified to be a “Protected System” under Section 70 of the IT Act, 2000 by the Central Government on 11.12.2015. Anyone trying to unlawfully gain access into this system is liable to be punished with 10 years imprisonment and fine. The storage involves end to end encryption, logical partitioning, firewalling and anonymisation of decrypted biometric data. Breaches of penalty are made punitive by Chapter VII of the Act. Biometric information is deemed to be an “electronic record”, and “Sensitive personal data or information” under the IT Act, 2000. There are further guards under The Aadhaar ( Data Security )Regulation, 2016.
(b) Requesting Entities (AUA and KUA)
209) Other identity information is shared with Requesting Entity (AUAs and KUAs) only for the limited purpose of authentication. The data is transferred from the RE to the ASA (Authentication Service Agency) to the CIDR in an encrypted manner through a leased line circuitry using secure Protocols (Regulation 9 of the Authentication Regulations). The storage of data templates is in safely located servers with no public internet inlet/outlet, and offline storage of original encrypted data (PID blocks). There are Writ Petition (Civil) No. 494 of 2012 & connected matters Page 285 of 567 safety and security provisions such as audit by Information Systems Auditor. REs are appointed through agreement. REs can enter into agreement with sub-AUA or sub-KUA with permission of the of UIDAI. Whatever identity information is obtained by the requesting entity is based on a specific consent of the Aadhaar number holder. The e-KYC data shared with the RE can only be after prior consent of the Aadhaar holder. Such data cannot be shared and has to be stored in encrypted form. The biometric information used is not permitted to be stored only the logs of authentication transactions are maintained for a short period. Full identity information is never transmitted back to RE. There is a statutory bar from sharing Biometric information [Section 29(1)(a)/ Section 29(4)]. The Data centres of ASA, REs and CIDR should be within the territory of India.
(c) Enrolment Agencies and Registrars
210) The enrolment and Authentication processes are strongly regulated so that data is secure. The Enrolment agency, which collects the biometric and demographic of the individuals during enrolment, is appointed either by UIDAI or by a Registrar [Section 2(s)]. The registrar are appointed through MoUs or agreements for enrolment and are to abide by a code of conduct and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 286 of 567 processes, policies and guidelines issued by the authority. They are responsible for the process of enrolment. Categories of persons eligible for appointment are limited by the Regulations. The agency employees a certified supervisor, an operator and a verifier under Enrolment and Update Regulations. Registrars, enrolling agencies are obliged to use the software provided or authorized by UIDAI for enrolment purpose. The standard software has security features as specified by Authority. All equipment used are as per the specification issued by the authority. The Registrars are prohibited from using the information collected for any purpose other than uploading the information to CIDR. Sub-contracting of enrolment function is not allowed. The Code of Conduct contains specific directions for following the confidentiality, privacy and security protocols and submission of periodic reports of enrolment. Not only there are directions prohibiting manipulation and fraudulent practices but the Act contains penal provisions for such violations in Chapter VII of the Regulations. The enrolment agencies are empanelled by the authority. They are given an enrolling agency code using which the Registrar can onboard such agency to the CIDR. The enrolment data is uploaded to the Central Identities Data Repository (CIDR) certified equipment and software with a digital Writ Petition (Civil) No. 494 of 2012 & connected matters Page 287 of 567 signature of the registrar/enrolling agency. The data is encrypted immediately upon capture. The decryption key is with the UIDAI solely. Section 2(ze) of the IT Act, which defines ‘secure systems’ and Section 2(w) of the Act, which defines ‘intermediaries’ apply to the process.
(d) Authentication Service Agency
211) Authentication only becomes available through the Authentication Service Agency (ASA). They are regulated by the Aadhaar (Authentication) Regulations, 2016. Their role and responsibilities are provided by Authentication Regulation 19. They are to use certified devices, equipment, or software are duly registered with or approved or certified by the Authority/agency. The systems and operations are audited by information system auditor. The REs pass the encrypted data to the CIDR through the ASA and the response (Yes/No authentication or e-KYC information) also takes the same route back. The server of the ASA has to perform basic compliance and completeness checks on the authentication data packet before forwarding it to the CIDR.
(e) Hacking
212) As far as hacking is concerned, the respondents submit that the authority has involved adequate firewalling and other safety Writ Petition (Civil) No. 494 of 2012 & connected matters Page 288 of 567 features. The biometric data stored in the CIDR is stored offline.
Only templates are online. So far there has been no incidence of hacking. However, the authority is conscious of the hackers and it constantly updates itself to safe guard the data.
It may, however, be mentioned that of late certain reports have appeared in newspapers to the effect that some people could hack the website of CIDR, though it is emphatically denied by the UIDAI. Since there are only newspapers reports to this effect which appeared after the conclusion of hearing in these cases and, therefore, parties could not be heard on this aspect, we leave this aspect of the matter at that with a hope that CIDR would find out the ways and means to curb any such tendency.
(f) Biometric Solution Providers
213) With respect to foreign companies owning software, Respondents submit that UIDAI has entered into licensing agreements with foreign biometric solution providers (BSP) for software. Even thought the source code of the software are retained by the BSP as it constitutes their Intellectual property, the data in the server rooms is secure as the software operates automatically and the biometric data is stored offline. There is no opportunity available to BSP to extract data as they have no access to it. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 289 of 567 Substantive, Procedural or Judicial Safeguards:
214) Another grievance of the petitioners is that the Act lacks any substantive, procedural or judicial safeguards against misuse of individual data. Section 23(2)(k) which allows sharing information of Aadhaar holders, in such manner as may be specified by regulations. This means individual’s identity information can be shared with the government. This may include demographic and core biometric information, include aspects such as DNA profiles, handwriting, voice-print etc., (in the future). Subsequent linkage with various state and non-state actors that interact with such individual may enable UIDAI to share greater information. The police can easily gain access to all biometric information, bank accounts of the individual, all mobile phones, and meta data associated with any associated linkages, information relating to all mutual funds, policies etc., information relating to travel by air or by rail by such person and so on.
215) In other cases of collection of information of this kind under other laws, there are exhaustive legal procedures. For example, Section 73 of the Indian Evidence Act, 1872 which allows the taking of handwriting samples only if necessary “for the purposes of any (specific ) investigation”, or in order to compare writing or Writ Petition (Civil) No. 494 of 2012 & connected matters Page 290 of 567 signature that appears in relation to the facts of a particular case.
Section 53 of the CrPC allows medical examination of a person arrested on a charge of committing an offence if reasonable grounds exist for believing that an examination of his person will afford evidence as to the commission of the offence. Similarly provisions in various other statutes such as of the Foreign Exchange Regulation Act, 1973 (Sections 34-48); the Prevention of Money-Laundering Act, 2002 (Sections 17-19); the Narcotic Drugs and Psychotropic Substances Act, 1985 (Sections 41-42) and the Customs Act, 1962 (Chapter 13) which allow for search, seizure or even arrest, and thereby provide access to personal information also bear a nexus with a particular crime under investigation.
216) As per the petitioners, the Investigating Agency can presently access fingerprints, only limited to cases of citizens who were arrested on the reasonable basis of having committed a crime, or were convicted of a crime, as per provisions of the Identification of Prisoners Act. In all such circumstances, not only are there adequate safeguards- such as permission from the Magistrate that collection is necessary for the purpose of investigation, but persons accused of an offence presently can claim protection Writ Petition (Civil) No. 494 of 2012 & connected matters Page 291 of 567 under Article 20(3), thereby making it incumbent upon the investigating agency to obtain such information in accordance with law, as described above. Further, unlike the Aadhaar Act, present day criminal statutes contain provisions for destruction of some kinds of core biometric data obtained [Section 7 of the Identification of Prisoners Act, 1920]. No such safeguards exist under the Aadhaar Act.
217) It is also argued that Section 33(2), which permits disclosure of identity information and authentication records under direction of an officer not below the rank of Jt. Secretary to Central Government in the interest of national security, has no provision for judicial review. The Oversight Committee does not have a judicial member.
218) Respondents submitted that Section 29 of the Aadhaar Act provides protection against disclosure of core biometric information. The biometric information cannot shared with anyone for any reason whatsoever; or used for any purpose other than generation of Aadhaar numbers and authentication under this Act. Section 8 ensure that the during authentication, biometric information of an individual is only used for submission to the Central Identities Data Repository.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 292 of 567
219) We are of the view that most of the apprehensions of the petitioners stand assuaged with the treatment which is given by us to some of the provisions. Some of these are already discussed above and some provisions are debated in the next issue. Summary thereof, however, can be given hereunder:
(a) Authentication records are not to be kept beyond a period of six months, as stipulated in Regulation 27(1) of the Authentication Regulations. This provision which permits records to be archived for a period of five years is held to be bad in law.
(b) Metabase relating to transaction, as provided in Regulation 26 of the aforesaid Regulations in the present form, is held to be impermissible, which needs suitable amendment.
(c) Section 33 of the Aadhaar Act is read down by clarifying that an individual, whose information is sought to be released, shall be afforded an opportunity of hearing.
(d) Insofar as Section 33(2) of the Act in the present form is concerned, the same is struck down.
(e) That portion of Section 57 of the Aadhaar Act which enables body corporate and individual to seek authentication is held to be unconstitutional. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 293 of 567
(f) We have also impressed upon the respondents, as the discussion hereinafter would reveal, to bring out a robust data protection regime in the form of an enactment on the basis of Justice B.N. Srikrishna (Retd.) Committee Report with necessary modifications thereto as may be deemed appropriate.
220) With the removal of the aforesaid provisions from the statute and the Rules, coupled with the statement of the Authority on affidavit that there is no record of any transactions carried out by the individuals which is even known (and, therefore, no question of the same being retained by the Authority), most of the apprehensions of the petitioners are taken care of. At the same time, we may remind ourselves of the judgment in G. Sundarrajan v. Union of India & Ors.78. In that case, the Court noted the safety and security risk in the setting up of the nuclear power plant in the backdrop of Fukushima disaster and Bhopal Gas tragedy. Yet, keeping in view the importance of generation of nuclear energy, the Court observed that a balance should be struck between production of nuclear energy which was of extreme importance for the economic growth, alleviation of poverty, generation of employment, and the smaller violation to 78 (2013) 6 SCC 620 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 294 of 567 right to life under Article 21. It took note of the opinion of experts committee and observed that ‘adequate safety measure’ have been taken. It noted huge expenditure of money running into crores and observed ‘apprehension however legitimate it may be, cannot override the justification of the project. Nobody on this earth can predict what would happen in future and to a larger extent we have to leave it to the destiny. But once the justification test is satisfied, the apprehension test is bound to fail. Apprehension is something we anticipate with anxiety or fear, a fearful anticipation, which may vary from person to person’. The Court also held that ‘nuclear power plant is being established not to negate right to life but to protect the right to life guaranteed under Article 21 of the Constitution. No doubt, the Court took a view that this interest of people needed to be respected for their human dignity which was divinity. However, it was also stressed that generation of nuclear energy was a nuclear necessity and the project was for larger public benefit and consequently, individual interest or smaller public interest must yield. In such a situation, necessity for ‘adequate care, caution, and monitoring at every stage’ and ‘constant vigil’ was emphasised. Safety and security was read into Article 21. Acknowledging that proportionality of risk may not be ‘zero’, regard being had to the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 295 of 567 nature’s unpredictability, the Court ruled that all efforts must be made to avoid disaster by observing the highest degree of constant alertness. In the directions of the Court, it was observed that ‘maintaining safety is an ongoing process not only at the design level but also during the operation’. In the present case as well, we have come to the conclusion that Aadhaar Act is a beneficial legislation which is aimed at empowering millions of people in this country. The justification of this project has been taken note of in detail, which the subsequent discussion shall also demonstrate. In such a scenario only on apprehension, the project cannot be shelved. At the same time, data protection and data safety is also to be ensured to avoid even the remote possibility of data profiling or data leakage.
221) Notwithstanding the statutory provision discussed above, we are of the view that there is a need for a proper legislative mechanism for data protection. The Government is not unmindful of this essential requirement. During the arguments it was stated by Mr. K.K. Venugopal, learned Attorney General, that an expert committee heading by Justice B.N. Srikrishna (Retd.) was constituted which was looking into the matter. The said Committee has since given its report.
Writ Petition (Civil) No. 494 of 2012 & connected matters Page 296 of 567
222) In this behalf, it may be worthwhile to mention that one of the first comprehensive reports on data protection and informational privacy was prepared by the Group of Experts 79 constituted by the Planning Commission of India under the Chairmanship of Retd. Justice A.P. Shah, which submitted a report on 16 October, 2012. The five salient features of this report were expected to serve as a conceptual foundation for legislation protecting privacy. The framework suggested by the expert group was based on five salient features: (i) Technological neutrality and interoperability with international standards; (ii) Multi-Dimensional privacy; (iii) Horizontal applicability to state and non-state entities;
(iv) Conformity with privacy principles; and (v) A co-regulatory enforcement regime.
223) The Union Government, on 31 July 2017, had constituted a committee chaired by Retd.Justice B N Srikrishna, former Judge of the Supreme Court of India to review data protection norms in the country and to make recommendations. The Committee recently released its report and the first draft of the Personal Data Protection Bill, 2018 which comprehensively addresses the processing of personal data where such data has been collected, 79 “Report of the Group of Experts on Privacy” (16 October, 2012), Government of India, available at http://planningcommission.nic.in/reports/genrep/rep_privacy.pdf Writ Petition (Civil) No. 494 of 2012 & connected matters Page 297 of 567 disclosed, shared or otherwise processed within the territory of India. The bill has incorporated provisions and principles from the Europe’s General Data Protection Regulation (EUGDPR).
224) The Draft Bill replaces the traditional concepts of data controller i.e. the entity which processes data and data subject i.e. the natural person whose data is being collected, with data ‘fiduciary’ and data ‘principal’. It aims to create a trust-based relationship between the two.
225) The Bill largely incorporates data protection principles from the EUGDPR and EU data protection jurisprudence, including fair and reasonable processing of data, purpose limitation, collection limitation, lawful processing, storage limitation, data quality and accountability. The Draft bill and the report cull out rights and obligations of the data fiduciary and data controller respectively. These rights include the right to access and correction, the right to data portability and right to be forgotten – a right to prevent or restrict disclosure of personal data by a fiduciary. Most importantly, consent has been given a crucial status in the draft data protection law. Thus, a primary basis for processing of personal data must be individual consent. This consent is required to be free, informed, specific, clear and, in an important Writ Petition (Civil) No. 494 of 2012 & connected matters Page 298 of 567 addition, capable of being withdrawn. The Authority under the Bill is obligated and empowered to ensure protection of data from misuse and compromise.
226) Processing of biometric data, classified as ‘Sensitive Personal Data’ (SPD), by the data fiduciary mandates additional safeguards (mentioned under Chapter IV of the Bill). For example, the data fiduciary is required to undertake Data Protection Impact Assessment under the provisions of the Bill. The Draft Bill allows processing of biometric data for the exercise of any function of the State authorised by law for the provision of any service or benefit to the data principal. Special provisions to protect sensitive and personal data of children also exist. For example, Data fiduciaries shall be barred from profiling, tracking, or behavioural monitoring of, or targeted advertising directed at, children and undertaking any other processing of personal data that can cause significant harm to the child.
227) For security of data and protection of breach, the Draft Bill has separate provisions which require use of methods such as de- identification and encryption and other steps necessary to protect the integrity of personal data and to prevent misuse, unauthorised access to, modification, disclosure or destruction of personal Writ Petition (Civil) No. 494 of 2012 & connected matters Page 299 of 567 data. The data fiduciary is required to immediately notify the Authority of any personal data breach relating to any personal data processed by the data fiduciary where such breach is likely to cause harm to any data principal. It also incorporates a provision for Grievance Redressal.
228) The Draft Bill creates several exceptions and exemptions for processing data by the State. These are situations where rights and obligations of data principals and data fiduciaries may not apply in totality. Such situations include national security, prevention of crime, allocation of resources for human development, protection of revenue, etc. The committee asserts that such exceptions have been envisaged in the Puttaswamy judgement as legitimate interests of the state and satisfy the proportionality test.
229) The Srikrishna Committee Report and the Draft Data Protection Bill are the first articulation of a data protection law in our country. They have incorporated many of the progressive data protection principles inspired by the EUGDPR. There may be indeed be scope for further fine tuning of this law through a consultative process, however, we are not far away from a comprehensive data protection regime which entrenches informational and data Writ Petition (Civil) No. 494 of 2012 & connected matters Page 300 of 567 privacy within our laws and legal system. We hope that there would be a robust statutory regime in place in near future.
230) The aforesaid discussion leads us to hold that the protection that there is going to be a surveillance state created by the Aadhaar project is not well founded, and in any case, taken care of by the diffluence exercise carried out with the striking down certain offending provisions in their present form. Privacy:
Whether Aadhaar Act violates right to privacy and is unconstitutional on this ground?
(This issue is considered in the context of Section 7 and Section 8 of the Act.)
231) The petitioners submit that right to privacy and dignity and individual autonomy have been established by various cases. In Gobind v. State of M.P.80, this Court held:
“the significance of man's spiritual nature, of his feelings and of his intellect and that only a part of the pain, pleasure, satisfaction of life can be found in material things and therefore they must be deemed to have conferred upon the individual as against the Government, a sphere where he should be let alone.
xx xx xx
24. Any right to privacy must encompass and protect the personal intimacies of the home, the family, marriage, motherhood, procreation and child rearing. This catalogue approach to the question is obviously not as instructive as it does not give analytical picture of the distinctive characteristics of the right of privacy. Perhaps, the only 80 (1975) 2 SCC 148 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 301 of 567 suggestion that can be offered as unifying principle underlying the concept has been the assertion that a claimed right must be a fundamental right implicit in the concept of ordered liberty.
25. Rights and freedoms of citizens are set forth in the Constitution in order to guarantee that the individual, his personality, and those things stamped with his personality shall be free from official interference except where a reasonable basis for intrusion exists. “Liberty against Government” a phrase coined by Professor Corwin expresses this idea forcefully. In this sense, many of the fundamental rights of citizens can be described as contributing to the right to privacy.
26. As Ely says:
“There is nothing to prevent one from using the word ‘privacy’ to mean the freedom to live one's life without governmental interference. But the Court obviously does not so use the term. Nor could it, for such a right is at stake in every case.”
232) To recapitulate briefly, the judgment of K.S. Puttaswamy has affirmed the following –
(i) privacy has always been a natural right, and the correct position has been established by a number of judgments starting from Gobind. Privacy is a concomitant of the right of the individual to exercise control over his or her personality. Equally, privacy is the necessary condition precedent to the enjoyment of any of the guarantees in Part III. The fundamental right to privacy would cover at least three aspects—(i) intrusion with an individual’s physical body, (ii) informational privacy and (iii) privacy of choice. Further, one aspect of privacy is the right to Writ Petition (Civil) No. 494 of 2012 & connected matters Page 302 of 567 control the dissemination of personal information. Every individual should have a right to be able to control exercise over his/her own life and image as portrayed in the world and to control commercial use of his/her identity.
(ii) The sanctity of privacy lies in its functional relationship with dignity. Privacy ensures that a human being can lead a life of dignity by securing the inner recesses of the human personality from unwanted intrusions. While the legitimate expectation of privacy may vary from intimate zone to the private zone and from the private to the public arena, it is important to underscore that privacy is not lost or surrendered merely because the individual is in a public place. Privacy is a postulate of dignity itself. Privacy concerns arise when the State seeks to intrude into the body and the mind of the citizen.
(iii) Privacy as intrinsic to freedom, liberty and dignity. The right to privacy is inherent to the liberties guaranteed by Part-III of the Constitution and privacy is an element of human dignity. The fundamental right to privacy derives from Part-III of the Constitution and recognition of this right does not require a constitutional amendment. Privacy is more than merely a derivative constitutional right. It is the necessary basis of rights guaranteed in the text of the Constitution.Writ Petition (Civil) No. 494 of 2012 & connected matters Page 303 of 567
(iv) Privacy has both positive and negative content. The negative content restrains the State from committing an intrusion upon the life and personal liberty of a citizen. Its positive content imposes an obligation on the State to take all necessary measures to protect the privacy of the individual.
(v) Informational Privacy is a facet of right to privacy. The old adage that ‘knowledge is power’ has stark implications for the position of individual where data is ubiquitous, an all- encompassing presence. Every transaction of an individual user leaves electronic tracks, without her knowledge. Individually these information silos may seem inconsequential. In aggregation, information provides a picture of the beings. The challenges which big data poses to privacy emanate from both State and non-State entities.
(vi) Right to privacy cannot be impinged without a just, fair and reasonable law. It has to fulfil the test of proportionality i.e. (i) existence of a law (ii) must serve a legitimate State aim and (iii) proportionate.
233) We have also remarked, in paragraph 85 above, the taxonomy of privacy, namely, on the basis of ‘harms’, ‘interest’ and ‘aggregation of rights’. We have also discussed the scope of right to privacy with reference to the cases at hand and the Writ Petition (Civil) No. 494 of 2012 & connected matters Page 304 of 567 circumstances in which such a right can be limited. In the process, we have also taken note of the passage from the judgment rendered by Nariman, J. in K.S. Puttaswamy stating the manner in which law has to be tested when it is challenged on the ground that it violates the fundamental right to privacy. Keeping in mind all these considerations and parameters, we proceed to deal with the argument on right to privacy.
234) It is argued that the Aadhaar project, during the pre-Act period (2009/10 – July, 2016), violated the Right to Privacy with respect to personal demographic as well as biometric information collected, stored and shared as there was no law authorizing these actions. In a digital society an individual has the right to protect herself by controlling the dissemination of such personal information. Compelling an individual to establish her identity by planting her biometric at multiple points of service violates privacy involving the person. The seeding of Aadhaar in distinct data bases enables the content of information about an individual that is stored in different silos to be aggregated. This enables the State to build complete profiles of individuals violating privacy through the convergence of data.
235) It is also contended that the citizen’s right to informational privacy Writ Petition (Civil) No. 494 of 2012 & connected matters Page 305 of 567 is violated by authentication under the Aadhaar Act inasmuch as the citizen is compelled to ‘report’ her actions to the State. Even where a person is availing of a subsidy, benefit or service from the State under Section 7 of the Act, mandatory authentication through the Aadhaar platform (without an option to the citizen to use an alternative mode of identification) violates the right to informational privacy. An individual’s rights and entitlements cannot be made dependent upon an invasion of his or her bodily integrity and his or her private information which the individual may not be willing to share with the State. The bargain underlying section 7 is an unconscionable, unconstitutional bargain. Section 7 is against the constitutional morality contained in both Part III as well the Part IV of the Constitution of India.
236) It was also highlighted that today the fastest growing businesses are network orchestrators, the likes of Facebook and Uber, which recreate a network of peers in which participants interact and share value in creation. The most important assets for these network orchestrators is information. Although, individuals share information with these entities, such information is scattered, not concentrated in a single authority or aggregated. If information, collected in different silos is aggregated and centralized, it can afford easy access to a person’s complete profile, including her Writ Petition (Civil) No. 494 of 2012 & connected matters Page 306 of 567 social groups, proclivities, habits, inclinations, tastes etc. The entity that holds the key to such information would then be in an extremely powerful position, especially if such entity is the State. Since informational privacy is a part of Right to Privacy, it had to be saved. The peittioners pointed out that the significance of information being aggregated was noted by Hon’ble Court in K.S. Puttaswamy as follows:
“300 ...Yet every transaction of an individual user and every site that she visits, leaves electronic tracks generally without her knowledge. These electronic tracks contain powerful means of information which provide knowledge of the sort of person that the user is and her interests. Individually, these information silos may seem inconsequential. In aggregation, they disclose the nature of the personality: food habits, language, health, hobbies, sexual preferences, friendships, ways of dress and political affiliation. In aggregation, information provides a picture of the being: of things which matter and those that don't, of things to be disclosed and those best hidden… xx xx xx
305. Daniel J Solove deals with the problem of "aggregation". Businesses and governments often aggregate a variety of information fragments, including pieces of information which may not be viewed as private in isolation to create a detailed portrait of personalities and behaviour of individuals. Yet, it is now a universally accepted fact that information and data flow are "increasingly central to social and economic ordering". Individuals are identified with reference to tax records, voting eligibility, and government-provided entitlements.
There is what is now described as "'veillant panoptic assemblage', where data gathered through the ordinary citizen's veillance practices finds its way to state surveillance mechanisms, through the corporations that hold that data.” Writ Petition (Civil) No. 494 of 2012 & connected matters Page 307 of 567
237) It was further argued that test of proportionality was not satisfied as the extent of information collected is not proportionate to the ‘compelling interest of the State’. Various judgments were citied where the principle of proportionality has been established by this court. In Chairman, All India Railway Recruitment Board v. K Shyam Kumar and others81, this Court held as follows:
“37. ...Proportionality requires the court to judge whether action taken was really needed as well as whether it was within the range of courses of action which could reasonably be followed. Proportionality is more concerned with the aims and intention of the decision-maker and whether the decision-maker has achieved more or less the correct balance or equilibrium. The court entrusted with the task of judicial review has examine whether decision taken by the authority is proportionate i.e. well balanced and harmonious, to this extent the court may indulge in a merit review and if the court finds that the decision is proportionate, it seldom interferes with the decision taken and if it finds that the decision is disproportionate i.e. if the court feels that it is not well balanced or harmonious and does not stand to reason it may tend to interfere.”
238) Attention was also drawn to the judgment in Modern Dental College & Research Centre, wherein this Court established the four-limb test of proportionality. It was argued that Aadhaar failed to meet the test laid down therein.
239) According to the petitioners, there is no compelling state interest for State to know the details of the location and time of using Aadhaar authentication. Likewise, there are various other 81 (2010) 6 SCC 614 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 308 of 567 methods available for identification. Submission was that one of the objects of the Aadhaar project is to ensure targeted delivery in the disbursement of government subsidies benefits and services in India. Identification for this purpose can be carried out by various other identity documents issued by the government of India, such as passport, voting card, ration card, driving license, job card issued by NREGA duly signed by an officer of the State government, employment certificate by a public authority, birth certificate, school leaving certificate, PAN card, overseas Indian citizen card/PIO/OCI of Indian origin card. There is no justification to impose Aadhaar under as the exclusive means of identification under Section 7, without which a person would be unable to secure her entitlements. Such mandate would not only infringe upon the privacy of a person and violate a person’s fundamental rights, but would also unreasonably deprive a person of her entitlements on a ground that has little connection with her right to receive such entitlements.
240) Judgment in the case of Jordan & Ors v. State82 was also cited wherein Sachs & O’Regan JJ. concurringly held that continuum of privacy rights start with the inviolable inner self, move to the home, and end with the public realm; and that 82 (2002) ZACC 22 Writ Petition (Civil) No. 494 of 2012 & connected matters Page 309 of 567 commitment to dignity invests great value in the inviolability and worth of the body. Decisional privacy allows individuals to make decisions about their own body, and is an aspect of right to self determination. It is underscored by personal autonomy, which prevents the State from using citizens as puppets and controlling their body and decisions. Informational privacy deals with a person’s mind and comprises of (i) anonymity, (ii) secrecy, and (iii) freedom. It is premised on the assumption that all information about a person is in a fundamental way her own, for her to communicate or retain for herself as she sees fit.
241) It was submitted that privacy rights against both the State and non-State actors. There is a qualitative difference between right to privacy against the State and against Non-state actors. Subba Rao. J’s dissent in Kharak Singh, was relied upon wherein it was stated that the existence of concentrated and centralized State power, rather than its actual or potential use that creates the chilling effect and leads to psychological restraint on the ability of citizens to think freely. Therefore, individuals have a higher expectation of privacy from the State. In the vein, it was further submitted that the State was imposing disproportionate and unreasonable State compulsion. States do not have the power to Writ Petition (Civil) No. 494 of 2012 & connected matters Page 310 of 567 compel their citizens to do particular acts, except in a narrow range of defined circumstances. As sentinels on the qui vive, Courts are duty bound to protect citizens against State compulsion, whether in the context of forcibly undergoing narco-analysis/lie detectors tests or forcibly undergoing sterilization. Compulsion can be used in limited circumstances such as punishment for law-breaking, compulsion in the aid of law enforcement, and compulsion to prevent potential law-breaking. These include fines, imprisonment, fingerprint collection for criminals and prisoners. Even in medical jurisprudence, the case of Common Cause v. Union of India83 elaborates on the concepts of dignity, bodily integrity and decisional autonomy. For DNA tests and blood tests to be conducted a high standard of evidence is required. Similarly ‘refusal of treatment’ is a constitutionally protected liberty interest in the United States of America as stated in the case of Cruzan v. Director, Missouri Dept. of Health84.
242) The petitioners further submitted that although the Aadhaar Act is ostensibly framed as a voluntary entitlement to establish one’s identity under section 3 read with Section 4(3) of the Aadhaar Act, the actions of the Executive and private entities 83 Writ Petition (Civil) No. 215 of 2005 84 497 US 361 (1990) Writ Petition (Civil) No. 494 of 2012 & connected matters Page 311 of 567 under sections 7 and 57 have made possession of Aadhaar de facto mandatory. Residents have thus been forced to obtain an Aadhaar number, for continued access to statutory entitlements and services. 252 government schemes have been notified by various Ministries/Departments of the Central Government under section 7 (as on 30.11.2017) requiring Aadhaar as a condition precedent for availing services, subsidies and benefits including for persons with disabilities, for SC/STs, and for rehabilitation of Manual Scavengers. It has also been made mandatory for mobile services, banking and tax payments, registration of students of CBSE, amongst other things. It thus pervades every aspect of an individual’s life. Concomitantly, there is no opt out option in the Aadhaar Act, which makes consent irrevocable and deprives individuals the ability to make decisions about their life.
243) As per the petitioners, this kind of mandatory nature of Section 7 violates Article 14. They submit that mandatory authentication has caused, and continues to cause, exclusion of the most marginalized sections of society. Proof of possession of an enrolment number or undergoing Aadhaar authentication is a mandatory pre-requisite for receiving subsidised food grain under the National Food Security Act. It creates “undue Writ Petition (Civil) No. 494 of 2012 & connected matters Page 312 of 567 burden” on citizen which is unconstitutional. Successful monthly authentication is contingent on harmonious working of all attendant Aadhaar processes and technologies–i.e. correct Aadhaar-seeding, successful fingerprint recognition, mobile and wireless connectivity, electricity, functional POS machines and server capacity–each time. It is also dependant on age, disability (e.g.leprosy), class of work (e.g. manual labour), and the inherently probabilistic nature of biometric. Economic Survey of India 2016 reports that authentication failures have been as high as 49% in Jharkhand and 37% in Rajasthan, recognising that “failure to identify genuine beneficiaries results in exclusion error”.
244) The exclusion is not simply a question of poor implementation that can be administratively resolved, but stems from the very design of the Act, i.e. the use of biometric authentication as the primary method of identification. Determination of legal entitlements is contingent on a positive authentication response from the UIDAI. Biometric technology does not guarantee 100% accuracy and is fallible, with inevitable false positives and false negatives that are design flaws of such a probabilistic system, especially because biometrics also change over time. Writ Petition (Civil) No. 494 of 2012 & connected matters Page 313 of 567
245) Classification caused by the Act lacks rational nexus. The entitlement of an individual depends upon status, and not proof of identity. At the point of use, The Biometric Authentication divides residents into two classes: those who have and do not have Aadhaar; and those who authenticate successfully, and those who do not. Given that the probability of biometric mismatch is greatest for the aged, disabled, and individuals engaging in manual labour – amongst the most vulnerable sections of society–the decision to use periodic biometric authentications has a direct and disparate effect of violating fundamental rights of this class. This division bears no rational nexus with the question of status for receiving benefits. It leads to under- inclusion, and is thus arbitrary, causing an Article 14 violation.
246) It is also argued that mandatory nature of Section 7 violates Article 21 as well. The Aadhaar Act alters the entire design & institutional structure through which residents were receiving entitlements. Mandatory imposition of Aadhaar violates their rights to choose how to identify themselves to the government in a reasonable and non-intrusive fashion. On Writ Petition (Civil) No. 494 of 2012 & connected matters Page 314 of 567 making Aadhaar mandatory, instead of the citizen’s right to food and a correlative duty on the State to take action to ensure the proper fulfilment of such rights, the State is exercising its power to convert the constitutional rights of its citizens into liabilities.
247) As per the petitioners, having established the infringement of Article 21, the invasion is not justified under the principle of proportionality. The State’s primary justification of eliminating welfare leakages and ensuring “better targeting” does not stand up to judicial scrutiny.
First, it has failed to discharge its burden of showing that the purported leakages were exclusively caused due to identity fraud, and that those leakages would not exist if Aadhaar is implemented. The state has not given any empirical data. Leakages exist due to eligibility frauds, quantity frauds and identity frauds. Studies filed in Petitioner’s affidavits show that eligibility and quantity frauds are the substantial cause for leakages. Assuming that the Aadhaar Act prevents leakages, the biometric identification system can, at best, only cure leakages related to identity fraud. The government’s claims of savings inter alia of Rs. 14,000 crores in the PDS system, due to the deletion of 2.33 crore ration cards is incorrect, inflated, and Writ Petition (Civil) No. 494 of 2012 & connected matters Page 315 of 567 based on wrong assumptions for the following reasons:
(a) it admittedly does not have estimates of leakages in PDS, nor has any study been done to see if POS machines are effective in removing PDS irregularities;
(b) it conflates issue of “bogus /ineligible ration cards” (eligibility fraud) with identity fraud;
(c) the figure of 2.33 crore includes West Bengal, where ration cards are issued to each person, as opposed to each household;
(d) a large number of these 2.33 crore cards were deleted even before Aadhaar-integration and seeding came into effect;
(e) the savings figure includes even those eligible beneficiaries who have been removed from the list due to failure to link Aadhaar properly; and
(f) it does not value the cost of loss of privacy. Most importantly, the basis for reaching such savings figure has not been disclosed.
Similarly, incorrect averments have been made in the context of LPG savings, using Aadhaar-enabled Direct Benefit Transfer (‘DBT’) scheme known as PAHAL.
Secondly, it has failed to show how the introduction of Writ Petition (Civil) No. 494 of 2012 & connected matters Page 316 of 567 Aadhaar will stop the losses causes on any of the grounds above. Aadhaar is susceptible to its own unique forms of mischief by the vendor.