Pros and cons of Aadhaar bill
We need an
Aadhaar legislation to establish boundaries within which the ID database
will function and clearly cordon it off from government over-reach
When the National Democratic Alliance introduced the Aadhaar Bill in
Parliament late last week, it looked like the government was trying to
latch the stable door a few years after the horse had bolted. This is
2016. We are approaching a billion issued Aadhaars. Passing an enabling
legislation now is a bit like planning a coronation to celebrate the
diamond jubilee of the Queen.
Much of the opposition to Aadhaar comes from the massive amounts of
sensitive personal information that has been collected. These
apprehensions are exacerbated by the casual and porous approach that the
government has to inter-departmental data transfer—a fear that was
brought into sharp focus when it took the full might of the Supreme
Court to stop the Central Bureau of Investigation (CBI) from accessing
the Aadhaar fingerprint database.
This is why we need an Aadhaar legislation—to establish boundaries
within which the identity database will function and clearly cordon it
off from government over-reach. In many ways, it is far more important
to have a legislation today, as the project enters the implementation
phase, than when the project was conceived.
I have worked with the government on drafting a privacy legislation
and my expectations of the Aadhaar Bill were low. The government hates
absolutes and I was resigned to finding privacy provisions riddled with
exceptions. I was pleasantly surprised to find surprisingly few. I will
go so far as to say that the Aadhaar Bill, if it passes in its current
form, will impose some of the strongest fetters on government
over-reach, of any legislation in the country.
The best example of this is in the protection afforded to core
biometric information—a subset of biometric information that includes
the fingerprints and iris scans and forms the foundation of Aadhaar’s
authentication mechanism. Under Section 29, core biometric information
cannot be shared with anyone for any reason whatsoever. The section
makes it clear, in language that brooks no exception, that this
information cannot be used for any purpose other than the generation of
Aadhaar numbers and authentication of Aadhaar number holders.
There are many examples throughout the bill where core biometric
information has been ring-fenced in this manner. For instance, Section
8, which deals with authentication, states that the response to an
authentication query must exclude core biometric information. Perhaps
the most extreme manifestation of this is in the proviso to Section
28(5), which prevents the Aadhaar number holder from accessing his own
core biometric information in the Central Identities Data Repository
(CIDR).
The other pleasant surprise is the manner in which classic privacy
principles of notice, consent and purpose limitation have been liberally
sprinkled throughout the statute. Enrolment officers have to inform
individuals seeking enrolment how their information will be used, who it
will be shared with and what access rights they have. Requesting
entities must obtain consent before collecting information for
authentication and provide details of the information that will be
shared and the alternatives available if the individual doesn’t want to
submit identity information.
There is an entire provision (Section 28) devoted to the protection
of information. This is yet another example of a provision that has been
framed in the absolute—prohibiting the authority from revealing any
information stored in the CIDR to anyone.
It would have been too much to ask for the legislation to have been
completely devoid of exceptions—Section 33 allows for judicial and
executive exceptions to the absolute prohibition against disclosure of
information. It states that the protections of Sections 28 and 29 will
not apply against the order of a district judge (or higher). Similarly,
the protections under Sections 28 and 29 can be over-ridden by
directions issued by an officer above the rank of joint secretary, in
the interests of national security. Any such direction must be reviewed
by an oversight committee before it takes effect.
This is not a legislation without flaws. There is a lot that’s left
to be clarified through delegated legislation, and if there is one thing
experience has taught us, it is that the devil is in the detail. One
particularly disappointing provision is Section 29(4), which seems to
allow core biometric information to be made public for purposes
specified in the regulations—contrary to the manner in which it has
otherwise been ring-fenced.
In the balance, this is a good legislation, filled with the kind of
stiff backbone needed in a law that will form the basis for the
digitization of government services. I have apprehensions about how it
will be implemented, whether in practice, the privacy protections of
consent, notice and purpose limitation will be given effect to. Or
whether the national security exception will be misused. But given the
absolutes in the drafting, it’s likely that the courts will make short
work of any transgressions.
