The debate engendered by the Aadhaar project has propelled India from being a predominantly pre-privacy society to one in which privacy protection in digital databases has emerged as a major national concern. The welcome and scholarly Supreme Court judgment8 has upheld privacy as a fundamental right, and informational self-determination and the autonomy of an individual in controlling usage of personal data have emerged as central themes across the judgment. The main privacy concerns with Aadhaar are:1
Also, Aadhaar does not record the purpose of authentication. Authentication without authorization and accounting puts users at serious risks of fraud because authentication or KYC meant for one purpose may be used for another.6 Recording the purpose of authentication is crucial, even for offline use.2 Privacy-by-design is not achieved by self-imposed blindness.
Lack of protection against insider threats and lack of virtual identitieswhich were retrofitted in a limited way9raise some serious privacy concerns, and the absence of a clear data usage policy and regulatory oversight exacerbates the problem.1 Without a robust consent and purpose limitation framework and a regulatory access control architecture, the privacy concerns will remain. The inadequate privacy safeguards can potentially give the government of the day unprecedented access to information and power over its citizens threatening civil liberty and democracy.3,5,7
The Supreme Court's three-pronged proportionality test for the constitutionality of Aadhaar was based on determination of a rational nexus between the objectives and the means, of necessityimplying that the adopted means are the least intrusive for the purposeand of balancing of extents to which rights are infringed.7 Although the majority judgment upheld the constitutionality of Aadhaar, it struck down most of its uses on privacy grounds and limited its scope to only disbursement of welfare and income tax. The dissenting minority judgment, however, found Aadhaar to be unconstitutional in its entirety. Moreover, the Supreme Court of Jamaica has also recently struck down its very similar Jamaican National Identification and Registration Act (NIRA) as unconstitutional by heavily relying upon and extensively citing the dissenting Aadhaar judgment.10 Judicious design of a national identity system that is respectful of fundamental rights is still very much an open problem.
2. Banerjee, S. and Sharma, S.V. An offline alternative for Aadhaar-based biometric authentication, 2018; http://bit.ly/330m8jn
3. Drezé, J. The Aadhaar coup, 2016; http://bit.ly/2IfqQSe
4. Khaira, R. Rs 500, 10 minutes, and you have access to billion Aadhaar details. Tribune India, 2018; http://bit.ly/2wW5wdY
6. PTI. UIDAI suspends Airtel, Airtel Payments Bank's e-KYC license over Aadhaar misuse, 2017; http://bit.ly/2IJnjdR
7. Puttaswamy, KS and Another v Union of India. Writ petition (Civil) No 494 of 2012. Supreme Court judgment dated Sept.26, 2018; https://indiankanoon.org/doc/127517806/
9. Sharma, S. (via P.V. Singh). Virtual ID is a good beginning; much more remains to be done, 2018; http://bit.ly/2YxDmp5
10. Supreme Court of Judicature of Jamaica. Justice Sykes, B. Justice Batts, D. and Justice Hamilton, L-P. Claim No. 2018HCV01788 between Julian J. Robinson and The Attorney General of Jamaica, 2019; http://bit.ly/31r3XTg
11. Viswanath, L. Four reasons you should worry about Aadhaar's use of biometrics, 2017; https://thewire.in/featured/real-problem-aadhaar-lies-biometrics
©2019 ACM 0001-0782/19/11
Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and full citation on the first page. Copyright for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, or to redistribute to lists, requires prior specific permission and/or fee. Request permission to publish from email@example.com or fax (212) 869-0481.
The Digital Library is published by the Association for Computing Machinery. Copyright © 2019 ACM, Inc.
It is a good that Upholding of the Identity theft is a Violation of the Fundamental Right, as decided by the Honb'le Apex Court. But a Surveillance Mechanisms are to be developed by the Union Governments for monitoring the Flow of Data and the Agents involved with deterrent Punitive Actions.For this matter not only the Data available with Aadhar can be taken in to account but also the DATA available through the Social Media can also be considered.
After all protecting the Individual Identity is nothing but Protecting the Society at large.
Displaying 1 comment