India's Unique Identity Programme
Total Page:16
File Type:pdf, Size:1020Kb
Governing ID: India’s Unique Identity Programme 1 GOVERNING ID India’s Unique Identity Programme A project of the Centre for Internet and Society, India supported by Omidyar Network → digitalid.design ← → cis-india.org ← RESEARCH & WRITING Vrinda Bhandari REVIEW & EDITING Amber Sinha DESIGN Pooja Saxena COVER ILLUSTRATION Akash Sheshadri Governing ID: India’s Unique Identity Programme 2 introduction This is the second in a series of case studies, using our evaluation framework for the governance of digital identity systems. These case studies, which analyse identity programmes and their uses, illustrate how our evaluation framework may be adapted to study instances of digital identity across different regions and contexts. This case study looks at the Unique Identity scheme in India. The Unique Identity (UID) scheme or Aadhaar is intended as a foundational identity system that stores the demographic and biometric information of all residents in India and allows the Aadhaar number holder to establish their identity through authentication or offline verification (although no guidance has been further provided about how this mechanism will work).1 All the identity information is stored in a centralised database, the Central Identities Data Repository (“CIDR”) and can be “seeded” 2 with other existing databases. 1 Section 4(3), Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act, 2016 [“Aadhaar Act”]. 2 Seeding is the process by which the Aadhaar number is introduced into various databases for identity verification. Inorganic seeding transpires when the database is automatically updated by the UIDAI using programming tools and algorithms, without the involvement of the Aadhaar number holder. See Aadhaar Seeding (2014) https://pdsportal.nic.in/Files/Aadhar%20seeding%20 guidelines.pdf, 1. Governing ID: India’s Unique Identity Programme 3 rule of law tests 1.1 LEGISLATIVE MANDATE Is the project backed by a validly enacted law? The Union of India issued a Notification dated 28.01.2009, constituting the Unique Identification Authority of India (“UIDAI”) for the purpose of implementing the Unique Identity (UID) scheme. The UID scheme envisaged the issuance of a digital ID, “Aadhaar,” through the creation of a UID database. The first Aadhaar number was in 2010, without any statutory backing. The government continued to issue Aadhaar numbers solely on the basis of the Executive Notification, till the passage of the Aadhaar Act in 2016. During the pendency of several legal challenges filed in the Supreme Court of India, the Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act, 2016 (“Aadhaar Act”) was introduced as a “Money Bill” under Article 110 of the Constitution of India and passed.3 All these challenges were heard together by the Indian Supreme Court in K.S. Puttaswamy v Union of India, (2019) 1 SCC 1 (“Aadhaar judgment” ), which by a majority of 4:1 upheld the constitutionality of the Act, while striking down/reading down certain sections. The Supreme Court also upheld Section 59 of the Act, thus validating the Aadhaar project (i.e. the enrolment/storage/use of Aadhaar) from 2009 till 2016, prior to the passage of the Aadhaar Act.4 In 2019, the President of India promulgated the Aadhaar and Other Laws (Amendment) Ordinance, 2019, (Amendment Act). This Ordinance has been challenged before the Supreme Court in S.G. Vombatkere v Union of India.5 Although the Supreme Court in the Aadhaar judgment had upheld the passage of the 3 The Act included a savings/validation provision, Section 59, which aimed at validating actions taken by the Central Government pursuant to Notification dated 28-1-2009 till the passing of the Act. The Aadhaar Act, including Section 59 was subsequently challenged vide W.P. (C) No. 797/16, titled S.G. Vombatkere and Anr. v. Union of India & Anr. 4 (2019) 1 SCC 1, paras 428, 431, 513.9. 5 After the Parliament came to session, the Aadhaar and Other Laws (Amendment) Law, 2019 [“Aadhaar Amendment Act”] was passed – without any public consultation – and was also challenged before the Supreme Court in S.G. Vombatkere v Union of India, W.P. (C) No. 1077/2019 [“S G Vombatkare” ]. The challenge pertains to expanding the use of Aadhaar to private entities, in the teeth of the Aadhaar judgment and the private surveillance architecture enabled by the Amendment Act. Notice was issued on this petition by the Supreme Court on 22.11.2019 and it was tagged with W.P.(C) No. 679/19. Governing ID: India’s Unique Identity Programme 4 Aadhaar Act as a Money Bill,6 the issue has been thrown open again. In a recent decision in Rojer Mathew v South India Bank Ltd, (2019) SCC Online SC 1456, the Supreme Court raised questions over the majority’s interpretation of Article 110(1) of the Constitution, noting a “potential conflict” with judgments of the coordinate Bench. Consequently, the Court referred the issues of Money Bill to a larger bench. Thus, a re-examination of the Money Bill issue, pertaining to the Aadhaar Act, will likely be reopened. While there is a law backing the ID system, the validity of the law is likely to be legally examined. 1.2 LEGITIMATE AIM Does the law have a ‘legitimate aim?’ Are all purposes flowing from a ‘legitimate aim’ identified in the valid law? The primary requirement of the legitimate aim test is that the actions in questions must respond to a pressing social need, and should not operate in a manner that discriminates on the basis of race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status. The objectives laid down in the Aadhaar Act satisfy the legitimate aim test.7 Section 2(k) of the Act, defining “demographic information” expressly excludes the collection of information regarding race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. The Supreme Court in the Aadhaar judgment held that the Aadhaar Act had a legitimate aim, relying primarily on Section 7 of the Act, while noting that it was “aimed at offering subsidies, benefits or services to the marginalised sections of the society for whom such welfare schemes have been formulated from time to time” and “the objective of the 6 S G Vombatkare, supra, para 515.5. 7 The objectives are “to provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto.” Governing ID: India’s Unique Identity Programme 5 Act is to plug the leakages and ensure that the fruits of welfare schemes reach the targeted population, for whom such schemes are actually meant.” 8 Even though the law has a legitimate aim, it does not clearly define the purposes for which the ID system can be used. 1.3 DEFINING ACTORS AND PURPOSES Does the law governing the ID system clearly define all the actors that can use or are connected to it in any way? The Aadhaar Act does not clearly define all the actors that can use or manage, or are connected to the Aadhaar database. The Amendment Act introduces the definition of “Aadhaar ecosystem” which includes enrolling agencies, Registrars, requesting entities, offline verification-seeking entities and any other entity or group of entities as may be specified by regulations.9 These actors, apart from the Aadhaar number holders themselves, can use/manage or are connected to the CIDR. However, no ensuing amendment has been made to the existing Aadhaar Regulations to give any further details about the actors, especially the offline verification seeking entities, in the Aadhaar ecosystem. Other actors can also use the ID system for the process of organic/inorganic seeding described above. The government has in the past notified more than 250 schemes, including for Public Distribution Systems and for pension, through over 130 notifications passed under Section 7 of the Act, to require Aadhaar for authentication.10 Several actors are not clearly defined in the Aadhaar Act or the supporting regulations itself. 8 Aadhaar judgment, supra, paras 314, 373. 9 Section 2(aa), Aadhaar Act. 10 See Reply to Lok Sabha Unstarred Qs No. 819 on 20.12.2017. Governing ID: India’s Unique Identity Programme 6 1.4 REGULATING PRIVATE ACTORS Is the use of the ID system by private actors adequately regulated? Section 57 of the original Aadhaar Act permitted private sector use of Aadhaar. However, a part of Section 57, which enabled private actors to seek authentication on the basis of a contract, was struck down by the Supreme Court in the Aadhaar judgment since it enabled commercial exploitation of an individual biometric and demographic information by these entities and violated the privacy of the Aadhaar number holders.11 There has been a lot of debate about the true meaning of the Court’s ruling and the status of private entities in the Aadhaar ecosystem. One view was that after the partial striking down of Section 57, private actors were not permitted to use the Aadhaar infrastructure even as requesting entities, even under a voluntary contract. Others argued that the wide definition of “requesting entity” 12 and the mandate given to the UIDAI to perform authentication of the Aadhaar number submitted by any requesting entity13 meant that the private sector could continue to use Aadhaar through this route. In 2019, through an amendment, the government omitted Section 57, but effectively restored private sector use of Aadhaar through other amendments.14 The Telegraph Act was further amended by introduction Section 4(3) clarifying that a licensee under the Telegraph Act can identify its customer/user by authentication or offline verification under the Aadhaar Act (based on their consent), apart from existing methods such as identification through passports.