Vol XLV No.35 August 28, 2010
The article “A Unique Identity Bill” (EPW, 24 July 2010) reflects some fundamental misunderstandings on the objectives of the Unique Identity Authority of India, the features of the identity number, and the impact it will have on privacy. A response. The objective of the Unique Identification Authority of India (UIDAI), constituted in January 2009, is a simple one: to issue a unique identity (UID) number for every resident in the country. The impact of this initiative, however, goes to the heart of our development agenda today. The UIDAI will fill a significant gap that has existed in our regulatory infrastructure. India has long lacked the identification infrastructure that is in place in countries around the world.1 The absence of this in India has been one of the biggest barriers that the poor face in accessing welfare and social services effectively, as it increases costs and effort of identification as well as the risk of duplicates.
The key role of this UID number is that of an enabler – a number that helps governments design better welfare programmes, enables residents to access resources more easily wherever they live, and allows agencies and programmes – such as the National Rural Employment Guarantee Scheme (NREGS), the Public Distribution System (PDS) and the Sarva Shiksha Abhiyan (SSA) – to deliver benefits and services effectively and transparently. The number will thus be an identity infrastructure, and the foundation over which multiple services and applications can be built for the resident.
The UIDAI has stated its role and objectives in various public documents, and also outlined these in its draft bill. Despite these efforts to clarify the various aspects of the UID Authority, the article by Usha Ramanathan “A Unique Identity Bill” (EPW, 24 July 2010) reflects some fundamental misunderstandings on the objectives of the UIDAI, the features of the identity number, and the impact it will have on privacy.
I do not believe that members of the public, on reading the UIDAI documents, would reach the same conclusions that this article has. Regardless, I would like to address any concerns it may have raised.
Consultations by the UIDAI
At the outset, the author implies in her article that the UIDAI has not been consultative enough, and not opened the UIDAI draft bill sufficiently for comments and discussion.
This remark takes an arbitrary factor – the timeline the UIDAI provided for comments – as proof that the UIDAI has not encouraged discussion on the draft bill. The possible provisions of the bill have, in fact, been under discussion for a significant period of time. Since Nandan Nilekani was appointed chairman of the UIDAI last year, the UIDAI has undertaken a wide range of consultations on what the draft bill should look like, with economists who have worked on welfare design, civil society activists and scholars, academics, law experts as well as biometric experts.
The UIDAI has also engaged in discussions and consultations with several stakeholders at various levels across the country – various ministries and departments of the government, all state governments, the Planning Commission, the Thirteenth Finance Commission, and various independent regulatory authorities. (The details of these consultations are publicly available on the web site.)
These discussions over the last year have shaped the eventual bill, which took into account the various concerns and viewpoints expressed. The invitation for comments once the draft bill appeared on the web site was in addition to this.
Sharing of Information
The article makes the following, apparently tautological statement: “convergence (combining information) is a predictable and inevi table consequence of the UID project”.
The UID database is not what makes convergence of information possible – this is fully possible, even today, without Aadhaar. Mobile numbers, PAN card numbers and passport numbers can all be used to profile, identify and converge data on individuals by agencies.
Overall, concerns on convergence and linking of data can only be addressed through a broad personal data protection regime which will be applicable to all agencies that collate data. The Department of Personnel and Training is currently spearheading an effort to examine the legal framework for personal data protection in the country.
Such a law would also be able to differentiate between benign convergence, which is in the interest of the beneficiary, and illegitimate convergence. The example the article offers – the sharing of health records between hospitals – in fact illustrates that combining data is not always for sinister goals. Sharing of medical records should require the consent of the patient, but is useful for the individual being treated, as it would alert doctors to the patient’s medical history, such as pre-existing heart conditions that rule out anaesthesia, or reactions to particular medication. This would enable better and also cheaper treatments, since different hospitals would not subject patients to the same medical test multiple times.
When it comes to sharing of data, the UIDAI is of the view that the individual is an active, not a passive participant, and does not need self-appointed spokespeople to debate on their behalf. A strong data protection law would ensure that data sharing when it is done, is done with the consent of the individual. Such a law would also give individuals the space and security to choose the information they keep private, according to their own needs. So while an individual may not want a pizza parlour to have access to her personal information, a PDS beneficiary accessing a toll-free number on the system may want to share more information on family members, income and home address to ensure that she receives her subsidy effectively. The author ought to recognise that the preferences of the latter individual are as important as the former.
NATGRID, DNA Bank, NPR and UID
The article suggests that the UIDAI is a part of a national security focus of the Government of India. As mentioned, the goal of the UIDAI project is to issue an identification number to residents for better service access.2 While the NATGRID and the DNA data banks are playing critical national security roles for the country, the UID Authority is attached to the Planning Commission and is not connected to these efforts. Neither is the UIDAI implementing the National Population Register (NPR) – this is under the ambit of the Registrar General and Census Commissioner.
The author’s suggestion of links to the NATGRID/DNA data banks is pure conjecture, meant to create apprehensions on the UIDAI project, and trivialises the actual concerns of the millions of residents who live today without recognition.
Profiling, Tracking and Surveillance
The author also makes multiple statements that the UIDAI has not addressed concerns on profiling and tracking of individuals using Aadhaar information. Her argument ignores several clear, well-highlighted provisions that the bill makes to address concerns of profiling and surveillance.
Profiling of individuals is not possible in the UIDAI system. The bill clearly states3 that the definition of demographic data the UIDAI will collect cannot be expanded to include any profiling information, such as on race, religion, caste, tribe, ethnicity, language, income or health. Tracking and surveillance are also not supported in the UID system.
The UIDAI is also barred from revealing information stored in the central identities data repository. There are only two exceptions to the rule of information disclosure, for reasons of national security, and these exceptions are captured in Section 33. Our approach here reflects one that is followed the world over – where national security and the threat of terrorism remain a very strong reason to provide selective access to information. Such disclosures would have clear checks and balances, and would require a court order or the approval of a concerned minister as well as an additional joint secretary. The article has chosen to quote solely this clause, without citing the various protections that would prevent its misuse.
To further limit misuse of data, the Authority will not have records of transactions that the resident would have engaged in. The Authority will only retain authentication records in a manner similar to the retaining of credit card records – to protect the interest of residents in case of disputes of authentication.
Denial of Service
The author contends that while every resident is entitled to an Aadhaar, the UIDAI does not recommend that delivery of services and benefits cannot be denied due to a lack of UID number.
Policies for providing or denying service are determined by the service provider – it is a function they perform today and will continue to perform, with or without the UIDAI. The UIDAI cannot dictate their processes to them. Additionally, the Aadhaar is meant to replace the various kinds of documentation agencies now demand as proof of identity and proof of address. It does not make sense therefore, for the UIDAI to state that agencies should not require the Aadhaar number to provide services, once these numbers have become sufficient proof of identity and address.
Additional Comments
The article makes some additional, erroneous remarks which either misunderstand or misrepresent the UIDAI’s stated objectives:
(i) “S. 12 – the UID chairperson and members can be appointed by the central government, giving the government control over the persons running the institution”.
As is the case with all of India’s regulatory institutions, the Authority will be created by an act of Parliament and hence will be a statutory authority and accountable to Parliament and the judiciary.
(ii) “The Bill does not limit the use of the number”.
In Section 28, the Bill envisages the creation of an independent body called the Identity Review Committee which shall ascertain the extent and pattern of usage of the Aadhaar numbers across the country and prepare a report annually and make recommendations to the central government.
(iii) “There is no grievance redressal mechanism mandated by law – it may be set up by regulation or it may not”.
The Authority is setting up a grievance redressal mechanism to address feedback and complaints from residents receiving the Aadhaar. The information and grievance mechanisms are already being tested by the UIDAI.
(iv) “In its powers and functions the UIDAI has the authority to define the use of the UID number for the delivery of benefits and services”.
The government today faces the challenge of weak delivery of resources and services across several welfare schemes. The power of the UIDAI to define the use of the Aadhaar number for the delivery of benefits and services is in order to help
reduce leakages and improve resource delivery across such schemes.
(v) The UIDAI has entered into MoUs “without legitimacy, and they do not have the statutory power to collect, hold and transmit information about people”.
This is patently untrue. The UIDAI is an attached office of the Planning Commission and was constituted by an order dated 28 January 2009. The constitution of the authority is valid in law and within the executive authority of the government.
(vi) Pointing to the numbering system document on our web site, the article states that the UID system is expected to live on for years, clearly indicating that the number is a “tagging device” that is likely to live on beyond a person’s lifetime.
The numbering system document is a technical, not a policy document. It was written to lay down the numbering logic for designing the Aadhaar number. Quoting statements from this document to suggest that the Aadhaar number is a tagging device is fundamentally inaccurate. The sentence the article quotes was made
regarding the fact that the population of the country keeps growing, and the numbering logic needs to ensure that sufficient Aadhaar numbers are available.
(vii) Given biometric inaccuracy and lack of debate and answers, it is too early to seek parliamentary approval.
As mentioned previously, the UIDAI has held numerous consultations and debates with government and regulatory institutions as well as civil society groups, the public and subject matter experts, including in biometrics on the use and architecture of the Aadhaar number. Contrary to the article’s assumptions, accuracy from biometrics can now be achieved at a very high level, crossing 99% when different kinds of biometrics are combined, as the UIDAI intends to do. This assessment has come from the Biometrics Committee that was constituted to study the various biometrics and make recommendations best suited to India’s population and environment.4 The UIDAI has adopted the committee’s recommendations to collect face, fingerprint and iris biometrics, in order to ensure that even people with non-existent fingerprints (due to physical labour) would be issued an Aadhaar.
The author of the article views the state as an oppressor; she would do well to
acknowledge that it is the government which spends on the delivery of social benefits such as food, health, education and work, and the government is consequently keen to ensure that these benefits actually reach the people they are intended for. This is the animating principle behind Aadhaar. Without building better and more secure social welfare nets, and ensuring access for the poor to education and health, our efforts against inequality and poverty will come to naught. Aadhaar is the foundation on which we can provide the services and resources individuals need to ensure their dignity, and their right to a better life.
Notes
1 The United States for instance, has built a strong network of welfare services that residents access through the social security number (SSN), and the United Kingdom and European countries deliver social services to residents through similar identification numbers, such as the National Insurance Number.
2 This goal is restated in the preamble of the draft bill.
3 Ref Section 2(h), and Section 9.
4 The Biometrics Committee report is in the public domain, and available on the UIDAI web site.
