The UIDAI project:
Why some of the optimism might be nir-aadhar
The article by Nandan Nilekani in the May–June 2011 issue of the Journal1 provides an interesting laundry list of the advantages which an Aadhar number could provide to those registered through the Unique Identification Authority of India (UIDAI).
Nonetheless, it is surprising that nothing has appeared on the limitations. The article fails to present a holistic picture—there is no reference to the expected challenges, the potential for duplication of the existing mechanisms, the threats the Aadhar project poses, particularly to privacy of personal information of individuals and data security. Further, there is no mention of any proposed measures the UIDAI is taking to address these potential loopholes. Even a cursory uninformed examination of the claims in the article indicates that while the intention is laudable, the process and means can definitely be causes of concern.
As readers, we had several questions related to the approach to, implementation of as well as legislative adequacy of the UIDAI initiative and the implications of these issues for its success.
Why two sets of identification data?
It is unclear as to why two sets of identification data—demographic and bioinformatics—are required for securing an Aadhar number. Also, the operational aspects and possible misuse could cause concern. As it is, individuals face many problems while trying to meet the requirements of producing proof of residence, date of birth, etc. for securing other key government identification documents (such as a voter’s card, passport and ration card), and nothing has been said on how similar trials and tribulations can be minimized in the case of those seeking an Aadhar number.
Would securing an Aadhar number truly remain voluntary?
The article has pointed out some benefits of having an Aadhar number, such as immunization tracking for children. However, this system implies a clear link between basic health provisioning (such as immunization) and the need for official proof of being an Indian resident (to be certified through the possession of an Aadhar number). If this is indeed the case, it would mean that providers, especially in the public healthcare system, might not be able to provide health services to vulnerable populations such as ‘illegal’ immigrants. It should not be the duty or responsibility of a healthcare provider to sit in judgement over a patient’s legal status regarding his entitlement to health services. A patient presenting at a healthcare facility without an Aadhar number might be suspected of being a non-citizen—and stigmatized—and not provided with health services, or even worse, be pursued by the state machinery. Linking Aadhar to essential public health services such as immunization could mean that undocumented immigrants, among other vulnerable groups, would shun health programmes and hence, put themselves and others in the community at risk of vaccine-preventable and other communicable conditions.
Although securing an Aadhar number is currently voluntary, the emphasis on its use in healthcare in the way Nilekani advocates in the article might lead to the risk of the Aadhar number becoming almost ‘mandatory’ for better, swifter and smoother access to healthcare in due course of time. Aadhar has already become compulsory for the provision of liquefied petroleum gas (LPG) by government oil companies as part of a pilot project in Mysore.2 Concerns regarding the Aadhar number becoming almost mandatory have been expressed by others, too.3
Wouldn’t the proposal to use Aadhar for immunization tracking be duplication of efforts?
The government has already launched a separate system for maternal and child health tracking, including immunization 4 through the National Rural Health Mission Health Management Information System (http://nrhm-mis.nic.in/mchtracking.htm and http://nrhm- mcts.nic.in/), and it is not clear why UIDAI should aim to replicate it through Aadhar.
We believe there might be other areas in which Aadhar might lead to a replication of efforts. This would not only lead to a waste of resources, but also increase the risk of threats to data security.
Is the health system sufficiently equipped to use the Aadhar number?
Assuming that the Aadhar number could finally be used in the healthcare context as Nilekani delineates, is our health system equipped with the required e-platform across the nation? Also, do we have adequately trained human resources to run such a sophisticated system, or the capability of recruiting such manpower at every level within the health system? It appears that the use of the Aadhar number as envisioned would entail inter-ministerial and inter-sectoral coordination and the investment of substantial resources. It is not clear how this is being planned or how it will be executed.
Would the system to protect privacy and for data protection be truly foolproof?
The article has not dealt with the issue of privacy of personal information (especially health) and the associated challenges. It is also not clear as to how data safety will be ensured. In response to a question in Parliament regarding mechanisms to protect data from un authorized use, it was said that the data would be encrypted at source and measures such as limiting physical use and establishing standard security infrastructure would be taken.5 We wonder if that would be sufficient given the current trend of data theft from the supposedly safe and well-protected sectors, such as banking and information technology, which use similar mechanisms. As instances of theft and misuse of information become commonplace, as evidenced by increasing credit card fraud and frequent hacking of government websites,6 any framework for information collection which does not have robust safeguards should be a cause of concern. In addition, India does not have any coherent policy or law governing data encryption.7–9
In the contemporary context of global terrorism, it would also be challenging for the UIDAI to keep to its promise of confidentiality of data collected if faced with mounting pressure from investigation and intelligence agencies, whether domestic or foreign, to share bioinformatics information of individuals suspected to be associated with terrorism and violence.
Although the context is somewhat different, the vaccination campaign launched by a US intelligence agency aimed specifically at collecting DNA samples from the Osama Bin Laden household in Abbottabad in Pakistan10 is an example of how a public health programme collecting identifiable data may be misused.
The initial Aadhar registration system being implemented is also a cause of concern. As the enrolment process has been sub-contracted via tenders to private firms, there is seemingly no guarantee of how information and data security will be maintained. Moreover, ensuring data protection from interested parties, such as insurance companies which could choose to deny health insurance coverage to individuals on the basis of their health profiles, is of paramount importance. Unless stringent safeguards are built in, the Aadhar number could be a serious and risky intrusion into our privacy.
Furthermore, it is not clear as to how harmonization and reconciliation across various legal apparatuses, such as the National Identification Authority of India Bill and the proposed Right to Privacy Bill,11 would be achieved in the context of protecting personal information gathered under the Aadhar project.
Against this backdrop, we believe that the editorial by Nilekani raises more questions than provides answers, and hence there is reason to question the claims of the article.
Finally, we also find it disconcerting that though the author declares his affiliation with the UIDAI, there is no conflict of interest statement in the article. Nilekani, as head of the initiative, is expected to have a positive bias towards the programme. We believe it would have been good practice for a conflict of interest statement to have been appended with the article.
REFERENCES
-
1 Nilekani N. Building a foundation for better health: The role of the Aadhaar number.
Natl Med J India 2011;24:133–5.
-
2 Milton L. Aadhaar number to be must for LPG services. The Times of India 2011 Aug
-
3 Ramanathan U. A private right or a public affair? Tehelka 2011 Jul 9, vol 8, issue 27.
Available at http://www.tehelka.com/story_main50.asp?filename=Ne090711
PROSCONS.asp (accessed on 18 Aug 2011).
-
4 Government Health. Now, a tracking system for immunisation in India: The name-
and telephone-based tracking of pregnant mothers and children through a web-
-
5 Unique Identification Authority of India. Planning Commission, Government of
India, Rajya Sabha Questions. Question no 393 (answered on 2011 Feb 24).
Available at http://uidai.gov.in/index.php?option=com_content&view=
article&id=171&Itemid=150#rs (accessed on 20 Aug 2011).
-
6 Kurup D. ‘State actor’ linked to major cyber intrusions in India, world. The Hindu,
Bangalore edition. 2011 Aug 4. Available at http://www.thehindu.com/news/
article2319894.ece (accessed on 18 Aug 2011).
-
7 Data Security Council of India. Recommendations for Encryption Policy Regulation
u/s 84A of the Information Technology (Amendment) Act, 2008. Prepared by DSCI/
NASSCOM with inputs from the industry. 2009 July 13. Available at http://
www.dsci.in/sites/default/files/encryption_policy_dsci_ final_submission_to_dit.pdf
(accessed on 16 Aug 2011).
-
8 Dalal, P. Encryption policy of India needed. 2011 Jun 19. Available at http://ictps.
blogspot.com/2011/06/encryption-policy-of-india-is-needed.html (accessed on 5
Aug 2011).
-
9 Waris S. Government asleep over encryption regulations. 2009 Aug 20. Available at
http://www.legallyindia.com/20090820138/Legal-opinions/government-asleep-
over-encryption-regulations (accessed on 21 Aug 2011).
-
10 Reardon S. Pakistan. Decrying CIA vaccination sham, health workers brace for
backlash. Science 2011;333:395.
-
11 Venkatesan J. Bill on ‘right to privacy’ in monsoon session: Moily. The Hindu 2011
Jun 7. Available at http://www.thehindu.com/news/national/article 2082643.ece (accessed on 17 Aug 2011).
Anant Bhan
anantbhan@gmail.com
Sunita V. S. Bandewar
sunita.bandewar@utoronto.ca
Pune Maharashtra
- ______________________________