BY ET CONTRIBUTORS | UPDATED: AUG 30, 2017, 12.37 PM IST
By Anit Mukherjee
Aadhaar can provide this option to people by issuing a physical card with the biometric information stored within it protected by access and authentication identifiers that will address privacy concerns to a large extent.
The Supreme Court judgement on the right to privacy comes at a critical moment in India’s and the world’s transformation to a digital economy. But while most of the discussion has been focused on what the decision means for the future of Aadhaar, this decision will also have a major impact on identification technology and policy across the globe.
If Aadhaar strengthens its data protection as prescribed by the decision, it has the potential to be an example for the world, and will define the global discourse on how both state and non-state actors collect, protect and use personal information.
By addressing the genuine concerns of individual privacy and data protection, Aadhaar will be ready to move ahead and lead by example as it has already done on the technological side.
The SC judgement could not have come at a more appropriate time. Aadhaar is the world’s largest unique individual database, with one in seven persons in the world enrolled. Many countries are closely following Aadhaar’s biometric standards, data safety protocols and authentication capability as they roll out their own identity systems.
Aadhaar is changing the way ordinary people interact with the state but is also asking people to trust the Unique ID Authority of India (UIDAI) to keep private information safe in an increasingly interconnected world. Resolving the issue of individual privacy and data security is therefore of utmost importance.
Globally, 120 countries have data privacy laws which can be a useful guide to any future legislation.
India would do well to learn from experiences of countries like Estonia and Austria. Both these countries have unique identification systems similar to India but that provide greater control to individuals at the point of authentication and in the way their data is shared across sectors. If Aadhaar adopted lessons from abroad, it will address the privacy concerns raised by its critics.
First, from the earliest times, identification systems have relied on some subset of the many different attributes that together distinguish each of us as a distinct person. They may be bundled into three main factors and combined in different ways to form the basis for identification: something you are such as a fingerprint, something you have such as a birth certificate, election ID card or driving licence, and something you know such as a pin or password.
Modern identification systems that combine all three identification factors: have, know, and are. In Estonia, fingerprints are taken at the age of 15 on registration for the digital ID (who you are: to prevent multiple identities).
A card is issued (what you have); it includes digital certificates to enable the holder to both authenticate his identity and to sign documents electronically. For these purposes, the holder authenticates himself against the card by providing two user-selected and private PINs (what you know), one to authenticate himself and the other to sign.
Second, multi-factor authentication offers extra security. The main difference with Aadhaar is the option of the private PINs which gives the individual control over the authentication process and reduces the chance of impersonation without his or her knowledge, ensuring greater degree of privacy over the centrally warehoused information.
Aadhaar can provide this option to people by issuing a physical card with the biometric information stored within it protected by access and authentication identifiers that will address privacy concerns to a large extent.
Finally, the concern of data sharing across different uses can be addressed by a system where a single, unique individual can be identified in different ways for different purposes.
In Austria, cryptography enables users to access multiple services using a single e-ID while ensuring that records cannot be matched across the different databases using a common number. This should be possible to do with the Aadhaar since the same individual often holds separate IDs for getting government benefits like gas subsidy and pensions.
These are just two examples of several country experiences that India can learn from. The SC judgement gives the opportunity to provide a strong privacy foundation to Aadhaar. What is needed is the willingness on the part of everyone involved in the debate to come together for a common purpose – protecting individual privacy while harnessing the power of technology for better governance
The writer is policy fellow at Centre for Global Development
