The Supreme Court bench hearing petitions challenging the constitutional validity of Aadhaar Act has observed that fears of misuse are not enough to quash a law. That is of course the case, but the growth of Aadhaar to touch every aspect of human life by covering more government schemes and drawing in private corporations has created risks that are being discovered along the way. What government, if not the court, can do is to minimise people’s exposure to Aadhaar through restricting Aadhaar to such specific purposes as delivering cash transfers and eliminating duplicate PAN cards.
Reports of denial of rations and starvation deaths due to Aadhaar authentication failures, denial of access to hospitals and other critical services because of non-enrollment or sharing Aadhaar violates right to life. Recall that at inception Aadhaar was merely a unique identification document unlike the voter ID, passport, ration card and PAN card which served specific purposes. But its biometric component and the lure of big data spurred a supposedly “minimum government” to move towards maximum government even as corporations mount similar raids on privacy.
Linking every bank account to Aadhaar is just one of the many intrusive, unconvincing and recursive Aadhaar authentication tasks that the government is imposing on citizens. The law mandates that income tax returns incorporate all bank account details. Linking PAN to Aadhaar effectively provides government a window to such bank accounts, which ought to be enough if government works efficiently. Similarly, linking SIM to Aadhaar is another pointless exercise in authentication when domestic SIM is just one among many telephony options. Forcing citizens to submit their Aadhaar opens a window for banks and telecom companies to monetise private consumption behaviour without seeking informed consent. Now, even mobile wallet companies have joined the Aadhaar pestering service.
Only months ago, a telecom company violated informed consent and surreptitiously opened payments bank accounts for subscribers. The Aadhaar Act design of UIDAI as regulator, service provider, data protector and sole victim-complainant in data breaches is untenable. A strong data protection law with tough penalties for breaches, and a corresponding independent regulator, are urgently needed. Aadhaar should be limited by law to be required for only a few specified government services and departments, such as cash transfers or linkage to PAN cards. If Aadhaar evolves to track every activity it would endanger citizens, privacy, democracy and national security.
This piece appeared as an editorial opinion in the print edition of The Times of India.
