13288 - Individual data goldmine of commercial information, says SC - Business Standard

Individual data goldmine of commercial information, says SC

IANS  |  New Delhi 

Last Updated at April 12, 2018 21:05 IST

Expressing serious concern over information surveillance taking place in the country for commercial purposes, the Supreme Court on Thursday said that individual data is a goldmine of commercial information.

"Today, commercial information is itself a goldmine of information. Even little things we disclose for Aadhaar is available for commercial purposes. We are dealing with data of 1.3 billion people, some of who may be poor...but the goldmine of information is available for commercial purposes," the five-judge constitution bench observed.

The observation by the bench, headed by Chief Justice Dipak Misra, came after the Unique Identification Authority of India (UIDAI) contended that biometric and demographic data on 1.3 billion people stored with it was secure from any intrusion.

"Information of individuals is a goldmine, a source of huge commercial market outside" and "today, all information about an individual is of commercial value" said the bench, also comprising Justice A.K. Sikri, Justice A.M. Khanwilkar, Justice D.Y. Chandrachud and Justice Ashok Bhushan.

The court's observation came as senior counsel Rakesh Dwivedi, appearing for the UIDAI, sought to assure the constitution bench that they have foolproof system where every information gets transformed in an encrypted form that cannot be cracked and thus cannot be hacked.

Stating that currently, India did not have a "robust data protection law", the court told Dwivedi that the leak of information might not arise at the UIDAI end but at the end of requesting authority seeking authentication of information of the Aadhaar holder.

Informing the bench that when a request reaches UIDAI for the authentication of individual data, they only say "yes" or "No" and no individual information was shared, Dwivedi, however, said that they had no control over the requesting authority.

At this, the bench said that this made the requesting entity an uncharted sea.

During the course of the hearing, when Dwivedi told the bench that the UIDAI only knew about the request of authentication of identity and nothing about the transactions being undertaken by the Aadhaar holder, Justice Sikri said: "You may not have details of transactions but you have the details of (individual's) activities."

Dwivedi said that government did not need Aadhaar for doing surveillance. "Surveillance is happening, but nobody needs Aadhaar for that."

The court was hearing a batch of petitions, including by former Karnataka High Court Judge K.S. Puttuswamy, Magsaysay awardee Shanta Sinha, feminist researcher Kalyani Sen Menon, social activists Aruna Roy, Nikhil De, Nachiket Udupa and others challenging the constitutional validity of the Aadhaar scheme on the touchstone of the fundamental right to privacy.

--IANS

pk/nir/vm

(This story has not been edited by Business Standard staff and is auto-generated from a syndicated feed.)

First Published: Thu, April 12 2018. 21:02 IST

13148 - Courting Controversy: Protecting fair and democratic elections from Aadhaar’s harvested data!! - Bar & Bench

Courting Controversy: Protecting fair and democratic elections from Aadhaar’s harvested data!!

Nakul Dewan

“What’s the currency of the world now?………… It’s not gold, it’s data. It’s the information.” American Democratic Political Strategist – Stan Greenberg

Two major electoral verdicts, which left a significant number of people around the world perplexed in 2016-2017, were Brexit, where the United Kingdom chose to leave the European Union, and the election of Donald Trump as the President of the United States.

Both verdicts have been questioned and even considered freak results in recent history. While Brexit impacts more than just the sovereignty of the United Kingdom, the poll is still out on where the United States will be at the end of the Trump regime.

The one common factor in both these has been the influence of the British political consulting firm Cambridge Analytica, which has disgracefully become prominent for violating the privacy of Facebook users, by using data in breach of Facebook’s terms and conditions, to strategize electoral campaigns.

Cambridge Analytica’s influence has run across elections all over the world, including India, where through its business partner Oveleno Business Intelligence, it reportedly assisted the present ruling party in the 2014 general election and the opposition.

The Cambridge Analytica-Facebook controversy could not have blown up at a more appropriate time from an Indian judicial perspective. Having held in K.S. Puttaswamy vs Union of India (2017) 10 SCC 1 (Puttaswamy) that the right to privacy is a fundamental right, the Supreme Court is in the midst of hearing arguments on the Aadhaar case, which is now wading into the government’s submissions justifying the mandatory applicability of Aadhaar.

                                  Justice Puttaswamy

The controversy throws up four interesting facets, which are relevant for the Supreme Court to consider. The first, that data privacy can be breached on a large scale and there is nothing like fool proof protection of data. The second, that even a large-scale breach may never be disclosed to the persons whose data has been wrongfully taken. The third, that even after the breach has taken place, it is difficult to police the breach and its consequences especially if it has passed on to multiple people, and fourth, that the data, when harvested, can influence outcomes on a large scale, including elections, without the affected persons even being aware about it.

Harvesting of information

In the traditional farming sense, harvesting is the act of removing crops from where it is growing and moving it to a more secure location for processing, consumption, or storage. Where information is the subject matter, the act of removing information from where it is growing and moving it elsewhere for its analytical processing and strategic use, amounts to harvesting of information. While it may not be unethical if removal of information is based on consent, as that would fall into Nariman J.’s compartment set out at paragraph 495 of Puttaswamy that “[i]f a person was to paste on Facebook vital information ….. such information, being in the public domain, could not possibly be claimed as a privacy right after such disclosure”, it would clearly violate a person’s privacy if such removal is done in breach of the terms and conditions that apply to the uploading of the information.

That is precisely where the hard facts from the Cambridge Analytica-Facebook controversy show how big a deal this is. The matter in issue is the use of information of 50 million Facebook users without their knowledge or consent by Cambridge Analytica for strategically determining electoral campaigns.

That is data of approximately double the size of Delhi’s total population and presumably four times the size of its voters. As a company, Cambridge Analytica uses inherent psychological traits to affect voters’ behavior through teams of psychologists and data scientists. One contract which Cambridge Analytica had entered into described the services it provided to be “behavioral microtargeting with psychographic messaging.” To be armed with knowledge about traits of people is, as a founder of Cambridge Analytica stated, “……. supposed to be the arsenal of weapons to fight [a] cultural war.”

Simon Milner, Vice-President of Facebook’s Public Policy for Asia-Pacific admitted on March 22, 2018 before a Select Parliamentary Committee constituted by the Republic of Singapore, that the breach went as far as constituting a breach of trust between Facebook and its users, who expected their data to be protected by Facebook. But in this context, breach of trust between Facebook and its users is only part of the problem. The bigger issue is the time it took for the world to have become aware about the full extent of the breach.

Youtube Screen Shot from the Facebook proceedings in Singapore

When being questioned by the Select Committee, Mr. Milner accepted that Facebook had become aware as early as 2015 that data had been given to Cambridge Analytica in clear violation of Facebook’s terms and conditions. However, even as late as February 8, 2018, when he appeared before the British Parliament’s Select Committee, Facebook did not publicly acknowledge that in breach of Facebook’s policies, Cambridge Analytica had misused Facebook’s data. In fact, during Mr. Milner’s questioning before the Singapore Select Committee, which was after the Cambridge Analytica news had surfaced, he admitted that with the benefit of hindsight, Facebook had not made a full and frank disclosure before the British Parliament’s Select Committee.

The impact of this is enormous. Harvested information is an extremely essential tool for electioneering once it is fed into an artificially intelligent system with defined parameters.  That is simply because harvested data is not only a key to political persuasion, but when such data is acquired without the knowledge of a group of persons, it allows the acquirer to exploit the vulnerability of that group and lead an election campaign simply exploiting such vulnerability.

Can handing the Aadhar data to the government be the answer towards data protection in a democratic country? At paragraph 328 of Puttaswamy, the Supreme Court stated that “[w]e commend to the Union Government the need to examine and put into place a robust regime for data protection”. That, however, may not be sufficient if it simply seeks to entrust data protection to the government. Clearly the government is an interested party because any harvested Aadhaar data would allow it to exploit the vulnerability of voters in subsequent election campaigns. The government cannot, therefore, be considered as an independent or a neutral protector of the data, because it can potentially harvest the data for its own electioneering benefit. That would go against the concept of free and fair elections, which is a basic tenet of democracy.

Giving data to a private party is also certainly not the answer, given that the conduct of a company as credible as Facebook has been extremely wanting. One might argue that the answer lies in the creation of a completely independent agency for data protection, one which is impenetrable and cannot be influenced. But could such an institution be created, given that it would then potentially be more powerful than any other institution in India because it would have at its fingertips data of each and every individual in India? The magnitude of the power vested in such an institution would make policing it implausible and presumably leave it with no checks and balances.

Aadhaar may have certain values which are laudable. However, the scale at which it is sought to be mandatorily applied in India poses significant threats to which credible answers have not been forthcoming. Till then, the mandatory application of Aadhar for practically everything that is done in India needs to be carefully monitored or even reconsidered.

Nakul Dewan is an Advocate at the Supreme Court of India and Barrister at 20, Essex Street Chambers, Singapore and London

12861 - State cannot sit in judgement on identity of citizens, Supreme Court told - Economic Times

State cannot sit in judgement on identity of citizens, Supreme Court told

PTI|

Feb 20, 2018, 10.08 PM IST

NEW DELHI: The State cannot sit in judgement and rely only on biometric details to establish the identity of its citizens, a former High Court Judge who has challenged the Aadhaar scheme, told the Supreme Court today. 

A five-judge constitution bench headed by Chief Justice Dipak Misra is hearing a clutch of petitions including one filed by former High Court judge Justice K S Puttaswamy challenging the constitutional validity of the Centre's flagship Aadhaar scheme and its enabling 2016 Act. 

Senior advocate Gopal Subramanium, appearing for the former judge, said the State cannot sit in "judgement" and rely on some numbers and biometric details of a person to establish his or her constitutional identity. 

"Virtual person cannot reduce the real personhood," the senior lawyer told the bench which also comprised Justices A K Sikri, A M Khanwilkar, D Y Chandrachud and Ashok Bhushan 

Terming the Aadhaar Act as "unconstitutional", he said it has been held in several judgements that the individual's rights always gets primacy over the rights of the State and moreover, the action of the government is needed to be tested "for substantive and procedural due process". 

The senior lawyer maintained that the government says that Aadhaar scheme was put in place for furthering "social good", but the "remedies are worse than the maladies". The right to equality, right to personal liberty and freedom of speech and expression are being violated by the Aadhaar scheme, he said. 

He also referred to the recent nine-judge bench judgement and said the right to privacy has been held to a be fundamental right to which dignity is "central and integral", he said, adding that the dignity of an individual is being infringed by the Aadhaar law. 

The fact that there would be a centralised data base will lead to aggregation of details of the citizens and they can be misused, he said. 

"Means employed in the statute is because biometrics itself is flawed. And algorithmic behaviour is itself rational and beyond the control of the UIDAI," he said, adding the people would be denied the access to justice by the Aadhaar Act, which is an "overarching theme". 

The advancing of arguments remained inconclusive and would resume tomorrow. 

Earlier, the court had posed whether the government was not entitled to seek proof of identity from citizens if their entitlement to certain benefits were dependent upon their identities. 

"If your entitlement depends on who you are, then can the government not require proof on that count? Is it not a reasonable condition," the bench had asked. 

Senior advocate Kapil Sibal, appearing for the West Bengal government, had said the proof of identity has to be linked with the status of the person which entitles him or her for the benefit and moreover, the citizens must have the choice to prove their identity 

Prior to this, the court had said that issues like denial of benefits to citizens for either want of Aadhaar or due to its non-authentication may not be a ground for holding the law as "unconstitutional". 

The apex court had on December 15 last year extended till March 31 the deadline for mandatory linking of Aadhaar with various services and welfare schemes of all ministries and departments of the Centre, states and Union territories. 

Read more at:

//economictimes.indiatimes.com/articleshow/63003205.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst

12890 - Vulnerability of personal data for Aadhaar violation of rights, Supreme Court told

Vulnerability of personal data for Aadhaar violation of rights, Supreme Court told

IANS|

Updated: Feb 07, 2018, 06.58 PM IST

NEW DELHI: The Supreme Court on Wednesday was told that vulnerability of citizens' demographic and biometric data collected under Aadhaar to leaks is itself the violation of their right to privacy. 

"Vulnerability (of personal data collected under Aadhaar to leaks) is violation of rights," senior counsel Kapil Sibal told the five judge constitution bench headed by Chief Justice Dipak Misra. 

Appearing for West Bengal government, Sibal said that the functioning of the digital world was vulnerable to the sabotage and pointed out no other country in the world has such a centralised demographic and biometric data of its citizens. 

Telling the court that there was "no system of the world that can't be hacked", he said if one goes to railway booking counter and feeds Aadhaar number, then it would reveal all journeys they had undertaken by trains in the past. 

Pointing out that same was the case with air journeys, Sibal asked: "Why should the state know where I am going and what I am doing?" 

At this, Justice A.K. Sikri recounted how he once took his wife for a Chinese dinner and asked for a rice dish they had eaten during their last visit five months back but whose name they were not able to recollect. After a short while, the waiter returned with the print-out of their five month old bill.

Justice D.Y. Chandrachud described the entire episode as "scary". 

A statute, Sibal said, has to be "consistent with the provisions of the constitution" and citing Section 57 of the Aadhaar Act, 2016 asserted that the provision, it was a person's choice to produce Aadhaar number to establish their identity. 

When Justice Ashok Bhushan said that under the said provision, Aadhaar can be used to establish the identity of the persons under other statutes, Sibal said that any interpretation other than that it was voluntary to use Aadhaar for establishing one's identity would be "horrendous". 

As Justice Bhushan asked: "What is wrong with one nation, one identity? We are all Indians", Sibal said: "Yes we are all Indians. Passionately Indian. But we are more than our Aadhaars." 

Further dwelling on his arguments, Sibal said, "Digital world knows more about you, than you know about yourself." 

He told the court that there is an app called "moodpanda which rates and tracks your mood"and in a lighter vein told the bench "We would love to use it to see Your Lordships' mood in the Aadhaar case." 

"Unlike smart cards which require several pieces of sophisticated equipment such as a card skimmer and card printer in addition to sophisticated software and advanced technical knowledge, most biometric readers in India today can be defeated by a child with no technical knowledge using Fevicol and wax," he claimed. 

Besides West Bengal government, the former Karnataka High Court judge K.S. Puttuswamy, Magsaysay awardee Shanta Sinha, feminist researcher Kalyani Sen Menon and others have assailed the constitutional validity of Aadhaar Act on the touchstone of the fundamental right to privacy. 

Hearing will continue on Thursday. 

Read more at:

//economictimes.indiatimes.com/articleshow/62822717.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst

12798 - Giving Aadhaar the finger - Times of India

Giving Aadhaar the finger

Himanshi Dhawan | Jan 28, 2018, 01:30 IST

While it may not be a wide uprising, sections of middle-class India have woken up to the flip side of Aadhaar in recent months, thanks to the efforts of a determined bunch of people who've been up in arms against government notifications making the unique identification number mandatory to access bank accounts, pay taxes, use mobile phones and loads of other services. So who is this motley crew? Sunday Times surveys the main camp of Aadhaar opposition

SOCIAL ACTIVISTS 

Aadhaar's dangers were flagged as early as 2010 by legal researcher Usha Ramanathan, activists like Bezwada Wilson and Aruna Roy, and economists like Jean Dreze and Reetika Khera, who petitioned the courts about food and welfare benefits being denied to those in need. In 2016-2017, the government made Aadhaar mandatory to access PDS, midday meals, maternity benefits, and supplementary nutrition for young children. Living and working among rural communities in Jharkhand gave Dreze an insight into how Aadhaar, which began as a voluntary facility, had become a "coercive and invasive project.'' Dreze says: "I had early opportunities to witness the hassles that Aadhaar authentication often creates for poor people. So I started questioning the project, at least in its current form." 

Anjali Bhardwaj, an activist with NCPRI and Rozi Roti Abhiyan working in Delhi, found that as early as 2013, the Sheila Dikshit government had made Aadhaar mandatory for marriage certificates, land ownership and other documents. "At that time the scheme was sold on the pretext that if you have no other form of identification, you can get Aadhaar,'' she recalls. 

Reetika Khera | Economist 

Biggest problem with Aadhaar I used to say Aadhaar is a remedy in search of a disease; now, I say that the remedy is worse than the disease. It is denying people their entitlements, and exclusions are being presented as savings 

What is the fix? At the very least, it must be made voluntary. Those coerced into it must be allowed to opt out 

The LEGAL EAGLES 

The first challenge to Aadhaar came in 2012, when former judge Justice K Puttaswamy filed a writ petition arguing that it violated the right to privacy and had no legislative backing. 2013 was a year of heavy challenges, with eight petitions being filed. Four more were subsequently filed in 2014 and five in 2015. 

Another 12 challenges have cropped up since the government passed the Aadhaar Act in 2016. Now there are 26 petitions before the Supreme Court with about 12 senior lawyers, including Gopal Subramanium, Shyam Divan, Meenakshi Arora, Arvind Datar and Anand Grover assisted by nearly 60 others. Most are working pro-bono. 

Divan, whose oratory and arguments in the case have won him some new fans, is so committed to the cause he does not even have an Aadhaar number yet. As an independent lawyer, Apar Gupta's interest was piqued in July 2015, when the government argued that citizens did not have an absolute right to privacy. "It was a key moment,'' he recalls. Gupta has been assisting the senior counsels in the case and tweeting the legal twists and turns. Lawyer Gautam Bhatia's handle has livetweeted legal proceedings, arguments by the government, the Aadhaar critics and court observations. 

Apar Gupta | Lawyer 

Biggest problem It is a tech-based solution that makes over-ambitious promises and does not respect the civil rights of an individual 

What is the fix? The government must acknowledge that Aadhaar, in its current form, has too many problems. It needs to consider expert views. The UK had also created an ID project, and then spent more money to scrap it 

DATA/TECH GEEKS 

First, Bengaluru police published 13,000 call records online for a hackathon in October 2015, and then even the local pub started demanding Aadhaar for entry. This was enough to send alarm bells ringing among the data security community in Bengaluru. Internet researcher Srinivas Kodali, digital rights activist Anivar Aravind and others like him have been relentless in flagging off Aadhaar-related technical glitches, like the potential storing and cloning of biometrics. For Anand Venkatanarayanan, software engineer and privacy buff, curiosity turned into active disquiet in early 2017 when UIDAI announced that the 12-digit number was mandatory for the mid-day meal scheme. Around the same time, his five-year-old son ended up with a few missing fingerprints because of skin grafting to fix an injury. "Obviously I have more skin in the game than anyone else to understand the issues around biometric enrolment and authentication failures as even schools were demanding Aadhaar for admission,'' he says. 

Srinivas Kodali | Internet Researcher 

Biggest problem Data sharing by the government without individual consent 

What's the fix? Allow Aadhaar as just one form of identification 

THE MEME MISSIONARIES 

Anyone heard the Ajit joke: "Robert, iska Aadhaar destroy kar do. Bina Aadhaar ke yeh zinda laash banke reh jayega"? Or the one about PM Modi advising Virushka to get an Aadhaar if they want their marriage recognised? Aadhaar critics got their big public boost after some social media influencers stepped up the game with memes, WhatsApp jokes, Twitter handles like @no2UID, and videos that grabbed attention. Political analyst Meghnad S, @memeghnad on Twitter, says that his antennae went up after the concerns raised by the parliamentary committee headed by former cabinet minister Yashwant Sinha, and interactions with social activists. "Some of us started talking online about the systemic flaws," the 28-year-old says. Soon, the jokes were in full flow on #Aadhaarmemes. Sarcasm was a potent response to new reports about bank access and emergency medical care hinging on Aadhaar. Rachita Taneja, the 26-year-old creator of the web comic Sanitary Panels, sees Aadhaar as a human rights issue. She took on Amazon India for demanding mandatory Aadhaar-linking to investigate a lost or damaged package. Soon, reports started pouring in of other companies forcing users to link Aadhaar. This is the popular face of the Aadhaar resistance, supplementing the behind-the-scenes research and activism. Says Nikhil Pahwa, founder of Medianama and social influencer, who had also helmed the public campaign for net neutrality: "It is my civic duty to push for better policy and implementation. We need more people to get involved, because Aadhaar impacts us all." 

Rachita Taneja | Web Comic Creator 

Biggest problem Recent data breaches show that our data is up for grabs and our privacy is not upheld 

What is the fix? The question we should be asking is, can Aadhaar be fixed at all? 

PHOREN FACTOR 

Former CIA employee and whistleblower Edward Snowden and Microsoft regional director and data security expert Troy Hunt have bolstered Aadhaar critics. In the last fortnight, Snowden said the programme was an "improper gate to service". He also expressed fears about private companies storing personal databases with Aadhaar details. Hunt, on the other hand, wrote a piece describing the claim of Aadhaar being hack-proof as "ludicrous". He points out that there are only "degrees of security and never an absolute position of security". 

Troy Hunt | Data Security Expert 

Biggest problem Government's assumption that Aadhaar is hack-proof and secure

What is the fix? Handle consumer concern better, control messaging and be more receptive to feedback. Acknowledge the reality that all systems have risks and that yes, it's possible Aadhaar may be hacked 

TOP COMMENT

Aadhaar is not a novel experiment by Indian government! It is similar to many such processes all Over the world. Hacking aadhaar doesn't make any difference whatsoever as hacking of PAN numbers has PAN numbers has never been a problem. It is mandatory for nation. To all those fools who will rant obscenities against PM MODI, get well soon.

Gagan Saini

12611 - Former Karnataka HC judge joins legal challenge against Aadhaar - Medianama

Former Karnataka HC judge joins legal challenge against Aadhaar

By Siladitya Ray siladitya@medianama.com    January 3, 2018   

Retired Karnataka high court judge, Justice Anand Byrareddy has filed an interlocutory application before the Supreme Court to add himself as one of the petitioners challenging the provisions of the Aadhaar Act 2016.

According to a detailed report on Livelaw.in, Justice Byrareddy highlights that the Act does not distinguish between citizens and non-citizens, alleging that this leaves the system open to abuse and poses a “serious security threat”.

The highlights of the application include:

• The Act fails to account for and be responsible for the welfare of the country’s citizenry as it “fails to distinguish between a citizen and resident/migrant/immigrant (legal and illegal)”.
• The act violates the Fundamental Right to privacy guaranteed under Article 21, “since the biometric and demographic information is collected as a mandatory condition precedent, while the safeguard mechanisms provided are wholly inadequate.”
• The act seeks to create “a wrongful classification amongst a homogeneous group of entitled persons – (i) the ones with an Aadhaar number; and (ii) the ones without an Aadhaar number, the same is arbitrary.”
• Although the Unique Identification Authority of India (UIDAI) is in possession of the data, it has no legal liability for any theft, fraud, crime, and compromise of any security or privacy.
• The passing of the Aadhaar Bill as a Money Bill “amounts to a fraud on the Constitution of India.”

Justice Byareddy had initially filed a separate petition against the implementation of Aadhaar which was dismissed by the apex court. But he was given the liberty to file and interlocutor application and implead himself in the pending petitions. Former Karnataka high court judge, justice KS Puttaswamy, is the lead petitioner in the Aadhaar cases.

Aadhaar eKYC: The core privacy concern

A report by Privacy International, an international organisation which advocates the right to privacy, noted that the scope of Aadhaar eKYC changed over the years which put people’s privacy at risk. It cited the different legislation which was brought up by the UPA government and the current BJP government.

Under the initial implementation of the Aadhaar database had only a single purpose: do the biometrics of a person match those stored for their Aadhaar number?

“So, when someone is seeking to authenticate their identity using Aadhaar, they do so either with their biometrics (either a fingerprint or an iris scan) or through a one-time pin (OTP) sent to their registered mobile number. This is checked against the data held in the Central Identities Data Repository (CIDR) database, and the reply is done on a “yes/no” basis: an individual’s Aadhaar number, and their biometric data or an OTP, is transmitted to the CIDR database, and an answer of only “yes/no” is returned,” the report said.

A legislation was drafted in 2010 called the National Identification Authority of India Bill where it stated that no other information other than the yes/no response could not be given. “However, this version of the legislation failed to pass both houses of the Indian parliament, and did not become law,” it said.

But the Aadhaar act drafted by the current government in 2016 called ‘Targeted Delivery of Financial and other Subsidies, benefits and services Bill’ has some key changes. Rather than simply being the yes/no response originally proposed any other appropriate response sharing such identity information excluding any core biometric information is allowed.

Karnataka government on board with Aadhaar

Meanwhile, the Karnataka state cabinet approved the central legislation to provide statutory backing to the Aadhaar for use of transferring government subsidies and benefits. “The cabinet gave its nod to the Target Delivery of Financial and Other Subsidies, Benefits and Services Bill, 2016, which was passed by Parliament,” Law and Parliamentary Affairs Minister TB Jayachandra told reporters on Tuesday.

Home » Aadhaar, privacy, Right to Privacy, Supreme Court, UIDAI

12561 - A Healthy Dose of Privacy - EPW

A Healthy Dose of Privacy

Dhvani Mehta (dhvani.mehta@vidhilegalpolicy.in) is at the Vidhi Centre for Legal Policy,New Delhi.

The Supreme Court’s privacy judgment has important implications for the right to health, especially the protection of health information. The standards that laws will have to meet to impose restrictions on such protection are examined. In this context, the HIV/AIDS Act, 2017, the implications of a data protection law for health, and the unconstitutionality of mandatorily requiring Aadhaar to obtain treatment for HIV/AIDS and tuberculosis are discussed. 

The author is grateful to Shankar Narayanan for his inputs.

The almost academic nature of the Supreme Court’s judgment on the right to privacy in K Puttaswamy v Union of India (2017a) means that its practical implications will continue to be dissected until they fill several volumes. One of the most important impacts of the judgment is on health, and this article discusses its implications for the scope of the right and the extent to which it is to be balanced with other interests. Justice R F Nariman’s opinion highlights at least three aspects of the right to privacy, each of which has particular significance for health: privacy relatable to the physical body; informational privacy, vesting individual control over the dissemination of personal information; and the privacy of choice, granting individual autonomy over personal choices (K Puttaswamy v Union of India 2017c: para 81).

At various places, the judgment offers examples of the link between issues concerning health and the three aspects of privacy mentioned above. Justice J Chelameswar provides an example of bodily privacy by recognising that the refusal of life-prolonging medical treatment falls within the “zone of the right to privacy” (K Puttaswamy v Union of India 2017d: para 38). Justice D Y Chandrachud states that a reasonable expectation of privacy attaches to medical information (K Puttaswamy v Union of India 2017b: para 177), while personal reproductive choices, which have obvious implications for health, are also recognised to be at the core of the idea of privacy (K Puttaswamy v Union of India 2017b: part 3, para 3F).

The nature of the question before the Court did not, perhaps, allow it to flesh out the health-related aspects of privacy in greater detail. Nor did the Court have the opportunity to set out, exhaustively, the different kinds of public interest that might constitute reasonable restrictions on privacy in the context of health. The most specific pronouncement of this kind is made only in relation to health information: The unauthorised disclosure by a hospital of medical records submitted by individual patients would constitute an invasion of privacy.

However, it would be open to the state

to assert a legitimate interest in analysing data borne from hospital records to understand and deal with a public health epidemic … to obviate a serious impact on the population. (K Puttaswamy v Union of India 2017b: para 182)

The other context in which the judgment discusses health and privacy is in the process of describing the evolution of the privacy doctrine in India (K Puttaswamy v Union of India 2017b: para 57, 58). Justice Chandrachud discusses the Supreme Court’s decision in Mr X v Hospital Z (1998), where a person’s HIV+ status was disclosed to his fiancée and her family. In that case, the Court, while holding that the right to privacy formed an integral component of the right to life under Article 21 of the Constitution, justified the disclosure and held that the right could be restricted for the protection of health (of his partner), among other interests (K Puttaswamy v Union of India 2017b: para 28).

In the Puttaswamy judgment, the Court does not make any observation on the correctness of this decision so far as the balance struck between health and privacy. The Court also cites a judgment of the South African Constitutional Court that dealt with the disclosure of the HIV+ status of three women. But, the judges use it primarily to demonstrate the links between privacy, equality, and dignity, rather than as an example of the balancing of privacy with other interests.

For this balance, we must turn to Justice Chandrachud’s opinion, which lays down a threefold standard that must be met by restrictions on any aspect of the right to privacy: first, the restriction must be laid down by law; second, the restriction must be in pursuit of a legitimate state aim (including the preservation of public health); and third, it must be proportional to the object and the needs sought to be fulfilled by the restricting law (K Puttaswamy v Union of India 2017b: para 180).

However, it is unfortunate that the Court confined itself only to judicial examples while discussing the evolution of privacy in India and the manner in which it is to be balanced with other interests. Legislative protection of the right to privacy has, in some cases, gone far beyond the protection afforded by the courts. A good example of this is the Human Immunodeficiency Virus and Acquired Immune Deficiency Syndrome (Prevention and Control) Act, 2017 (the HIV/AIDS Act).

HIV/AIDS Act

The HIV/AIDS Act contains comprehensive provisions on the protection of confidential health information. Section 8 of the act imposes a general prohibition on the disclosure of a person’s HIV status, permitting it only in the limited circumstance of a order of a court that deems it “necessary in the interest of justice for the determination of issues in the matter before it.” When information about HIV status has been imparted in confidence through a relationship of a fiduciary nature, such information shall not be disclosed without the informed consent of the concerned person. Informed consent may be waived, again, only in limited circumstances. These will include disclosure in the case of a judicial order; for the care and treatment of HIV+ persons; in cases where the information is shared between two healthcare providers for the purpose of treatment; where only statistical information (that could not reasonably be expected to lead to identification) is disclosed; and to officers of the central or state governments for the purposes of monitoring and evaluation.

Unlike the judgment in Mr X v Hospital Z (1998), there are strict conditions laid down for the disclosure of the HIV status of a person to their partner in the HIV/AIDS Act (Section 9). Every healthcare establishment that keeps records of HIV-related information is also under an obligation to adopt data protection measures to ensure the confidentiality of the information (Section 11). Section 39 prescribes a penalty for breach of confidentiality, which may extend to a fine of `1 lakh, although this is confined to the disclosure of information obtained during the course of court proceedings.

The act also protects bodily and decisional aspects of privacy by stating that no person shall be compelled to undergo an HIV test or be subjected to medical interventions, treatment, or research, except with the informed consent of such a person, and in accordance with specified guidelines (Section 5). Informed consent may be waived by a court for the use of a human body or any part thereof in medical research and therapy, for epidemiological purposes, and for screening purposes in a licensed blood bank (Section 6).

These provisions demonstrate that legislation, rather than judicial determination, is more suited to providing a context-specific and nuanced balancing of rights and interests. Each encroachment on privacy imposed by the HIV/AIDS Act is the least restrictive it can be, narrowly tailored to achieve legitimate state interests in the administration of justice and the protection of health of others, encompassing both individual and public health interests.

The value of the Puttaswamy judgment lies in the fact that it will ensure that the HIV/AIDS Act does not remain the exception. The judgment imposes a positive obligation on the state to, first, ensure that all existing restrictions on privacy are contained only in the form of law, and, second, to update or amend existing laws to make sure that they strike a reasonable balance between privacy and other interests.

Review of Health Legislation

There are nearly 100 central laws that have a direct or indirect bearing on health, ranging from the Epidemic Diseases Act, 1897 to the Transplantation of Human Organs and Tissues Act, 1994 and the Protection of Children from Sexual Offences Act, 2012 (POCSO Act). The Ministry of Health and Family Welfare (MoHFW), in consultation with the Ministry of Law and Justice, must undertake a thorough review of these laws to determine whether they meet the standards laid down in the Puttaswamy judgment. For instance, Section 19 of the POCSO Act requires all persons, including medical practitioners who suspect that an offence has been committed under the act, to report it to the Special Juvenile Police Unit or the local police. Although there is obviously a legitimate state interest in the prevention of crime against children, there are concerns about protection of privacy involved in compulsory reporting (Chandra 2017). The act may need additional safeguards to allow the doctor to provide treatment while keeping the patient’s identity confidential.

Varying standards apply to health-related information collected under different legislations. For instance, the Information Technology Act, 2000 and the rules framed under it will apply to confidential prescription information held by online or e-pharmacies (Drugs Consultative Committee 2016), while the protection of information collected during clinical trials is governed by the Guidelines for Clinical Trials on Pharmaceutical Products in India (Good Clinical Practice Guidelines). The Transplantation of Human Organs and Tissues Rules, 2014 itself contains different standards, neither of which provides much detail. Rule 28(f)states that tissue banks applying to be registered must use a unique donor identification number for each donor and restrict access to donor records. They do not specify who may access the records or the conditions under which such access is to be restricted. Rule 32(11), in relation to organ donation and tissue registries, merely states that “measures shall be taken to ensure security of all collected information” without any indication of the different factors that such measures ought to take into account.

Health laws require a review to minimise such differences and to evolve common principles that will govern the collection, storage, and disclosure of health information. The expert committee on data protection mentioned earlier will do some of this work, but the MoHFW must also play an active role in adapting these principles to the context in which they will operate, and framing detailed rules to put these principles into operation. A sense of the work that will be required is evident from the overview of the existing standards on electronic health records.

Electronic Health Records

An Electronic Health Record (EHR) is a “collection of various medical records that get generated during any clinical encounter or event” (National Health Portal 2015). The purpose of collecting such records is to improve evidence-based care, allow quicker diagnosis, and avoid multiple clinical investigations. Currently, EHR standards are largely confined to prescribing the software and hardware requirements for the capture, storage, and exchange of health information.1 These standards are explicitly held not to apply to “wider implementation scenarios of an administrative, legal, or regulatory nature,” although the document setting out these standards also provides its own definitions of data privacy and security (National Health Portal 2015).

The first requirement of the Puttaswamy judgment is that any restriction on the right to privacy may only be imposed by a law. The EHR standards, which currently exist only in the form of a circular issued by the MoHFW, do not meet this requirement, and will have to be revised based on the data protection framework that is likely to be enacted on the recommendations of the expert committee. The standards will now have to be extended explicitly to administrative, legal, and regulatory scenarios, and the definitions of data privacy and security will have to be harmonised with the more general data protection principles that will be developed. These standards should additionally be harmonised with those prescribed for the maintenance of records under Section 12(1)(iii), read with Section 52(2)(f) of the Clinical Establishments (Registration and Regulation) Act, 2010.2

As important as the protection of individual health records is, the Court in the Puttaswamy case explicitly recognises the value of such data for the protection of the larger public health interest. The need for this and the conditions under which such data may be used require some discussion.

Privacy and Public Health Interests

There is a vital role that big data can play in solving some of India’s more acute public health problems. Outbreaks of infectious diseases can be predicted with the use of “collated data sources” (Kang 2016). However, accurate data collection in India is very difficult, especially given the lack of available information in rural areas (Merten 2013). To remedy this, states like Karnataka are making cancer reporting mandatory and creating cancer registries that can provide an
accurate picture of the disease burden in the state (Ghosh 2015). While a legitimate state interest in registries created by such mandatory reporting is clearly made out, what are the safeguards that can be implemented to ensure that the confidentiality of individual patient’s information is preserved to the extent possible?

In 2017, the Indian Council of Medical Research issued the National Ethical Guidelines for Biomedical and Health Research Involving Human Participants. Section 8 of the guidelines deals comprehensively with public health research. This includes the manner in which data may be collected and used, and the instances in which informed consent for the use of such data may be waived.3

However, these guidelines may not be sufficient for the conduct of such research, given that the Puttaswamy judgment clearly requires any restrictions on the right to privacy to be imposed through a law. A bill to regulate biomedical research has now been in the offing for nearly four years (Dhar 2013). The Puttaswamy judgment might provide the right impetus to give it the shape of law.

Mandatory Use of Aadhaar

A discussion on health and privacy would not be complete without considering the implications of the mandatory submission of the unique identifier, Aadhaar, to obtain treatment for HIV/AIDS at anti-retroviral therapy (ARTs) centres or cash benefits under the Revised National Tuberculosis Control Programme. When the linking of the Aadhaar number was introduced as a pilot programme by the National AIDS Control Organisation, the move was initially welcomed as a way to track patients who might drop out of their treatment regime (Chatterjee 2014). However, the compulsory submission of Aadhaar details (introduced by the Madhya Pradesh State AIDS Control Society) is alleged to have made patients avoid government hospitals and ARTs centres for fear of disclosure of their identity (Tomar 2017).

A constitution bench of the Supreme Court will soon hear petitions that have challenged the mandatory use of the Aadhaar under several such schemes (Indian Express 2017). In the absence of any evidence to demonstrate that patients fraudulently obtain HIV/AIDS treatment (and it is very hard to see why they would) or cash assistance for tuberculosis, it is unlikely that the mandatory use of the Aadhaar under these two schemes will withstand constitutional scrutiny. It is difficult to point to any legitimate state interest. The compulsory submission of this information is entirely disproportionate to the aim of stemming the “dissipation of social welfare benefits” (K Puttaswamy v Union of India 2017b: para T[I][5]). Instead, by depriving persons of their right to obtain medical treatment, it violates the right to health guaranteed by Article 21 of the Constitution.

Conclusions

The Puttaswamy judgment also has implications for laws like the Medical Termination of Pregnancy Act, 1971 and the Surrogacy (Regulation) Bill, 2016, where the bodily integrity and decisional autonomy aspects of privacy are involved. However, a discussion of these issues is beyond the scope of this article. On the whole, the judiciary will continue to play an important role over the coming months in ensuring that the principles articulated in the Puttaswamy judgment are given meaningful content in practical challenges to executive encroachment, particularly in the form of the Aadhaar. In the meantime, civil society must continue bringing pressure to bear on Parliament to ensure that a healthy dose of privacy is injected into our legislative framework.

Notes

1 ISO standards have been prescribed for an Electronic Health Record Architecture, while different international standards are recommended for imaging, scanned or captured records, and data exchange.

2 One of the requirements for the registration of establishments under this act is that they fulfil the prescribed provisions for the maintenance of records.

3 These guidelines lay down that informed consent may be waived in cases of research conducted on routinely collected data under national programmes, where people concerned have been informed at the time of collection that data may be used for other purposes; where obtaining consent is impractical and research is to be conducted on stored anonymous data.

References

Chandra, Aparna (2017): Panel Discussion on Privacy and Reproductive Rights hosted by the Vidhi Centre for Legal Policy, India International Centre, New Delhi, 13 October.

Chatterjee, Pritha (2014): “Plan to Link Benefits for HIV Patients to Aadhaar No,” Indian Express,
24 November, viewed on 31 October 2017, http://indianexpress.com/article/cities/delhi/plan-to-link-benefits-for-....

Dhar, Aarti (2013): “Bill to Make Biomedical, Health Research Ethical,” Hindu, 19 September, viewed on 31October 2017, http://www.thehindu.com/todays-paper/tp-national/bill-to-make-biomedical....

Drugs Consultative Committee (2016): “Report of Subcommittee Constituted by the Drugs Consultative Committee to Examine the Issue of Regulating the Sale of Drugs over Internet under the Drugs and Cosmetics Rules, 1945,” 30 September, viewed on 30 October 2017, http://www.cdsco.nic.in/writereaddata/Sub-Committee%20Report%20on%20e-ph....

Ghosh, Padmaparna (2015): “Karnataka Takes the First Step towards Reducing Cancer Rates—By Mapping the Epidemic,” Scroll.in, 9 October, viewed on 30 October 2017, https://scroll.in/article/754178/karnataka-takes-the-first-step-towards-....

Indian Express (2017): “Aadhaar Case: Supreme Court to Set up Five-judge Constitution Bench to Hear Pleas,” 30 October, viewed on 31 October 2017, http://indianexpress.com/article/india/aadhaar-case-supreme-court-to-set....

K Puttaswamy v Union of India (2017a): SCALE,
SC, 10, p 1.

— (2017b): SCALE, SC, 10, p 1 (plurality opinion).

— (2017c): SCALE, SC, 10, p 1 (Nariman, J, concurring).

— (2017d): SCALE, SC, 10, p 1 (Chemaleswar, J, concurring).

Kang, Gagandeep (2016): “Mapping Disease with Big Data,” Hindu, 25 December, viewed on
30 October 2017, http://www.thehindu.com/sci-tech/health/Mapping-disease-with-big-data/ar....

Merten, Martina (2013): “The Problem with Data Collection in India,” Pultizer Center, 25 October, viewed on 30 October 2017, https://pulitzercenter.org/reporting/problem-data-collection-india.

Mr X v Hospital Z (1998): SCC, SC, 8, p 296.

National Health Portal (2015): “Electronic Health Records Standards,” 3 June, viewed on 30 October 2017, https://www.nhp.gov.in/executive-summary_mtl.

Tomar, Shruti (2017): “Linking Benefits for AIDS Patients to Aadhaar Triggers Privacy Concerns,” Hindustan Times, 3 April, viewed on 31 October 2017, http://www.hindustantimes.com/bhopal/linking-benefits-for-aids-patients-....

Updated On : 27th Dec, 2017

12486 - Should Aadhaar be mandatory? - Deccan herald

Should Aadhaar be mandatory?

Amber Sinha Dec 9 2017, 23:47 IST

Should Aadhaar be mandatory?

This week, a constitutional bench of the Supreme Court will adjudicate on limited questions of stay orders in the Aadhaar case. After numerous attempts by the petitioners in the Aadhaar case, the court has agreed to hear this matter, just shy of the looming deadline of December 31 for the linking of Aadhaar numbers to avail government services and benefits. Getting their day in the court to hear interim matters is but a small victory in what has been a long and frustrating fight for the petitioners. In 2012, Justice K S Puttaswamy, a former Karnataka High Court judge, filed a petition before the Supreme Court questioning the validity of the Aadhaar project due its lack of legislative basis (the Aadhaar Act was passed by Parliament in 2016) and its transgressions on our fundamental rights.

Over time, a number of other petitions also made their way to the apex court challenging different aspects of the Aadhaar project. Since then, five different interim orders of the Supreme Court have stated that no person should suffer because they do not have an Aadhaar number.

Aadhaar, according to the Supreme Court, could not be made mandatory to avail benefits and services from government schemes. Further, the court has limited the use of Aadhaar to only specific schemes, namely LPG, PDS, MNREGA, National Social Assistance Program, the Pradhan Mantri Jan Dhan Yojna and EPFO.

The then Attorney General, Mukul Rohatgi, in a hearing before the court in July 2015 stated that there is no constitutionally guaranteed right to privacy. But the judgement by the nine-judge bench earlier this year was an emphatic endorsement of the constitutional right to privacy.

In the course of a 547-page judgement, the bench affirmed the fundamental nature of the right to privacy, reading it into the values of dignity and liberty.

Yet months after the judgement, the Supreme Court has failed to hear arguments in the Aadhaar matter. The reference to a larger bench and subsequent deferrals have since delayed the entire matter, even as the government has moved to make Aadhaar mandatory for a number of government schemes.

At this point, up to 140 government services have made linking with Aadhaar mandatory to avail these services. Chief Justice of India Dipak Misra has promised a constitution bench this week, likely to look only into interim matters of stay on the deadline of Aadhaar-linking. It is likely that the hearings for the final arguments are still some months away. 

The refusal of the court to adjudicate on this issue has been extremely disappointing, and a grave disservice to the court's intended role as the champion of individual rights.

It is worth noting that the interim orders by the Supreme Court that no person should suffer because they do not have an Aadhaar number, and limiting its use only to specified schemes, still stand.

However, since the passage of the Aadhaar Act, which allows the use of Aadhaar by both private and public parties, permits making it mandatory for availing any benefits, subsidies and services funded by the Consolidated Fund of India, the spate of services for which Aadhaar has been made mandatory suggests that as per the government, the Aadhaar Act has, in effect, nullified the orders by the Supreme Court.

This was stated in so many words by Union Law Minister Ravi Shankar Prasad in the Rajya Sabha in April. This view is an erroneous one. While acts of Parliament can supersede previous judicial orders, they must do so either through an express statement in the objects of the Act, or implied when the two are mutually incompatible. In this case, the Aadhaar Act, while permitting the government authorities to make Aadhaar mandatory, does not impose a clear duty to do so.

Therefore, reading the orders and the legislation together leads one to the conclusion that all instances of Aadhaar being made mandatory under the Aadhaar Act are void.

The question may be more complicated for cases where Aadhaar has been made mandatory through other legislations, such as Prevention of Money Laundering Act, as they clearly mandate the linking of Aadhaar numbers, rather than merely allowing it. However, despite repeated appeals of the petitioners, the court has so far refused to engage with the question of the legality of such instances.  

How may the issues finally be resolved? When the court deigns to hear final arguments, the Aadhaar case will be instructive in how the court defines the contours of the right to privacy. The right to privacy judgement, while instructive in its exposition of the different aspects of privacy, does not delve deeply into the question of what may be legitimate limitations on this right.

In one of the passages of the judgement, "ensuring that scarce public resources are not dissipated by the diversion of resources to persons who do not qualify as recipients" is mentioned as an example of a legitimate incursion into the right to privacy. However, it must be remembered that none of the opinions in the privacy judgement were majority judgements.

Therefore, in future cases, lawyers and judges must parse through the various opinions to arrive at an understanding of the majority opinion, supported by five or more judges. While the privacy judgement was a landmark one, its actual impact on the rights discourse and on matters like Aadhaar will depend extensively on the how the judges choose to interpret it.

(Amber Sinha is a lawyer and works at the Centre for Internet and Society)

12405 - Govt makes strong pitch for Aadhaar, tells Supreme Court scheme saved India Rs 60,000 crore - India Today

Govt makes strong pitch for Aadhaar, tells Supreme Court scheme saved India Rs 60,000 crore

The Narendra Modi put forward a strong case for Aadhaar in the Supreme Court, telling the court the scheme saved the country Rs Rs 59,677 in the last three years. The government also said Aadhaar ensures privacy.

Harish V Nair

 | Posted by Dev Goswami

New Delhi, November 19, 2017 | 

The government also said Aadhaar's technical architecture ensures privacy and security (Picture for representation)

HIGHLIGHTS

• 1 - Aadhaar-DBT scheme saved India Rs 59,677 crore, govt tells SC.
  
  
• 2 - 88 per cent of population has obtained Aadhaar: Govt

• 3 - Scheme's technical architecture ensures privacy and security: Govt
  
  

Making a strong case for Aadhaar cards, the Narendra Modi government has told the Supreme Court that it could save a whopping Rs 59,677 crore through Direct Benefit Transfer (DBT) scheme in the last three years by weeding out duplication and fake claimants of welfare measures.

The Centre also said 118.64 crore Indians, which is 88% of the population, had obtained Aadhaar and they used it 1,216.8 crore times for authentication purposes.

Questioning claims that linking of biometric data collected through Aadhaar to banking, mobile connections and other services was a violation of right to privacy, the government also said over 12.64 crore bank accounts were opened using Aadhaar-based e-KYC (Know Your Customer).

The assertion through an affidavit comes ahead of the SC constitution bench hearing which will determine if the mandatory rule to submit personal details including iris scan and fingerprints violate the right to privacy as argued by a host of petitioners who have challenged it.

Critics say the ID system weaves together enough data to create a full profile of a person's spending habits, their friends, property they own and a trove of other information.

'PUBLIC INTEREST'

"There is a clear public interest in ensuring that the various benefits, subsidies and services being offered by the state should reach the intended beneficiary and not to fakes and duplicates, which proliferate in the system leading to loss of crores of rupees of public money", said the affidavit of RP Pant, UIDAI assistant director general, and drafted by the body's standing counsel Zoheb Hossain.

The unique identification authority had in an earlier instance said public sector oil companies detected around 55,000 duplicate connections on the basis of Aadhaar numbers and once these connections are blocked, it would save the exchequer around Rs 35 crore annually.

The court should encourage and endorse the use of Aadhaar-based biometric identification to prevent pilferage, leakages and to ensure elimination of bogus or fake persons from the system, it said.

'HIGH LEVEL OF PRIVACY'

Seeking to allay fears of data leaks, the UIDAI said "technical architecture of Aadhaar has been structured in such a way, to ensure clear data verification, authentication and de-duplication, while ensuring a high level of privacy and information security."

The apex court in its August 24 landmark verdict declaring privacy as a fundamental right expressed concerns over inroads made into an individual's right to privacy in the digital age and called for a data protection law proportionate to the purpose for which data is collected and stored.

"Informational privacy is a facet of the right to privacy. The dangers to privacy in an age of information can originate not only from the state but from non-state actors as well. We commend to the Union government the need to examine and put into place a robust regime for data protection," the SC had said.

QUESTION OVER AADHAAR REMAINS

The nine-judge bench of SC while declaring right to privacy a fundamental right has not commented if the Aadhaar scheme was a violation of it, as contended by the petitioners. This question has been delegated to a separate fivejudge bench which will begin hearings soon.

But a minute reading of the judgment makes it clear that the bench might have left enough loopholes, through reasonable restrictions on the extent to which citizens can enjoy fundamental right to privacy, after which the scheme may have secured a lifeline.

The judges also said the right to privacy is not absolute and has certain limitations.

One of the judges, Justice S K Kaul, in the privacy judgment bench even ruled that there is no harm in seeking details in legitimate national security interest, in public interest including for scientific or historical research purposes or statistical purposes.

He even said that private information can be elicited for regulatory framework of tax and working of financial institutions and markets.

The bench said "the legitimate aims of the state would include for instance protecting national security, preventing and investigating crime, encouraging innovation and the spread of knowledge, and preventing the dissipation of social welfare benefits."

Petitioners including retired Karnataka High Court judge K Puttaswamy, and social activist Aruna Roy said details for Aadhaar are collected by private contractors and NGOs hired by UIDAI without any safeguard, making them prone to misuse.

They claimed empirical research shows that the biometric identification denoted for UID, namely the iris scan and fingerprint identification, is faulty and could be abused.

12220 - New petition in apex court challenges linking Aadhaar with bank account and phones - TNN

New petition in apex court challenges linking Aadhaar with bank account and phones

Laxmi Prasanna | TNN | Oct 19, 2017, 20:13 IST

THIRUVANANTHAPURAM: A new writ petition has been filed in the Supreme Court challenging the linking of Aadhaar with one's bank account to mobile phones. The writ filed on behalf of noted gender activist and writer Dr. Kalyani Menon Sen is expected to be heard after Diwali holidays. This is the recent writ after a spate of petitions led by retired Justice K. S. Puttaswamy.

"The current writ petition numbered as WP [C] No. 1002/2017 is filed in public interest under Article 32 of the Indian Constitution to raise issues which endanger Fundamental Rights of Indian citizens, protected under Articles 14, 19 and 21 of the Constitution. It is filed on behalf of Dr Kalyani Menon Sen and is likely to be heard by the Supreme Court after Diwali holidays," Senior counsel Vipin Nair told TOI . This petition challenges Rule 2(b) of the Prevention of Money-laundering (Maintenance of Records) Second Amendment Rules, 2017 (Impugned provision), which seeks to amend Rule 9 of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, issued under the Prevention of Money-laundering (PMLA) Act 2005, he said.

By virtue of this Impugned Provision, submission of Aadhaar Number has been made mandatory for individual clients, companies, partnership firms and trusts for opening bank accounts, maintaining existing bank accounts, making any financial transactions of and above Rs. 50,000; and crediting foreign remittance into 'small accounts'. Existing bank account holders have been directed to furnish Aadhaar numbers before Dec 31 this year. Non-compliance with this provision will render the concerned bank accounts in-operational indefinitely, subject to submission of the Aadhaar Number and Permanent Account Number (PAN), he said.

The petition further seeks to challenge the Circular issued on March 23 this year by the Telecommunication department wherein it has been made mandatory for all mobile phone holders to link their mobile phone numbers with Aadhaar.

This petition appeals to the court to issue an appropriate order to declare that the impugned circular issued on March 23 this year is null and void and totally unconstitutional as it violates the fundamental rights of the Indian constitution. It also seeks the court to issue an order declaring that based on such a provision, the mobile phones of subscribers will not be made in-operational and future applicants will not be forced to submit their Aadhar numbers. It also pleads before the court to seek clarification from such companies or respondents who enforce such rules even when the program under Aadhaar Act is entirely voluntary. It also seek to issue an order to ensure that biometric, fingerprints and iris scans are the personal property of the citizens and not that of the state or some company infringing the privacy of the individual. 

12042 - Saving privacy for public good - Economic Times Blog

Saving privacy for public good

September 14, 2017, 11:05 PM IST Economic Times in ET Commentary | India | ET

By Akriti Gaur & Namrata Mukherjee

The Supreme Court’s judgement last month of Justice K S Puttaswamy vs Union of India (goo.gl/wdAqsu) has been widely acclaimed as a significant milestone in the jurisprudence on fundamental rights in India. The court unanimously declared that court unanimously any is a fundamental right and recognised informational privacy as one of its facets.

The right to informational privacy requires that an individual is able to affirmatively control her life and personality by controlling her personal information. This means that the law must guarantee an individual the ability to exercise control over the collection, use and disclosure of her personal information. This right is of particular significance in the digital age in which people are giving up huge volumes of personal information to access digitised services.

Further, in an age where State and non-State actors alike have access to acitizen’s personal data and activities — such as biometric information, internet-use patterns, geometric information, financial information — acomprehensive law on data protection to safeguard an individual’s right to privacy is imperative. As the Supreme Court noted, this must be achieved by enacting an effective data protection law for India.

The ‘fair information practice principles’ (Fipps), developed in the 1980s as a response to increased automated use of data, form the bedrock of dataprotection laws across most jurisdictions. The intention of Fipps is to ensure that even when personal data about an individual is collected, such collection is lawful, and the individual continues to be able to exercise control over it.

Fipps prescribe the following minimum standards of data protection: personal data must be collected with the consent of the individual, its use must be limited to the purpose of collection, the individual must continue to have access to her personal data and be able to rectify it, the data must ensure data-security measures to protect personal data.

While India does not have a dataprotection statute, the Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011, issued under the IT Act, seeks to introduce Fipps in India. While the rules are a first attempt towards framing alegal framework for data protection, they fall considerably short of internationally accepted data-protection standards.

First, they apply to a restricted category of data that are deemed ‘sensitive’ in nature. This includes data such as those pertaining to physical, physiological and mental health conditions, sexual orientation, medical records, biometric information, etc.

Second, they apply only to the private sector, thus, giving the government a free reign to collect and use people’s personal information as per their discretion. Further, it allows for unlimited sharing of data with the GoI on broad grounds such as prevention, detection, investigation including of cyber incidents, prosecution and punishment of offences, etc, coupled with a limited obligation on the government to not disclose such data.

Finally, the absence of an independent and effective enforcement mechanism means that these rules are nothing but a paper tiger.

Other than the IT rules, scattered instruments across sectors such as circulars issued by the Reserve Bank of India requiring the formulation of privacy policies, the Credit Information Companies (Regulation) Act, 2005, and allied rules, and provisions of licensing agreements for telecom service providers recognise limited Fipps. However, they too fall short.

Given India’s transition into a digital economy, an effective regime for the protection of personal data is the need of the hour. The creation of such aregime will be a complex exercise that involves balancing the rights of an individual vis-à-vis the benefits of big data and legitimate State interests such as national security, preventing and investigating crime, encouraging innovation and the spread of knowledge, and preventing the dissipation of social welfare benefits.

Attempts have been made in this regard in the past with both private bodies and GoI coming up with multiple drafts of a Privacy Bill that recognises data protection as an intrinsic aspect of privacy in the digital age. Unfortunately, none of these Bills has seen the light of day.

With the Supreme Court judgement on privacy, and international trends such as the European Union revamping its data-protection framework, India can no longer take cover behind the ambiguity on the legal position pertaining to the privacy, or afford to lag behind the international narrative.

(The writers are research fellows, Vidhi Centre for Legal Policy, New Delhi)















DISCLAIMER : Views expressed above are the author's own.

11958 - A Start, Not the Culmination - EPW

http://www.epw.in/journal/2017/35/editorials/start-not-culmination.html

A Start, Not the Culmination

The right to privacy judgment reaffirms the individual’s right to dignity and freedom.

The Supreme Court’s nine-judge bench ruling in Justice K S Puttaswamy v Union of India, delivered on 24 August, is a new charter of rights for the Indian citizen in the 21st century. Apart from overturning past precedents on the right to privacy and effectively erasing some of the most disgraceful judgments of the Court on matters of civil rights (ADM Jabalpur v S S Shukla and Suresh N Koushal v Naz Foundation), it has also set the course for a progressive and meaningful interpretation of civil–political rights in the context of the Constitution.

The judgment has grounded privacy on not just the text of the Constitution but also on international law and broader principles that have been accepted in most other liberal democracies. It has brought India’s rights jurisprudence in line with that of the rest of the world, keeping in mind the developments in technology and governance. Where the Supreme Court once dismissed the notion that surveillance by the state could affect one’s exercise of fundamental rights (in Kharak Singh v State of UP), it has now created the grounds for effectively dismantling unjustified surveillance measures. With technology providing new ways for governments to obtain information about citizens, the Supreme Court’s judgment defends dissent and non-conformity in a democracy.

It would be a mistake though to see this judgment only through the lens of data protection and state surveillance. By recognising that privacy includes not just the power to control information about oneself, but also bodily autonomy and the right to make choices, the Supreme Court has given citizens a powerful tool to challenge intrusive actions. The immediate consequences of this finding will be seen in the challenge to Section 377 of the Indian Penal Code, 1860, which criminalises homosexuality, and perhaps the pending challenge to the draconian state government bans on possession of beef and alcohol. It will also have an impact on laws relating to reproductive rights, whether in the context of abortion or surrogacy, living wills, mental health, disability rights, and many other areas. Specifically, it will affect those parts of the law that deny citizens the right to choose what is in their best interests and impose the will of a paternalistic state on them.

To the pending challenge to the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and subsequent notifications extending the Aadhaar’s mandatory use for myriad reasons, the consequences are not so obvious. While the judgment has clarified that the provisions of the law will be tested against the right to privacy laid out in the Constitution, at least one opinion among the six delivered hints that provision of welfare benefits is a ground for restrictions on the right to privacy. That said, it is still possible for the petitioners to claim that the law and its use, even for compelling state interests, is not “just, fair or reasonable.” Whatever the ultimate outcome, the Supreme Court’s judgment has ensured that Aadhaar will receive much greater judicial scrutiny than its makers probably intended.

Nonetheless, the positive impact of the Puttaswamy judgment should not be taken for granted. The jurisprudence of the Supreme Court is replete with grand pronouncements on principle that are retracted shortly afterwards for “pragmatic” or other such concerns. A recent example is the Court’s consistent refusal to apply the principles laid down in the Shreya Singhal case, in which Section 66A of the Information Technology Act, 2000 was struck down as constitutionally invalid, in the context of other cases concerning the freedom of speech and expression. On the contrary, the Court has even invented new grounds for restrictions of the right, beyond the limited grounds available in the Constitution.

The positive impact of this judgment may also get diluted if the courts were to allow claims of privacy to defeat concerns of transparency in governmental functioning. While a body of case law has developed over the years explaining why standards of privacy may have to be different for public figures and private individuals, the broad principles of this judgment could be used in the future to stifle reporting of misdemeanours and crimes of those in positions of power and privilege. It is once again incumbent on the judiciary to draw a careful balance between the two competing concerns in the larger public interest.

The most important takeaway from this judgment is an affirmation of the core constitutional principle that citizens of India are not subjects of the state. Individuals are entitled to live with dignity and the freedom to live their lives to the fullest potential, not because the state lets them, but because it is their right as humans. This judgment is the start, and not the culmination, of the process to fundamentally realign the relationship between the individual and the Indian state.