12751 - Aadhaar Law is inadequate to deal with privacy issues THE ASIAN AGE.

Aadhaar Law is inadequate to deal with privacy issues

THE ASIAN AGE. | PAVAN DUGGAL

Published : Jan 14, 2018, 3:33 am IST

Aadhaar ecosystem is unsafe as there are no parameters for protecting cyber security and privacy of its users.

People have many doubts about the safety of their information and the adequacy of current laws in addressing the issues that may arise from any future breach of privacy or data theft from Aadhaar database or its vast network.

The unauthorised access to the Aadhaar database that was obtained by a journalist to prove how unsafe the system was, has only increased concerns about the safety of personal data of nearly 120 crore people — the largest database available with a single authority anywhere in the world. Contrary to assertions of the government, this incident proved that the database is available on demand.

Though the Unique Identification Authority of India (UIDAI), the body responsible for Aadhaar, proposed the concept of Virtual Identity on January 10, whereby people would not have to share their actual Aadhaar number, the damage has already been done.

People have many doubts about the safety of their information and the adequacy of current laws in addressing the issues that may arise from any future breach of privacy or data theft from Aadhaar database or its vast network.

The legal framework for Aadhaar is the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Servi-ces) Act, 2016 and a January 10, 2018, circular that seeks to introduce virtual identity. The Aadhaar Act, however, does not envisage a virtual identity.

If we look at these legal frameworks, we find that the Aadhaar Act is not adequate to deal with the challenges thrown up, due to the increased breaches in the Aadhaar ecosystem. The offenc-es under the Aadhaar Act are defined under chapter VII.

Section 48 of the said Aadhaar Act makes the act of unauthorised accessing or extracting data from the Central Identities Data Repository, downloading, copying or extracting data therefrom, introducing or causing to be introduced any virus or computer contaminant, damaging or causing to be damaged the data in the Central Identities Data Repository or disrupting or causing to be disrupted the access to data in the Central Identities Data Repository as an offence punishable with three years imprisonment and Rs 10 lakh fine. The elements of hacking of Aadhaar database could be brought under Section 38 of the Aadhaar Act, 2016.

In addition, the provisions of Section 66 read with Section 43 of the Information Technology Act, 2000, relating to computer related offences could also be invoked. The said provisions make the act of hacking an offence that is punishable with five years of imprisonment.

 As of now, the Aadhaar Act is almost two years old and outdated, given the increasing focus of the government on making Aadhaar mandatory for most services. The obvious result is that there are almost no convictions under this law.

Therefore, the Aadhaar ecosystem is completely unsafe as there are no parameters for protecting cyber security and privacy of Aadhaar holders. Rights, duties and obligations of service providers and stakeholders need to be defined clearly. On top of it, the new concept of Virtual Identity, which is introduced on an optional basis, makes the entire exercise not very effective in the long run.

 India cannot take inspiration from advanced countries as there are no specific model laws in other countries in this regard. Some countries have tried to experiment with national biometric identity systems but have chosen not to implement it, given the huge security and other legal challenges that were in store.

Despite all the shortcomings in Aadhaar, there is no denying the fact that it has become the central point of our day-to-day life. Hence, all efforts must be made now to make Aadhaar more secure and safe. The government needs to revise and amend the Aadhaar Act, 2016 to mirror existing ground realities. While the Supreme Court judgment on Aadhaar law violating privacy is awaited, the government must proactively work on protecting cyber security of the Aadhaar ecosystem as a whole.

(The author is an advocate of the Supreme Court of India and the chairman of the International Commission on Cyber Security Law)

Tags: aadhaar, biometric identity, aadhaar database, virtual identity

11976 - Currently, privacy protection under Aadhaar is not strong: Pavan Duggal - DNA India

Currently, privacy protection under Aadhaar is not strong: Pavan Duggal

http://www.dnaindia.com/business/interview-currently-privacy-protection-under-aadhaar-is-not-strong-pavan-duggal-2543248

MANSI TANEJA | Updated: Sep 6, 2017, 07:15 AM IST, DNA

Interview with Cyber law expert and Supreme Court lawyer

The recent Supreme Court judgment that right to privacy is 'intrinsic to life and liberty' may have repercussions on Aadhaar scheme which collects personal details and biometrics for generating a unique identification number. Cyber law expert and Supreme Court lawyer Pavan Duggal, in an interview with Mansi Taneja, said the SC ruling is the 'Dawn of a new beginning' but Aadhaar Act needs to be amended in view of the same as it violates privacy in its current form.

How will the SC judgement on privacy impact the Aadhaar scheme?

The SC judgement will have a direct impact on the Aadhaar scheme. Though the judgement is prospective and people have a fundamental right to privacy, as on this date, Aadhaar data continues to be on a central database. Currently, privacy protection under Aadhaar is not strong as cybersecurity has been just given a lip service. Aadhaar has been walking on thin ice. Since 2009-16, there was no law governing it. It was granted legality presuming that Aadhaar will be voluntary. The Act needs to be amended as Aadhaar has been made mandatory -- for bank accounts, income tax returns and others. SC will now decide privacy matters related to it.

An entire ecosystem has developed around Aadhaar. How secure is it?

This ecosystem around Aadhaar is completely insecure and in its current form, it violates privacy norms. When the Aadhaar Act was passed, it was with the presumption that Aadhaar would be voluntary, so it only talked about the security of the Central Identities Data Repository. The more the cybersecurity, more are chances that privacy of Aadhaar will be protected. There have been many instances of Aadhaar leaks, which show that it is not completely secure. That is why UIDAI (Unique Identification Authority of India) is filing FIRs right, left and centre. No responsibility has been fixed for stakeholders involved in the ecosystem. Also, there is no individual redressal mechanism if there is some breach related to Aadhaar. Aadhaar has cut off the hand of its users. Especially, if your Aadhaar data is compromised, you as an Aadhaar user are not authorised/empowered to report the matter directly to police. Only UIDAI can report the matter to the police. Aadhaar should be made voluntary. Making it mandatory is like putting entire citizens of the country in a river of fire without adequate protection.

Technology is changing rapidly. And at a time when the government is talking about Digital India, where does our Information Technology (IT) Act stand?

The current IT Act is a thoroughly outdated legislation. The last amendments were done in 2008; that too, were changes and all issues were not addressed. Technology has changed so much in the last ten years, the IT Act needs to reflect existing realities of today's world. And in context of Aadhaar, how it is compliant with IT Act, we don't know. Aadhaar is nothing but data and information in an electronic format.

Lastly, how do you think the SC judgement will impact the ongoing case of WhatsApp/Facebook?

The SC ruling does not cover private players. The judgement has only made a right to privacy enforceable against states actions. The IT Act covers third-party service providers, but the government has not specified parameters for privacy protection in it. The government needs to come out with rules and regulations and ask providers to take steps for protection and preserve the privacy of users.

11904 - Back to square one in flawed Aadhaar ecosystem - Economic Times

Back to square one in flawed Aadhaar ecosystem

By Rajiv Singh, ET Bureau|

Aug 27, 2017, 12.01 AM IST

The SC judgment overturned a 63-year-old ruling that refused to recognise privacy as a fundamental right. 

In an increasingly digital world, in which artificial intelligence and big data are converging, there’s ostensibly no place to hide. The state has access (over the cloud) to your dates, dinners, calls, holidays, work, bank account et al. Besides, an expanding ecosystem for your unique ID Aadhaar, linking it with PAN cards, bank accounts, death certificates etc has raised questions on privacy and security — and inevitably prompted numerous WhatsApp quips, including: “We finally know the one thing you will take with you when you die. The Aadhaar number!” 

On Thursday, the Supreme Court came to the rescue, ruling that privacy is a fundamental right, protected as an intrinsic part of right to life and personal liberty and as part of freedoms guaranteed by the Constitution. In effect, “the judgment has put the ball in the government’s court to come up with a privacy law,” says cyber law expert Pavan Duggal. The SC judgment impacts state actions on collecting any biometric data and using the same to offer services or linking to multiple other services, like PAN, driving licence, pensions and so on, like in the case of Aadhaar. 

However, Ajay Bhushan Pandey, CEO of the Unique Identification Authority of India (UIDAI), told agencies that linking of PAN with biometric identifier Aadhaar will continue as previously directed; as will the quoting of the 12-digit ID number for availing various government subsidies. “The SC verdict holding privacy as a fundamental right has in no way stopped the quoting of Aadhaar for various schemes as well as the filing of income tax returns,” says Pandey. 

Duggal points out that the SC judgment is monumental and recognises privacy as a fundamental right. “From 2009 to 2016 (almost 1 billion people were enrolled in these seven years), information was being collected based on an executive order. The Aadhaar Act was passed on the presumption that it is voluntary but later its use was being made mandatory. An ecosystem started developing around Aadhaar,” said Duggal. 

That ecosystem “is flawed as it does not address cybersecurity, privacy and security of data issues. Government will have to amend the Aadhaar Act,” added Duggal. Pandey, for his part, maintained that the “SC judgment has not said anything about the Aadhaar Act”. 

The SC judgment overturned a 63-yearold ruling that refused to recognise privacy as a fundamental right. Since then, much data has been generated and digitised, making it easier for the state to dive deep into citizen’s private lives.

Recognising the challenges, even UIDAI’s first chairman Nandan Nilekani told ET in an interview in late April that India needs an advanced data protection, security and privacy law to deal with the data deluge. The SC judgment could now accelerate that. 

Read more at:

http://economictimes.indiatimes.com/articleshow/60237188.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst

9922 - India’s Aadhaar Law and Cyber Security, with a legal eye - Financial Express

India’s Aadhaar Law and Cyber Security, with a legal eye

By Express Computer on May 2, 2016

Pavan Duggal, Cyber Law Expert and Advocate Supreme Court of India

Issues pertaining to cyber security of Aadhaar ecosystem need to be very well examined and analyzed. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 not only symbolizes the biometric identity of individuals, but it also symbolizes biometric and demographic face of the biggest democracy in the world.

By Pavan Duggal

The month of March, 2016 was a historic month in the legislative history of India. This was the month in which the Parliament of India debated and passed a legislation dedicated on Aadhaar being the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. The said Act has received the assent of the President of India on 25th March, 2016 and came into effect thereafter.

The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 is indeed very significant as this has for the first time provided legal sanctity and validity to the Aadhaar ecosystem. It is pertinent to note that earlier in 2009, when Aadhaar was introduced it was done by means of an act of the Executive. From 2009 to 2016, there was not a single legislation that was passed by Parliament, which granted legality to the Aadhaar ecosystem. Meanwhile, various Public Interest Litigations were filed in the Supreme Court of India and the Supreme Court held that Aadhaar cannot be made mandatory by the Government till such time privacy related issues concerning Aadhaar ecosystem are not effectively determined by the Supreme Court.

The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 is a law that is aiming to provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is provided from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals.

The said legislation deals with enrolment and grant of Aadhaar Numbers on the receipt of demographic information and biometric information from the applicant. The term “demographic information” has been defined to include information relating to name, date of birth, and other relevant information as may be specified for the purposes of issuing an Aadhaar Number. However, the definition of demographic information does not include race, religion, caste, tribe, language, records of entitlement, income or medical history. 

Further, since Aadhaar is based on biometric information, biometric information has been defined to mean photograph, finger print, Iris scan, or such other biological attributes of an individual as may be specified by regulations.

The legislation has provided for the establishment, operation and maintenance of the Central Identities Data Repository for all the biometric and demographic information of Aadhaar Number holders. Further, Unique Identification Authority of India (UIDAI) has been given the responsibility of authentication of the Aadhaar Number of Aadhaar Number holders in relation to his or her biometric or demographic information provided, on the request made to the said Authority by any requesting party.

Given the fact that Aadhaar deals with the biometric information, the same is sensitive personal data within the meaning of the law, as defined under the Information Technology Act, 2000 and rules and regulations made thereunder. In the context of the Aadhaar ecosystem, thus the security of identity information becomes critical.

The Unique Identification Authority of India (UIDAI) has been straddled with this primary responsibility of ensuring the security of identity information and authentication records of individuals. Further, the Authority has been mandated to take all necessary steps to ensure that information in its possession or control is secured and protected against access, use or disclosure not permitted under the law and against loss, destruction or damages.

A perusal of a number of offences under Chapter VII of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 including unauthorized access to Central Identities Data Repository shows that they have not been given the kind of deterrent effect that matches the expectations of people.

In this regard, the cyber security protection elements pertaining to Aadhaar assume tremendous significance. Under Section 28 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, the Authority has been mandated to adopt and implement appropriate technical organization security measures for the information in question. However, what the said appropriate technical and security measures will be, have not been defined.

The Indian Cyberlaw mandates that reasonable security practices and procedures must be undertaken by a legal entity dealing, handling or processing sensitive personal data. Further, the Indian Cyberlaw has made ISO 27,001 as an embodiment of reasonable security practices and procedures. In this context, we find that the specified cyber security parameters in respect of Aadhaar ecosystem, has not been so prescribed, thereby leading to potential confusion.

The issues pertaining to cyber security as defined under the Information Technology Act, 2000, in my opinion, are equally applicable in the context of the Aadhaar ecosystem. The Aadhaar legislation has not really gone much deeper into the issue of protection and preservation of cyber security pertaining to the Aadhaar ecosystem. It is important to appreciate that the Aadhaar ecosystem is a Critical Information Infrastructure of India and as such, there is a need for specific provisions to enhance the cyber security of the said Critical Information Infrastructure.

Further, it is pertinent to note that the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 itself does not have any specific provisions for protection and preservation of cyber security in the context of the Aadhaar ecosystem. However, it is pertinent to note that the Central Government has been given the discretion to make rules to carry out the provisions of this Act. The Central Government can come up with specific cyber security parameters for protecting and preserving not just the Aadhaar Numbers, but also the connected biometric and demographic information and also all contents pertaining to the Central Identities Data Repository.

Issues pertaining to cyber security of Aadhaar ecosystem need to be very well examined and analyzed. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 not only symbolizes the biometric identity of individuals, but it also symbolizes biometric and demographic face of the biggest democracy in the world. As such, it is likely to expect that with the passage of time, the Aadhaar ecosystem could potentially be targeted by various state and non-state actors. Unauthorized breach into the cyber security could also prejudicially impact its security and also prejudicially impact the preservation and protection of India’s cyber security, sovereignty and integrity. In case, if this aspect will not given the requisite focus and emphasis, this could lead to potential cyber security breaches which could impact not just the Aadhaar ecosystem as a whole, but could also impact people’s confidence and trust in the Aadhaar ecosystem as the identity system

All stakeholders are looking up to the Government to come up with appropriate cyber security mechanisms, processes and procedures which can help make the Aadhaar ecosystem far more protected, from unauthorized intrusion by state and non-state actors. This is a matter of urgent and immediate concern. 

It is common knowledge that the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 was passed very quickly. In this context, the responsibility lies on the Central Government to ensure that it puts in place adequate norms, procedures and mechanisms, in addition to the norms already stipulated under the Information Technology Act, 2000, to deal with cyber security aspects of biometric information of Aadhaar in the Central Identities Data Repository, for making the Aadhaar ecosystem far safer and more secure.

The author Pavan Duggal, Advocate, Supreme Court of India, and leading expert and authority on Cyberlaw, Cybersecurity Law & Mobile Law. The author is also President of Cyberlaws.net; and Head of Pavan Duggal Associates, Advocate

- See more at: http://computer.financialexpress.com/columns/indias-aadhaar-law-and-cyber-security-with-a-legal-eye/17347/#sthash.XBiglnCX.dpuf