13813 - Can the Aadhaar Act and a Data Protection Act Coexist? - The Wire

LAW

Can the Aadhaar Act and a Data Protection Act Coexist?

The data protection draft bill and report add to the conversation around meaningful, just and fair data protection and its simultaneous existence with the unjustifiable privacy-related incursions of the Aadhaar project.

Credit: PTI

Praavita

LAWTECH

30/JUL/2018

Much like the finale of an exasperatingly long-drawn out TV series, the Srikrishna Committee submitted its final report to the law and IT minister on Friday. However, it appears that this emotionally and physically exhausting data privacy drama will be prolonged as the Aadhaar judgment isn’t out yet.

The Srikrishna Committee was constituted during the pendency of the hearings in the constitutional challenges to the validity of the UID project. The Union government had in fact stated during its submissions to the Supreme Court that it was setting up a committee and intended to introduce laws related to data protection and privacy. Those following the Aadhaar project have waited to see the kind of impact a data protection bill might have on the project, with many feeling that any data protection bill would by its very nature, have to deal with, and curtail it. The idea of a privacy/data protection law has been proposed various times in the country’s recent past. None of the various official drafts and deliberations have occurred in a time quite like this, when over one billion Indian citizens were, in most cases, coerced into enrolling in a centralised mandatory biometric identification system.

After the composition of the Committee was finally announced, by November 6, 2017, several eminent jurists and concerned citizens raised concerns about possible conflicts of interest of various members of the Committee, specifically related to Aadhaar. The Committee chose not to respond to this letter, nor did it increase the diversity of the members of the Committee. Lack of transparency and public participation has been a ‘feature’ of the deliberations of the Committee. The first public document put out by the Committee was its White Paper, which was published solely in English and no other language.

When the minutes of the meeting of the Committee was released, after denial and then appeal, in response to an RTI application filed by RTI activists Anjali Bhardwaj and Amrita Johri, it was found that the same think-tank involved in drafting the Aadhaar Act played a prominent supporting role in the deliberations of the Srikrishna Committee. The Ministry of Electronics and Information Technology later illegally denied providing the submissions and recommendations made to the Committee in response to RTI applications filed by the same activists. Most recently, 150 citizens once again wrote to the Committee demanding greater transparency and accountability in its functioning. The Committee remained determinedly silent, giving no response and continuing to valiantly and illegally deny RTI applications for the draft bill, notes and submissions made to the Committee. The release of the draft bill and the final report of the Committee are thus very welcome, but further public consultation is clearly needed. In fact, the pre-legislative process created by an empowered group of ministers in 2014 legally mandates it.

In its final report, the Committee recognises that, “The Aadhaar Act needs to be amended significantly to bolster privacy protections and ensure autonomy of the UIDAI. Since the context of the Committee’s functioning has been shaped by a vigorous public debate about Aadhaar and its impact on data protection, the Committee would be remiss if it did not deal with this issue.” The best way to understand the Committee’s proposed amendments to the Aadhaar Act and the suggestions it makes in its reports are to imagine being a ‘data subject’ – elderly, below the poverty line, significantly if not totally dependent on welfare entitlements for survival – who was coerced into submitting her biometrics as a necessary condition for her to receive her pension.

Concerns around the Aadhaar project have broadly coalesced around welfare and privacy; these have included questions of surveillance, liberty, access to basic rights, data commercialisation, coercion and choice.

               Justice B.N. Srikrishna. Credit: LiveLaw

At first glance, the draft data protection bill appears to provide massive exceptions for welfare that seemingly apply to Aadhaar. Section 13 makes the processing of personal data without a person’s consent possible for any function of the Parliament or State Legislature. It allows the processing of personal data, if necessary for the exercise of any function, for the delivery of services or benefits or issuance of certificates. In addition, Section 19 states:

Sensitive personal data may be processed if such processing is strictly necessary for: (a) any function of Parliament or any State Legislature and (b) the exercise of any function of the State authorised by law for the provision of any service or benefit to the data principal.

This appears to be the exception allowed for the State to process personal data and looks ominous when you think about the expansion of the Aadhaar into so many aspects of our lives – for welfare programmes, IT returns, for healthcare subsidies, sim cards etc.

But is Aadhaar or Aadhaar authentication strictly necessary to fulfill any function of the state? The draft bill opens a space in which we can and must ask this question. As Prof Reetika Khera points out, for example, “welfare needs Aadhaar like a fish needs a bicycle.” Much has been written about how Aadhaar is an inappropriate technology for welfare. Why should Aadhaar or Aadhaar authentication be necessary for a person to receive her pension?

Critics of the Aadhaar project have since the very beginning highlighted the sweeping nature of the Aadhaar project. While the Aadhaar Act posits itself as an act to “provide for, as a good governance, efficient, transparent and targeted delivery of subsidies, benefits and services”, its expansion into various other fields has been unchecked and indiscriminate. Section 5 of the draft data protection bill deals with purpose limitation and states that the “personal data shall be processed only for purposes that are clear, specific and lawful.” The processing of Aadhaar data so far has been for purposes that are anything but clear and specific, while the lawful bit is under challenge in the Supreme Court of India.

With the enormity of the unwieldy Aadhaar project occupying our imagination, one thing has become very clear – that while data protection laws around the world and this one in particular largely deal with protecting personal data, there might be times when I may need to be protected from data. For example, if I am poor and elderly and go to a ration shop, currently, I am mandatorily required to authenticate my fingerprint on a machine that decides whether or not I am the person I say I am. Once the machine decides, on the basis of data I gave it at an earlier date, only then can I get access to my entitlements. While various authorities keep assuring us that other means of identification are acceptable, this message has still not permeated to the people administering these programmes and in many cases, the technical architecture itself does not allow for any other means of identification.

In the case of Aadhaar authentications – for the elderly, differently abled, those engaged in manual labour, people genetically predisposed to not have fingerprints – Aadhaar-based biometric authentication does not work. The draft bill and report propose a new system of offline verification, only proving how broken Aadhaar really is. We have not been told what this system of offline verification will be, nor why it is necessary, nor what purpose it will serve or where exactly it will be used.

Section 9 of the draft bill relates to data quality and sub-section (1) states that:

“The data fiduciary shall take reasonable steps to ensure that personal data processed is complete, accurate, not misleading and updated, having regard to the purposes for which it is processed.”

As per section 2(13) of the bill, a “data fiduciary” means any person, including the state, a company, any juristic entity or any individual who alone or in conjunction with others determines the purpose and means of processing of personal data.” This would mean possibly, that the burden of maintaining data quality would be placed on the UIDAI, and not on the data subject.

The data protection draft bill and report further add to the conversation around meaningful, just and fair data protection and its simultaneous existence with the unjustifiable privacy-related incursions of the Aadhaar project. It remains to be seen how and whether the Aadhaar Act and a Data Protection Act can coexist.

The speed with which the Committee has been forced to work is an obvious side-effect of the vacuum created by the existence of the Aadhaar project, new proliferating technologies and the growing global conversation around data protection standards. It is vital that there be further discussion and public consultation on the data protection bill. The conversation around data protection is incomplete without the voices of those whom it will affect the most, including those that are entitled to welfare from the state.

Praavita is a lawyer and a SaveOurPrivacy volunteer.

11993 - Educationists on why linking Aadhaar in schools is a terrible idea- Catch News

Educationists on why linking Aadhaar in schools is a terrible idea

PRIYATA BRAJABASI

| Updated on: 5 September 2017, 16:35 IST

After facing huge embarrassment in the hands of two consecutive toppers’ scam in two years, the Bihar School Education Board (BSEB) has made Aadhaar mandatory for filling up forms for matriculation and intermediate examinations from the year 2018.

However, from 2019, Aadhaar number will be mandatory in all examinations conducted by the BSEB for all classes; identity cards will become inadmissible.

Earlier this year, the results of intermediate (arts) led to a row after it was detected that topper Ganesh Kumar, alias Ganesh Ram, fudged his age to take the exam a second time from Sanjay Gandhi Vidyalay, Lakshminia in Samastipur.

He showed his date of birth as June 2, 1993. Later, it was found that his actual date of birth when he took the matriculation exam for the first time was November 7, 1975 and he appeared from a school in Jharkhand. He later got into Ramnandan Singh Jagdip Narayan Intermediate College, from where he topped in Intermediate Arts.

However, linking Aadhaar to school examinations to stop cases of fraud may not be the way to go.

There are many issues that the children enrolling for Aadhaar might face. For instance, the Unique Identification Authority of India (UIDAI) recognises that the fingerprints of a growing child aren’t completely formed till the age of 14-15 years. The students appearing for matriculation examinations are usually 14-15 years of age. And once BSEB makes Aadhaar for all classes, many glitches in identification might begin to surface.

Right To Education National Convenor Ambarish Rai believes that basic amenities should be kept out of the ambit of Aadhaar. He told Catch, “The Supreme Court has made it clear that basic amenities should not be linked with Aadhaar. Education is a basic amenity. If Aadhaar is made mandatory for education as well, then many children who do not have Aadhaar will not be able to avail benefits of education. They will be deprived. In a state like Bihar, the percentage of population that has an Aadhaar is one of the lowest.

“In order to avoid cases of fraud, the state should strengthen its school administration system. How can you not discriminate between genuine children who do not have Aadhaar and the ones who are indulge in fudging and forgery of documents and other such means?

“As the justice system says, it is okay for a guilty person to walk free but an innocent person must never be convicted. It is the same case here. An innocent child who does not have access to Aadhar must not be deprived of an education,” he added.

Praavita, a member of Rethink Aadhaar campaign, told Catch: 

“The system of Aadhaar by design excludes. They are many ways in which it is already proved that this system fails. In many cases that we are following, in the public distribution system, in mid-day meal schemes, there are instances of fraud in spite of Aadhaar being in place.

“There is enough evidence that Aadhaar’s supposed uniqueness to the identity does not stop fraud. What is does in practice is exclude people. It will make more and more difficult for children in very vulnerable positions to get an education or to pass matriculation.”

Praavita added: “Aadhaar card will not prevent forgeries or fraud, you can get a fake Aadhaar card made for Rs 35 in Maharashtra. In Rajasthan, a dealer had seeded his Aadhaar card with dozens of other people, so he was able to collect grains for all of them.

“It is ridiculous that the government continues to use this as a method to prevent fraud when across the country we have evidence of how Aadhaar is being misused.”

The CBSE has also made the Aadhaar card mandatory for all students taking JEE and NEET exams.

However, CBSE has not made Aadhaar mandatory for its school examinations as of now. Many other states may soon make Aadhaar mandatory for school examinations too.

Edited by Joyjeet Das

First published: 4 September 2017, 23:55 IS

11893 - Aadhaar activists rejoice after SC's Right to Privacy verdict - Money Control

Aug 25, 2017 09:42 PM IST | Source: Moneycontrol.com

Aadhaar activists rejoice after SC's Right to Privacy verdict

One activist called the judgement an 'existential threat' to the foundations of the Aadhaar project.

Ankita Bose

Moneycontrol News

The Supreme Court verdict upholding Right to Privacy came as welcome news to Aadhaar activists, who have been striving to nix the Centre's efforts to link the 12-digit identification number to social benefit schemes, subsidies and other benefits.

RethinkAdhaar.in, a campaign actively involved in challenging the multifaceted implications of the Aadhaar project in India is celebrating the verdict which upheld that Right to Privacy is a fundamental right in the Constitution of India.

RethinkAadhaar features extensive work done in the remote areas of Rajasthan which documents rural people encountering several problems in receiving social benefit schemes, subsidies, and pensions linked to their Aadhaar number.

As it eagerly waited for the nine-judge bench to deliver its verdict on the right to privacy hearing, it expressed its happiness once the historic judgement came out.

View image on Twitter

Follow

Rethink Aadhaar @no2uid

We welcome the judgment of the Supreme Court affirming the Right to Privacy as a fundamental right #No2UID #AadhaarNahiSudhaar

10:02 PM - Aug 24, 2017

• 1 1 Reply
  39 39 Retweets
  60 60 likes

Twitter Ads info and privacy

Praavita, one of the key members of the RethinkAadhaar initiative, told Moneycontrol that the verdict will put greater pressure on the Aadhaar project to prove its legitimacy and lawfulness. "This judgment is an existential threat to the foundations of the Aadhaar project. Now that the 9 judge bench has decided that privacy is a fundamental right, the Aadhaar hearings can now resume. We hope for an early hearing," she said.

She added: "The Centre can do what it wants to do. The Supreme Court has now drawn a line in the sand, a Lakshman Rekha. Everything will be tested on the anvil of the fundamental right to privacy."

She added: "We plan to continue raising awareness on the multiple shortcomings of Aadhaar and its coercive, anti-privacy nature. We also plan to launch a campaign calling for the delinking of Aadhaar from the multiple programmes."

Praavita, who calls herself a feminist, was also confident that the judgement will prove to be beneficial for the LGBTQ (lesbian, gay, bisexual, transgender, queer) rights activists in decriminalising homosexuality and battling Article 377 of the Indian Constitution.

"For me, the right to privacy is the heart of dignity and democracy. It means the right to be free from constant surveillance, it means that the state does not have unfettered powers over my life, and I have the freedom to dissent. Privacy to me is important as a feminist and an activist," she said.

11116 - Over to Supreme Court - Deccan herald

Over to Supreme Court

By Praavita, Apr 24 2017, 0:41 IST

On April 11, 2017, the Aadhaar debate entered Parliament and, for what appeared to be the first time in a long time, the Opposition took to the floor and rallied for the people of India. Members from across party lines got engaged in a heated discussion on the pitfalls of the Aadhaar (Unique Identification or UID) project. The hard facts presented and the damning indictment of the project were shrugged off by Minister for Information Technology Ravishankar Prasad, like water off a duck’s back.

Concerns raised included the verification of the UID database, UID being mandatory for welfare entitlements, privacy concerns, the legality of, and liability relating to the project. The UID project has multiple weaknesses. Aadhaar was marketed as being a foolproof ID based on biometrics, what is discussed less is that no physical verification is carried out by any authority of any documents submitted at the time of enrolment. Thus you have incidents of Pakistani spies, the god Hanuman, and coriander plants getting Aadhaar numbers. 

Before the Aadhaar Act was passed in 2016, over 100 crore people had been enrolled without any form of verification being carried out. Rajeev Chandrashekhar, MP, asked about verification and pointed out that the only time the database was scrutinised was by the Parliamentary Standing Committee on Finance which concluded that the UID database was ineffective even for directing subsidies. He reminded us that the RS Leader of the House conceded that privacy is a fundamental right, even without the Supreme Court saying so.

The IT minister’s response to concerns of privacy and surveillance was that the UID database was a “marvel of technology” and could not be breached. Who knows whether the UID database can be breached? Even the Pentagon was breached. What we have, without speculation, are instances of third parties, including government agencies, leaking vast amounts of data online. 

Assurances aside, the minister failed to answer Trinamool MP Derek O’Brien’s concern on the leak of the information of 14 lakh minors. O’Brien pointed out that there was no regulation on third parties with access to the UID database. The UIDAI itself blacklisted 34,000 operators since 2010 for “polluting” the database. On April 19, 2017, UIDAI filed FIRs against eight websites for illegally collecting Aadhaar numbers and enrolment details from people.

Incredibly, Section 47 (1) of the Aadhaar Act, 2016 states that, “No court shall take cognisance of any offence punishable under this Act, save on a complaint made by the Authority or any officer or person authorised by it.” Thus, only the UIDAI and no one else can complain of offences under the Act. When asked who would be accountable for Aadhaar failures, the IT minister responded “Aadhaar works under the IT ministry, I am accountable to parliament and they (UIDAI) are accountable to the parliament through us.” 

Several MPs discussed exclusion caused by the linking of Aadhaar to welfare entitlements. Congress MP Jairam Ramesh cited the example of Rajasthan where seven lakh pensioners were removed from the list of beneficiaries after Aadhaar linking. Eminent lawyer and parliamentarian K T S Tulsi said that he had never seen as poor statutory framing in his life as in the Aadhaar Act. The CPI’s D Raja was concerned about denial of en­titlements due to various failures of Aadhaar.

In the public distribution system, the exclusion rate in Rajasthan was 25%, according to government figures. That is, 25 lakh people had not got rations since Aadhaar-based biometric authentication was made mandatory. In Bhim block, (Rajsamand district) almost 1,500 out of 3,000 elderly whose names were cut after being declared “dead” or “duplicates”, were found to be alive and were restored to their pensions. The IT minister claim­ed that Aadhaar led to savings. He quoted figures that have been repeatedly debunked, including by the CAG. He called the CAG report “judgemental” and cited the World Bank and UNDP reports in support of the project. The World Bank’s figures have also been rebutted. 

The World Development Report 2016 states, “This (LPG) is just one of many subsidy programmes in India that are being converted to direct transfers using digital ID, potentially saving over US$11 billion per year in government expenditures through reduced leakage and efficiency gains.” 

Hollow promises?

In fact, the source of this $11 billion estimates states that “The value of these transfers (NREGA, pensions etc) is estimated to be Rs 70,000 crore ($11.3 billion) per annum." Thus, for the World Bank, ‘potential savings’ refers to the entire social welfare budget.

Promises made to the people on the floor of the House are worth as much as cobwebs and moonshine when the minister can boldly stand and state: “I want to make it very clear on behalf of the government that no poor shall be denied his subsidy rights at all…we are only saying, you also come on Aadhaar. But no denial shall be there.” 

What is the minister’s word worth? No notification making possession of an Aadhaar number mandatory for any service has been withdrawn so far. What we have instead are deadlines for enrolment and the poor being denied their entitlements. The minister made many claims, including stating that the Aadhaar database will not be linked to the intelligence database of the NATGRID. But again, there is no law to stop this, and no notification, nothing more than the minister’s word. 

No concrete steps or plans to keep Aadhaar truly voluntary have been made or given. The mad dash for Aadhaar continues as pensioners, ration cardholders and NREGA workers are pushed further into destitution and vulnerability, as our national security is made vulnerable, and we are left to the mercy of an all-seeing surveillance state. 

The Supreme Court must intervene. Until then we are told to just believe the words of the minister for IT that “the Aadhaar is robust. Aadhaar is safe. Aadhaar is secure, and totally accountable.”

(The writer is with Rethink Aadhaar Campaign)