13935 - Did SC Re-Affirm that Aadhaar Database Could Be Used for Criminal Investigations? - The Wire

Did SC Re-Affirm that Aadhaar Database Could Be Used for Criminal Investigations?

There will likely be more pressure on the UIDAI to co-operate with investigative agencies.  

Theoretically, if the police find fingerprints at a crime scene, they could run those through the Aadhaar database, matching them against the entire database of citizens in the hope of identifying the culprit. Credit: Reuters/Illustration by The Wire

Prashant Reddy T.

37

interactions

LAWTECH

16/OCT/2018

The opposition against Aadhaar for the last few years has been primarily based on concerns of surveillance, with the concerns regarding exclusion getting little media space. The surveillance potential of Aadhaar was first flagged by Usha Ramanathan around eight years ago in an article published by the Economic & Political Weekly when few others were giving the UID project a hard look.

In that article, which was the first warning shot fired against Aadhaar, Ramanathan warned that the creation of a unique identifier like Aadhaar would eventually lead to the convergence of different databases that were otherwise maintained in separate silos, thereby giving the Indian state an unprecedented capacity to monitor the lives of its citizens and their activities.

The proponents of Aadhaar, have rejected this portrayal of Aadhaar and have pointed out that Aadhaar’s architecture allows it to collect only very limited information. For example, if an Aadhaar authentication is carried out by a bank to open an account or by a telecom service provider, the Aadhaar centralised database will only collect information regarding the entity which has requested the authentication but will not know the purpose of the authentication, i.e. the details of the transaction at the bank or the telecom service provider.

Also read: Aadhaar Verdict: Does the Mere Collection of Biometrics Violate Bodily Integrity and Privacy?

If an investigation agency wants to collect evidence related to the transactions conducted by the account holder, it will still have to seek a court order under The Bankers’ Books Evidence Act, 1891. The concerns about convergence may thus be overblown because each silo of information is usually governed by an in-built privacy regime.

The second concern with relation to Aadhaar’s surveillance potential was the possibility of its database of a billion biometrics being used for the purposes of criminal investigation. Since Aadhaar is designed in a manner to carry out de-duplication of each set of biometrics, the system can match the fingerprints of one individual against all 1 billion biometrics to check if the person has already been allotted an Aadhaar number. Its ability to carry out de-duplication goes to the heart of the UIDAI’s claim that Aadhaar is unique.

Theoretically, this means that if the police find fingerprints at a crime scene they could run those through the Aadhaar database, matching them against the entire database of citizens in the hope of identifying the culprit.

In fact, there is an actual instance of the Bombay high court directing the UIDAI to match fingerprints, collected by the CBI in a rape case, against its own database. The SC stayed the Bombay high court’s order in 2014 after it was approached by the UIDAI on the grounds that its database was not meant to be used for criminal investigations. Since that stay order of the SC, high-ranking officials such as the chief of the National Crime Records Bureau (NCRB) have made public comments about using the Aadhaar database for the purpose of criminal investigation. The UIDAI has repeatedly rejected such demands. The fear is that such power in the hands of the police is susceptible to misuse.   

Section 33 of the Aadhaar Act, 2016

The main provision of the Aadhaar Act, 2016 meant to curb the state’s potential to conduct surveillance is Section 33 which regulates the manner in which the identity information or the authentication information contained in the Aadhaar database can be shared by the UIDAI. This provision, whose constitutionality was challenged before the Supreme Court, has two parts.

The first part of the provision, S. 33(1), allows the sharing of identity information and authentication information pursuant to the orders made by a district judge. At no point, can a district judge order the sharing of core biometric information i.e. fingerprints or iris scans. The provision isn’t quite clear whether a district judge can order the UIDAI to run fingerprints, provided by an investigating agency, through its database to locate a possible suspect. Technically the UIDAI can conduct the exercise and share the identity information without sharing the biometric information. An additional issue with the wording of this provision is that it gives no guidance to a district judge as to the scenarios in which a request for accessing identity or authentication information may be accepted or denied.  

The second part of the provision, S. 33(2), allows for the sharing of identity information, core biometric information and authentication information, for the purposes of national security pursuant to the orders of a joint secretary to the government of India, whose orders will subject to post-facto review by an oversight committee consisting of the Cabinet Secretary and two other secretaries.

The constitutional challenge against Section 33

The challenge against Section 33 was three-fold.

The first ground of challenge was that the provision violated Article 20(3) which is the fundamental right against self-incrimination i.e. no person can be made to stand witness against oneself when accused of a crime. This was a weak argument because an earlier decision of the Supreme Court in 1962 has ruled that the collection of fingerprints and handwriting samples is only the collection of evidence and that it does not amount to giving testimony against one self and is thus not self-incrimination.

The second ground of challenge, was that ‘national security’ was a vague phrase and that the oversight committee was not independent enough. ‘National security’ is generally seen as a policy issue which is within the realm of the executive and courts rarely interfere with such clauses.

The third ground of challenge was that the oversight committee was not independent enough. There is really no constitutional principle requiring the oversight committee to be independent. As for the composition of the Oversight Committee it should be remembered that it adopts a formula laid down by the Supreme Court in the mid-nineties, in PUCL v. Union of India, where the court ordered the government to setup a review mechanism to monitor phone tapping.

The majority opinion

The majority opinion by Justice Sikri is quite disappointing because of its weak analysis. His honour makes no attempt to engage with the arguments in relation to self-incrimination, instead preferring to dispose the issue by stating that the district judge may consider the issue of Article 20(3) at the time of deciding applications for allowing access to the identity information or authentication information. The only concession made by the judgment is that the person whose information is being sought is required to be given a hearing along with the UIDAI prior to a decision being made by the district judge. But how exactly does this work when an investigating agency wants to run the fingerprints of an unknown person against the Aadhaar database in the hope of tracing an accused or perhaps trace the identity of a John Doe? The judgment is silent on the issue.   

Also read: One Data Protection Legislation and One Regulator for 1.3 Billion People?

On the issue of Section 33(2) and ‘national security’, Justice Sikri refers to relevant precedent to declare that ‘national security’ is a not a question of law but a matter of policy and held that the state could access information held by the UIDAI in the interests of national security. However, with the regard to the person who can order access to be provided in the interest of national security, Justice Sikri declares, at page 424, that joint secretary is too junior a rank and that the power should be granted to a higher ranking official. On this basis he strikes down Section 33(2) of the Aadhaar Act. His honour does not even attempt to explain the legal basis of such a conclusion.

By the time Justice Sikri arrives at the conclusion of his judgment at page 559, where he summarises his holdings, he states that a judicial officer should be associated with process of passing an order to access information.

He states in relevant part:

“However, for determination of such an eventuality, an officer higher than the rank of a Joint Secretary should be given such a power. Further, in order to avoid any possible misuse, a Judicial Officer (preferably a sitting High Court Judge) should also be associated with. We may point out that such provisions of application of judicial mind for arriving at the conclusion that disclosure of information is in the interest of national security, are prevalent in some jurisdictions.”

Like much of this judgment, there is simply no legal reasoning to back this conclusion or engage with the court’s own precedents. The Supreme Court in the PUCL case had rejected a request for phone tapping to be authorised only on the basis of warrants issued by judges rather than bureaucrats.

If Justice Sikri is diverging from this viewpoint, as appears to be the case, it is only reasonable to expect reasons for this conclusion. More puzzling is the formulation that he suggests. What exactly does his honour mean when he states that a judicial mind should be associated with the process of passing such an order? Does it mean that a judge should be sitting with a bureaucrat to pass an order? This would be an extraordinary setup because there is simply no precedent for such an arrangement.   

The concurring opinion

The concurring opinion by Justice Bhushan upholds Section 33 without making any recommendations on the lines made by Justice Sikri. Unlike the majority opinion, Justice Bhushan’s conclusions are backed by cogent reasoning and precedent.  

On the issue of whether Aadhaar violates the right against self-incrimination under Article 20(3), he refers to the precedent of the Supreme Court from 1962, in the case of State of Bombay v. Kathi Kalu Oghad, where the Court drew a distinction between collection of evidence and standing witness against oneself, noting that collection of biometrics fell within the former, which is not the same as self-incrimination.

Also read: Aadhaar and the ‘Least Intrusive Option’: What Did the SC Say About Smart Cards?

On the issue of ‘national security’, Justice Bhushan found in favour of the government because of the precedent that has declared national security to be a policy issue that can be determined by the government and not the judiciary.

In addition, Justice Bhushan also referred to a number of Indian and international judgments where it was held that national security was a valid ground to access personal information.

The dissent

The dissent by Justice Chandrachud does not really analyse the arguments regarding Section 33, and understandably so, because he concludes that the entire Aadhaar project violates the fundamental right to privacy when tested on the proportionality touchstone.

Once he concludes that the Aadhaar project itself is unconstitutional, there is little to be gained by analysing Section 33.

More pressure

As things stand now, Section 33(1) is constitutional, and it is constitutional to use the Aadhaar database for criminal investigation. Neither the majority nor the concurring opinion prohibits such usage.

In fact, the concurring opinion is quite lucid on this point when it concludes as follows:

“Section 33 cannot be said to be unconstitutional as it provides for the use of Aadhaar data base for police investigation nor it can be said to violate protection granted under Article 20(3).”

The implications of this conclusion are significant because there will now be more pressure on the UIDAI to co-operate with investigative agencies.  

While Section 33(2) has been struck down as unconstitutional, the formulation specified by Justice Sikri is so bizarre that it is not possible to implement. It is now up to the government to recommend a new formulation of Section 33(2).

Prashant Reddy T. is an assistant professor at NALSAR University of Law, Hyderabad.

11629 - By Splitting Aadhaar and Right to Privacy Issues, SC Has Embarked on a Tricky Legal Exercise - The Wire

By Splitting Aadhaar and Right to Privacy Issues, SC Has Embarked on a Tricky Legal Exercise

BY PRASHANT REDDY T ON 20/07/2017 • 2 COMMENTS

The court cannot simply declare privacy to be a fundamental right. It needs to explore its contours, including implications for the right to free speech.

The Supreme Court’s strategy to split the issue of whether privacy is a fundamental right from the constitutional challenge to Aadhaar was a mistake. Credit: Reuters/Pixabay

As the petitioners conclude their arguments before the bench of nine judges hearing the Aadhaar-related privacy challenge, it is becoming clear that the court’s strategy to split the issue of whether privacy is a fundamental right from the constitutional challenge to Aadhaar was a mistake. So far, the issue of privacy has been adjudicated by the Supreme Court in a variety of factual scenarios ranging from police surveillance, tapping of telephones and sensitive medical information to sexual rights, the use of interrogation techniques like narco-analysis by the police and search and seizure powers of different state agencies. In each of these cases, the court was dealing with privacy in a fixed factual scenario, allowing the court to define privacy in the context of a specific case and fashion a remedy for that specific context, thereby limiting its application in future cases.

By deciding to tackle the issue of privacy as a standalone issue and divorcing it from the Aadhaar challenge, the court has embarked on a complex jurisprudential exercise. The court cannot simply declare privacy to be a fundamental right and close the issue. Rather, it has to necessarily define the contours of a possible fundamental right to privacy along with the various limitations and exceptions on the exercise of such a right, because no fundamental right is an absolute right.

This is a particularly tricky exercise because declaring privacy to be a fundamental right has ramifications which extend far beyond the challenge to Aadhaar. Not only can future parliamentary legislation be struck down by the higher judiciary as unconstitutional for violating a potential fundamental right to privacy, but future courts will have to balance privacy with other fundamental rights including the fundamental right to free speech. This is not an abstract theoretical issue but a genuine problem that has been confronted by Indian courts in the past as a result of the Supreme Court’s judgment in the Rajagopal vs State of Tamil Nadu (1994), where a bench of two judges for the first time expressly declared privacy to be a fundamental right. While coming to this conclusion, the bench simply failed to deal with the jurisprudence of the earlier Supreme Court ruling in Kharak Singh vs State of UP, where a larger bench denied privacy the status of a fundamental right.

The facts and the consequence of the Rajagopal case are important to understand the danger of judicial lawmaking, especially in the realm of fundamental rights. In this case, the court was dealing with a petition filed by the editor of Nakkheeran, a famous Tamil newsmagazine, seeking to restrain the state of Tamil Nadu from interfering in publishing the autobiography of ‘Autoshankar’, a notorious serial killer whose was sentenced to death. In his autobiography, he claimed to have a close nexus with several IAS and IPS officers. The editor alleged that Autoshankar was tortured in prison and forced to write a letter withdrawing his consent to Nakkheeran to publish his biography, and that the inspector general of prisons had written to the editor ordering him to stop publication of the prisoner’s autobiography on the grounds that it was making false statements and in violation of prison rules. Fearing a raid by the state on the printing press publishing the magazine, the editor sought relief before the court.

Also read: The Different Ways in Which Aadhaar Infringes on Privacy

From reading the judgment, it is not clear who exactly raised the privacy argument or why it was even relevant to case, because the main argument of the state was that the biography contained false assertions and was defamatory. Nevertheless, in its judgment the Supreme Court cited a whole range of foreign precedents to declare privacy to be a fundamental right under Article 21. The court stated in that “The right to privacy is implicit in the right to life and liberty guaranteed to the citizens of this country by Article 21. It is a right to be let alone.” It then ventured to define the boundaries of privacy, stating, “it must be held that the petitioners have a right to publish, what they allege to be the life story/autobiography of Auto Shankar insofar as it appears from the public records, even without his consent or authorisation. But if they go beyond that and publish his life story, they may be invading his right to privacy and will be liable for the consequences in accordance with law.”  These few sentences have had an impact on unauthorised biographies and biopics of powerful public personalities.

In 1995, just a year after the Supreme Court’s judgment in the Rajagopal case, Phoolan Devi invoked this right to privacy before the Delhi high court seeking to restrain the exhibition of the movie Bandit Queen directed by Shekar Kapoor. The movie was based on her life and she objected to the depiction of certain scenes depicting a sexual assault on her. The fact that she was sexually assaulted had been reported in the press and books on her life, although she herself denied it. Rather than argue defamation, her counsel argued that the scenes in the movie about the sexual assault on her as well as her personal relationships violated her right to privacy. The defence tried arguing that as a public figure, Phoolan Devi could not claim privacy. The Delhi high court agreed with Phoolan Devi and declared that the defendants “have no right to exhibit the film as produced as has been filed in this Court violating the privacy of plaintiff’s body and person”. The fundamental right to privacy as laid down in the Rajagopal case was one of the reasons for the injunction against the release of the Bandit Queen.

A still from Bandit Queen.

As I have detailed in an article published on The Hoot, the judgment in Rajagopal was also applied by the Madras high court to restrain the publication of an unauthorised biography of J. Jayalalithaa on the grounds that it would violate Jayalalithaa’s fundamental right to privacy as defined in those lines from the Rajagopal judgment extracted above. Similarly, an unauthorised biopic of Veerappan was challenged by the deceased brigand’s wife. Although the Madras high court refused to restrain the release of the movie, the producers did agree to edit the scenes which contained scenes depicting his personal life with his family. The reason they agreed to do so was because Veerappan’s wife had raised the Supreme Court’s articulation of privacy mentioned above.

To be fair, there is at least one subsequent decision from the Madras high court by its then Chief Justice A.P. Shah holding that Jayalalithaa as a public personality could not restrain reporting by Nakheeran in the guise of privacy. But to come to this conclusion, Justice Shah had to fall back on an American judgment to hold that public personalities could not claim a privacy right. In doing so, he ignores the fact that the privacy right in the American case was a mere statutory right, not a fundamental right. By its very essence, a fundamental right is essential to everyone regardless of status. If it comes down to balancing a fundamental right to free speech and fundamental right to privacy, a judge will have to carry out a very fine balancing act.

Although the above cases deal with biopics and biographies, it does not take much effort to extend similar logic to daily reportage.

I give the above examples to highlight the less-discussed implications of an unqualified fundamental right to privacy. It is possible that similar issues will arise in cases dealing with the fundamental right of citizens to information/know. Indian courts have interpreted the fundamental right to speech to include the fundamental right to know. It is this right that the Supreme Court has leveraged to force greater transparency during elections by forcing candidates to disclose details regarding their wealth, qualification and criminal antecedents. Several of these issues qualify as private information in most jurisdictions. If privacy is elevated to the status of a fundamental right, can it be whittled down for public personalities? It is anybody’s guess how the court will balance such a right.

Rather than opening the door to uncertainty across the board by tackling privacy as a standalone issue, the court will be well advised to decide the issue of privacy as a fundamental right in the specific context of Aadhaar.

Prashant Reddy T. is a research associate at the School of Law, Singapore Management University.

9797 - No longer a black box: Why does the revised Aadhaar Bill allow sharing of identity information? - SCROLL.IN

No longer a black box: Why does the revised Aadhaar Bill allow sharing of identity information?

Sunday, April 10th 2016

SCROLL.IN

A seemingly minor amendment to the 2016 bill that could have significant privacy ramifications has not been received adequate debate.

The hacking of a Turkish government database containing close to 50 million personal records of the country’s citizens is yet another reminder of the vulnerability of electronic databases. 

The entire population of Turkey, is estimated at 77.69 million people. This is the second major database to be hacked in recent times, the first being a data breach in the United States government which affected 21 million federal government employees.

These massive data breaches come on the heels of a national debate in India on the various aspects of the Aadhaar project that was recently approved by Parliament when it enacted The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefit & Services) Bill, 2016. One aspect which hasn’t been debated substantially is a seemingly minor amendment to Clause 8(4) of the Bill, which can have significant privacy ramifications. To understand this amendment it is first necessary to narrate the early assurances provided by the Unique Identification Authority of India and its Chairperson, Nandan Nilekani.

Just Yes or No

As originally conceived, the Aadhaar number was to be generated after collection of relevant demographic information (such as address, age, date of birth) and biometric information (such as photographs, fingerprints and iris scans). The number generated were then to be used by either the government or a private entity to authenticate a person carrying out a transaction which required him or her to establish their identity. 

Prior to the introduction of the Aadhaar Bill in Parliament, the UIDAI had maintained that the authentication process would generate only a "yes" or a "no" in response to an authentication request, without actually sharing any of the personal identity information stored with the requesting authority.

This understanding can be confirmed in an explainer put out by the UIDAI. On the very second page, a neat explainer clarifies that Aadhaar authentication will “[r]eturn response to requesting agencies as Yes/No’ and will not “[r]eturn personal identity information of residents”.

This assurance was reiterated by Nandan Nilekani. In an interview to NDTV, responding to a question on whether the information collected would be shared, he had said:

“It is a black box. The purpose of this data is only in authentication. When you go somewhere to receive a service and you say I am Sreenivasan Jain, the system will reply it is him, or not him. That’s all it does. Only a yes or a no.”

Nilekani’s description gives the common man an impression that the Aadhaar project was designed in a manner that only allowed for personal information to be deposited in the Central Identities Data Repository without any mechanism to allow any person to extract such personal information. A crude analogy of a “blackbox”-style operation would be a vault in a bank that is constructed in a manner that it has a slot to allow people to deposit information in it but there is no way for any other person to open the vault and retrieve the information. In the case of the Aadhaar project, the information in question was only be used to authenticate a request from outside but would never itself leave the firewalls of the repository.

This guarantee was underwritten in Clause 5(2) of the National Identification Authority of India Bill, 2010 introduced by the United Progressive Alliance government which clarified:

“Authority shall respond to an authentication query with a positive or negative response or with any other appropriate response excluding any demographic information and biometric information."

Thus any of the information collected by the Authority was not to be shared with the requester. This fact is further substantiated currently by the UIDAI website, which clearly states that during authentication “No personal identity information is returned as part of the response.”

The change

The Aadhaar Act, 2016 however completely alters this provision. Now renumbered as Section 8(4), it states:

“The Authority shall respond to an authentication query with a positive, negative or any other appropriate response sharing such identity information excluding any core biometric information”.

The difference between the different versions of this provision is that while the 2010 Bill states no identity information will be shared during the authentication process, the Aadhaar Act clearly gives the UIDAI the power to share identity information back with the requesting agency. The only information excluded from being shared is core biometric information such as fingerprints or iris scans.

Therefore, once you provide certain information to a requesting authority performing the authentication, the UIDAI while confirming the identity can legally share with the requesting authority the personal identity information of the person requesting authentication.

Contrary to common perception, the authentication process under the UIDAI does not mandatorily require a resident to submit either fingerprints or iris scans, which are the only unique identifiers. According to the UIDAI explainer referenced earlier, there are five types of authentication techniques – two of these types don’t require either fingerprints or iris scans for authentication. These two forms of authentication can take place in conjunction with either demographic information such as date of birth, name or address OR in conjunction with a one-time-password delivered to a mobile phone or email account associated with the Aadhaar number. 

Therefore, at least theoretically, it is possible for a “rogue” requesting authority to key in the Aadhaar number along with a name or date of birth to the UIDAI and in return get back more personal identity information such as the address or photograph.

Since demographic information isn’t conclusively defined in the Aadhaar Act and this function has been delegated to the UIDAI, it is not known just how much information will eventually be collected by the UIDAI.

Whether these nightmare scenarios actually play out, the fact remains that the “black box” system of operating which was considered a fundamental operating principle of the UIDAI has now been overturned.

The question at this stage is why exactly was this clause altered? The answer is not clear especially since the government has adopted blitzkrieg tactics to pass the Bill through Parliament.

Prashant Reddy Thikkavarapu studied law at the National Law School of India University, Bengaluru, and at Stanford Law School. He is a practising lawyer based in Delhi.