12369 - Aadhaar seeding: benefits and concerns - Live Mint

Last Published: Tue, Nov 14 2017. 02 52 AM IST

Aadhaar seeding: benefits and concerns

Products and services such as bank accounts, life insurance policies and phone connections have to be linked with Aadhaar. But is this of any real help?

Shaikh Zoaib Saleem

Photo: Indranil Bhoumik/Mint

LATEST NEWS »

The government has made it mandatory for consumers to link many important services with Aadhaar. You too may be getting frequent reminders to link your banks account, mutual fund and mobile number with Aadhaar. Recently, the Reserve Bank of India also clarified that it is mandatory to link bank accounts with Aadhaar.

The latest addition to this list are insurance policies. In a circular, the Insurance Regulatory and Development Authority of India (Irdai) has stated that linking of Aadhaar number to insurance policies is mandatory under the Prevention of Money-laundering (Maintenance of Records) Second Amendment Rules, 2017. 

The issue is being discussed intensively, with the Supreme Court taking a decision in favour of linking Aadhaar biometrics and the number with a host of services. Several petitions have been filed challenging not just the linking of these services with Aadhaar but also the validity of Aadhaar itself. We spoke to people who support and those who oppose this linking, to understand how either case impacts consumers. 

The benefits 

According to the Unique Identification Authority of India (UIDAI), government schemes are asking for Aadhaar as it helps to clean out duplications and fakes, and provides accurate data to enable implementation of direct benefit programmes. “Use of Aadhaar reduces the cost of identifying persons and provides increased transparency to the government in implementation of its schemes,” the Authority states under frequently asked questions on its website (read more at: https://uidai.gov.in/your-aadhaar/help/faqs.html) So, when you link your bank account with your Aadhaar, government benefits such as subsidy on LPG cylinders is credited directly to that account. The FAQs, however, do not elaborate how such linking helps an individual who does not get, or does not wish to get, such subsidies. In a tweet, UIDAI had said that verifying a bank account using Aadhaar adds an additional layer of security. 

Nakul Saxena, a former banker who now works on policy advocacy at the software think tank iSpirt Foundation, said that linking of Aadhaar with these services will help eradicate fake accounts, fake insurance policies and unauthorised mobile connections. “It is possible that there are many accounts in the system that have been opened using such documents and copied signatures and even the banks may not be aware of it. Some people may not even be aware that an account exists in their name. These accounts need to be verified using Aadhaar now,” he said.

The government claims to have removed millions of fake beneficiaries for government benefits by Aadhaar linking. As reported by Mint in May 2017, over 23 million fake ration cards have been scrapped, potentially saving the government Rs14,000 crore in food subsidy every year. Another Mint report in August says, three states discovered that about 2,72,000 fake students were availing the mid-day meal (MDM) scheme.

However, those who are against linking Aadhaar disagree with these arguments. “Initially, Aadhaar was about delivery of services. But linking everybody’s phone number and bank account is not about that anymore. The real question is, what purpose this linking serves. If the intention is to update the databases, then there can be other means to update those,” said Rahul Narayan, a Supreme Court advocate who is among the lawyers representing petitioners who have challenged Aadhaar linking in court. 

The concerns 

The fundamental objection to this linking of services is that all information on an individual will be available at a single place, which could make surveillance easier and also increase the risks if this information is hacked. “As of now, your bank knows something about you, your insurance company knows something and your mobile phone company knows something about you. Each of these are different silos of information. When these converge, which is then accessible to a single person, that person knows almost everything about you,” said Narayan.  

Moreover, a user’s Aadhaar number and fingerprint are permanent identifiers, and at least the Aadhaar number has been compromised for over 130 million citizens, as per a study by Centre for Internet & Society, said Nikhil Pahwa, co-founder of the SaveTheInternet.in (https://internetfreedom.in) campaign for net neutrality in India. “This leaves the users vulnerable to social hacks, some of which we have already been reading about in the news. To forcefully and mandatorily link Aadhaar to bank accounts means that their finances are at risk,” he said. 

Saxena said the data leaks that have been highlighted have been typically about demographic details such as name, date of birth and address “which have been commonly available so far.” However, given the heightened sensitivities in this digital age, customers must ask their service providers to not publish such details, nor provide this information freely, he added. 

Grievance redressal and data privacy 

Another major concern is the absence of a clear redressal mechanisms for consumers in case of a data leak, misuse or hack. “When things go wrong, consumers need to have access to a proper complaints mechanism. In the case of Aadhaar, such access is to be provided through the establishment of ‘contact centres’ under the Regulation 32 of the UIDAI Enrolment and Update Regulations. To the best of our knowledge, not much beyond Regulation 32 has yet been specified by the UIDAI,” said Renuka Sane, associate professor at the National Institute of Public Finance and Policy, who has worked on data privacy and security issues. 

Apart from this, Section 47 of the Aadhaar Act stipulates that only UIDAI or its authorised officers can file a criminal complaint for violations of the Act, she added.

“The UIDAI has been given complete discretion in determining if and when to file a criminal complaint for violations of the Act, and an individual aggrieved by actions of a third person is left to rely upon the bonafide actions of the UIDAI,” Sane added. 

The government is also working towards a data privacy legislation, that is needed to give citizens protection against misuse of their data, and them having some control over who gets their data, how it is used, and where it can be shared. “However, a data privacy legislation and mechanism will not ensure that data remains secure and protected, and that processes are followed. The Act disallowing people from sharing Aadhaar numbers did not prevent government departments from publishing details online,” said Pahwa. He also said that systems can get hacked, which could include the Aadhaar database, the parallel Aadhaar databases with state governments, or eKYC databases held with banks and telecom operators. 

Saxena said the UIDAI has clarified that biometric information is not stored with user agencies, and stored biometrics can't be used for Aadhaar authentication or eKYC. “Hence, customers can be assured when using Aadhaar and biometrics with authorized entities,” he said. “The data privacy law will address data privacy and protection in all digital systems, not just Aadhaar. It will equally apply to social media and mobile apps. It should also go into the aspect of ‘right to be forgotten’,” said Saxena.  

Pahwa, however, insists that the least that should be done is to give citizens the right to not link their Aadhaar and use other IDs for authentication, plus the ability to change their ID number if the system gets compromised. 

What you should do 

For now, the deadlines for linking bank accounts with Aadhaar is 31 December 2017, and for mobile phones it is 7 February 2018. In its latest hearing on the matter, the Supreme Court has directed service providers to mention these deadlines in their reminders. “Right now, regardless of what they say, nobody is going to shut down your bank account or disconnect your mobile connection, at least till the deadline. There are several petitions being heard in the Supreme Court. The matter is supposed to be taken up by the Supreme Court in the last week of November. The final word from the court is yet to come and it is quite possible that at least the deadlines gets extended,” said Narayan. 

If you have already linked these services with Aadhaar, you are in no trouble. But if you are having second thoughts, the linking cannot be undone. If you are concerned about safety or other aspects, you can wait to get more clarity from the Supreme Court.

First Published: Mon, Nov 13 2017. 04 58 PM IST

11836 - The accountability framework of UIDAI: Concerns and solutions - Medianama

The accountability framework of UIDAI: Concerns and solutions

By Guest Author editor@medianama.com    August 21, 2017   

Share This:          Share via Email   

by Vrinda Bhandari and Renuka Sane and Bhargavi Zaveri.

The public discourse on Aadhaar has largely focused on concerns about the privacy issues associated with the collection of personal information, and the constitutionality of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (“the Act”). Regardless of the outcome of the case at the Supreme Court, most residents will likely have to interact with the UIDAI, which is the body empowered to roll out an enrollment and authentication program for beneficiaries of welfare programs.

The UIDAI is an Agent established by the Principal (Parliament), with three powers. The law allows the State to compel an individual seeking a state-sponsored subsidy to undergo the enrollment and authentication processes designed by the UIDAI (although Aadhaar has now been made mandatory for certain non-welfare schemes as well, which goes beyond the conception in the law). The UIDAI is empowered to license and regulate Registrars and enrolling agencies to collect the demographic and biometric information of individuals, and enroll them under the Act. Finally, the UIDAI has quasi-legislative powers, such as the power to suspend the licenses of such enrolling agencies and Registrars.

In this article, we examine the foundations required to make UIDAI work properly: the performance and accountability standards. Under the present law, UIDAI is neither performance oriented nor is there accountability for failure. The problem of accountability at UIDAI is a little explored issue, other than occasional media reporting which expresses angst about data breaches and authentication failures (see here, here, and here). There is considerable knowledge from the global and Indian literature on public administration on how to achieve performance of such an Agent. Drawing on this body of knowledge, we propose that the UIDAI should be held to appropriate accountability standards, so as to create an environment where it will perform well.

Agencification and its associated challenges

Since the 1980s, governments have established specialised organisations which perform certain functions. These Agents have diverse mandates such as regulating a specific sector (SEBI and TRAI); administration of social welfare schemes (the erstwhile Benefits Agency in the UK); and running prisons (such as the HM Prison Service (HMPS) in the UK or the Dienst Justitiële Inrichtingen – National Agency for Correctional Institutions (DJI) in the Netherlands).

The Agent performs its mandate through the exercise of three kinds of powers, namely, quasi-legislative powers, quasi-executive powers, and quasi-judicial powers (FSLRC, 2013). While some agencies have all three kinds of powers at their disposal, others have some of them. For instance, while SEBI has all three powers, agencies which are tasked with administrative functions such as the UK Benefits Agency or the HMPS have limited quasi-legislative powers and no quasi-judicial powers. Whatever may be the scope of powers of these agencies, two features cut across all such agencies: (a) they perform functions that the sovereign would have otherwise performed; and (b) they wield the power of the State in being able to coerce certain private persons in certain ways.

Broadly speaking, agencification has worked well in improving State capacity. However, this has come from establishing an array of mechanisms to deal with a few important concerns:

1. Weaker links between the people and agencies: When a sovereign delegates functions to agencies, this reduces accountability through elections (Maggetti, 2010). The persons manning such agencies are one more step away from the people, as they are autonomous from the government and are not politically accountable to the people. Power in the hands of unelected officials also creates concerns about democratic legitimacy (Majone 1998). For instance, agencies which have been tasked with the administration of social welfare have been accused of opacity (Pollitt et al, 2004).
2. Unfettered discretion: When agencies have the power to write subordinate legislation (i.e. regulations), this power is often not accompanied by checks and balances. In liberal democracies, there are elaborate checks and balances that are placed upon Parliamentary law. These checks and balances can, and often are, diluted in the context of the “regulatory state”. For example, in all these years of SEBI’s establishment, only one of its quasi-legislative instruments has been challenged. Compare and contrast this to the constitutional challenge that virtually every significant parliamentary law faces in India. Similarly, in the last 30 years, no order issued by RBI has been challenged by the person penalised. This leads to the possibility of abuse of power (Cochrane, 2015).
3. Size and ever-growing footprint in administration of public affairs: Autonomous bodies, especially those entrusted with the administration of social security benefits, end up assuming significant proportions, both in terms of their size and budget allocations. For instance, in 2000, the Benefits Agency which was responsible for the administration of social welfare schemes in the UK employed a staff of 70,642 and accounted for 30% of the overall state budget (Pollitt et al, 2004). Similarly, the Social Security Administration in the United States now has a staff strength of 60,000. In the Indian context, the annual expenditure of the RBI is larger than that of the States such as Goa.

An accountability framework for agencies of the State

The power to coerce or the power to spend, that is conferred upon the Agent, must be associated with commensurate accountability mechanisms (Stone and Thatcher, 2002). Accountability mechanisms are ex-ante and ex-post. Examples of both are enumerated below:

Ex-ante accountability mechanisms:

1. Having an adequate strength of independent directors on the board of the agency
2. Regular internal audits to review the performance of the agency and ensuring that it complies with the law in exercising the discretion vested in it
3. Setting out the objectives of the agency and the instruments to be used to achieve them, clearly in the law
4. Setting out performance oriented goals and metrics for measurement of performance, in advance
5. Defining formal processes for the exercise of the powers vested in the agency
6. Mechanisms to facilitate transparent decision making, such as public consultations before making delegated legislation, maintaining a website, publishing a clear rationale for each decision of the agency

Ex-post accountability mechanisms:

1. Laying all quasi-legislative instruments before the Parliament
2. Reports showing the goals set out at the beginning of the year, the extent to which they are achieved at the end of the year and a statement of reasons for failure
3. Resource allocation towards different goals and year-end utilisation
4. Performance and audit by external independent agencies and publishing the reports of such audits

How do other social security administrators account for their performance?

Since the Aadhaar number is so often compared to the social security number issued by the Social Security Administration (SSA) in the United States, we can usefully draw a comparison with the annual performance and financial report published by the US SSA. The report sets out the strategic goals of the SSA that were determined at the beginning of the year. It divides the strategic goal into multiple objectives, specifies measurable performance metrics to ascertain the extent to which the objectives have been met, and the extent to which the goal was achieved. An example of how the performance reporting for the SSA works, is given below.

1. For FY 2012, a pre-determined strategic goal of the SSA was to deliver “quality disability decisions and services”.
2. This strategic goal was divided into three objectives. One of the objectives was to “Reduce the wait time for hearing decisions and eliminate the hearing backlog”. The metrics used to measure the performance of the SSA on this objective was to complete “the budgeted number of hearing requests” and “reduce waiting time between hearings and decisions”. SSA reported its performance on these two metrics as under:

Example of performance reporting by the SSA

Objective: Reduce the wait time for hearing decisions and eliminate the hearing backlog
Performance Measure	FY 2012 target	FY 2012 Actual	Whether target achieved
Complete the budgeted number of hearing requests	875,000	820,484	No
Minimize average wait time from hearing request to decisions	321 days	362 days	No

The SSA’s performance report also shows the funds allocated to each objective and a statement of reasons where the performance metric is not met.

The current accountability framework of the UIDAI

A reading of the objectives and functions assigned to the UIDAI under the Act would suggest that the UIDAI must, at the very least, be held accountable for:

1. The enrollment and authentication of persons [sections 11 and 23(1)]
2. The regulation of enrollment agencies and other service providers licensed by it [section 23(2)(i)]
3. The security and confidentiality of the data shared by persons who have enrolled with the UIDAI [section 23(2)(j) and (k)].

The Act and the accompanying Regulations specify a limited accountability framework, which is not oriented towards performance or service delivery to the citizen. Three accountability measures are present under the Aadhaar Act and Regulations:

1. An annual CAG audit, and requiring these certified accounts of the UIDAI to be laid before each House of Parliament [Section 26 of the Act]; and
2. Requiring an annual report in a prescribed form describing UIDAI’s past activities, accounts, and future programmes of work, to be laid before each House of Parliament [Section 27 of the Act]. However, no such manner and form for the publication of the report has been laid down in the Aadhaar Regulations, nor does such a Report seem to be available in the public domain.
3. Requiring certain processes to be followed by the CEO in transacting business at the UIDAI (Transaction of Business at Meetings of the Authority) Regulations, 2016, although these only relate to the number of meetings, quorum, voting procedure etc.

Apart from an annual financial audit, the law lacks any performance accountability mechanisms for the UIDAI. For instance, there is nothing in the law requiring the UIDAI to set performance standards for itself or account for core responsibilities such as number of people enrolled and not enrolled, number of authentication failures or number of data and security breaches. The law is similarly completely silent on ex-post accountability mechanisms. It neither requires a performance audit nor demands a justification for failures on its part.

Weak law will deliver weak performance

The conduct of an agency is largely shaped by the law governing it. For instance, Burman and Zaveri (2016) find that there is a correlation between the laws which mandate transparency of a regulator and the responsiveness of such regulators to citizens’ preferences. Similarly, the detailed performance reporting by the SSA is underpinned by a law called the Government Performance and Results Act, 1993, a law that set up a performance-oriented framework of reporting for the US federal agencies to show the progress they make towards achieving their goals.

In the absence of such statutorily mandated accountability standards, measuring the performance of the UIDAI is difficult. Stories of security breaches and authentication failures for availing benefits abound. For instance, Scroll.in queried the UIDAI about the authentication requests received between September 2010 (when the first Aadhaar number was issued) till October 2016, and how many failed or succeeded. The query was aimed at assessing the efficacy of biometric authentication. 

The UIDAI replied that it had not maintained any records between September 2010 and September 2012 and that it did not maintain authentication data state-wise. More importantly, the UIDAI revealed that data about the success or failure of the over 331 crore authentication requests was “not readily available”, nor was the breakup of the negative reply to the requesting authority on each of the five modes of authentication “readily available”.

Similarly, cases of fake Aadhaar cards have also been reported. Pertinently, in response to an RTI filed by PTI, seeking details related to all cases of duplicate and fake Aadhaar cards and the action taken on them, the UIDAI refused the request on the grounds that the disclosure might affect national security, or lead to incitement of an offence. The UIDAI also informed PTI that its CIDR facilities, information assets, logistics and infrastructure and dependencies, are all classified as “protected system” under the IT Act, and are thus, exempt from RTI. It further stated that the format in which it held the information contained identity details, which may be prone to identity theft, if divulged. The practical reality thus is that cases of unauthorised leaks/disclosures of identity information are being dealt with on a case to case basis, with zero clarity in the law on who is to be held accountable for such lapses in the future.

Conclusion

In previous decades, when we first set up state agencies in India, we were driven by concerns of efficiency and expertise that such agencies would bring to public administration. We now have sufficient experience about the endemic failure of State capacity in that approach. If one more new agency is built, on the lines of existing agencies, there is a high chance that it will reproduce the failures of existing agencies.

The climate of thinking on these questions in India is shifting.

 The FSLRC report, which proposes a new financial regulatory architecture, made extensive recommendations on the accountability framework for financial sector regulators. These recommendations were codified in the Indian Financial Code (IFC), a draft law that accompanied the FSLRC report. For example, the IFC contains provisions that mandate (a) regulators to build a system of periodical internal audits and publish the reports of such audits, (b) performance audits by an external auditor, (c) building systems for measuring the performance and efficiency of regulators, and (d) public consultation and a cost benefit analysis before exercising quasi-legislative powers. Some of these provisions that do not require legislative amendments are being implemented by the Ministry of Finance through a Handbook on Governance enhancing recommendations of the FSLRC, adopted by the four financial sector regulators in October 2013.

The report of the Bankruptcy Law Reforms Committee (2015), drew on the regulatory governance framework recommended by the FSLRC and recommended four elements for achieving accountability of the Insolvency and Bankruptcy Board of India, India’s new insolvency regulator. While some of these elements were codified in the Insolvency and Bankruptcy Code, others are sought to be implemented in the course of setting up the Insolvency and Bankruptcy Board of India. Recent events at TRAI are pushing the organisation towards sound processes.

While the subject of regulatory governance seemed remote and a second order issue in setting up institutions in India, policy thinking today has increasingly started recognising that enhancing governance standards is as important as technical soundness, when designing new frameworks. Every government agency is an Agent, and the journey to building high performance agencies lies in setting up a sound principal-agent relationship, in the law. UIDAI is an important new organisation, and it should emerge as a high performance agency. We must harness our experience and our knowledge, to build appropriate accountability standards for the UIDAI in the law.

References

Cochrane, J. (2015), The rule of law in the Regulatory State.

Heidenheimer, A.J., Heclo, H. and Teich Adams, C. (1990), Comparative Public Policy: The Politics of Social Choice in America, Europe, and Japan, (3rd edition) New York: St. Martins.

Maggetti, Martino (2010). Legitimacy and Accountability of Independent Regulatory Agencies: A Critical Review, Living Reviews in Democracy Vol 2.

OECD (2014), The Governance of Regulators, OECD Best Practice Principles for Regulatory Policy, OECD Publishing.

Pollitt, Christopher, Colin Tablot, Janice Caufield, and Amanda Smullen (2004), Agencies: how governments do things through semi-autonomous organizations, New York: Palgrave Macmillan.

Young Han Chun, Hal G. Rainey (2005), Goal Ambiguity in U.S. Federal Agencies, J. Public Adm. Res. Theory 2005, 15 (1): 1-30.

Majone, Giandomenico (1998), The Regulatory State and its Legitimacy Problems, Political Science Series No. 56, Department of Political Science of the Institute for Advanced Studies (IHS)

Sweet, Alec Stone and Thatcher, Mark (2002), “Theory and Practice of Delegation to Non-Majoritarian Institutions”, Faculty Scholarship Series, Paper 74

Report of the Financial Sector Legislative Reforms Commission, Volume 1 (2013)

Burman, Anirudh and Zaveri, Bhargavi (2016), Regulatory responsiveness in India: A normative and empirical framework for assessment, IGIDR Working Paper WP-2016-025, October 2016.

*

Vrinda Bhandari is a practicing advocate in Delhi. Renuka Sane is a researcher at the National Institute of Public Finance and Policy, Delhi. Bhargavi Zaveri is a researcher at the IGIDR Finance Research Group, Mumbai.

*

Source: The accountability framework of UIDAI: Concerns and solutions by Vrinda Bhandari and Renuka Sane and Bhargavi Zaveri,  Ajay Shah’s blog, August 20, 2017.

10846 - UIDAI CEO: We’ll ask SC to test Aadhaar Act on standard of privacy as a fundamental right - Medianama

UIDAI CEO: We’ll ask SC to test Aadhaar Act on standard of privacy as a fundamental right

By Nikhil Pahwa ( @nixxin , +NikhilPahwa ) on February 16, 2017

Rajesh Jain (Founder, Netcore) and Ajay Bhushan Pandey (CEO UIDAI)

“I would urge all of you, please read the Aadhaar act and the regulations,” UIDAI CEO Ajay Bhushan Pandey said at the India Digital Summit last week, adding “What the underlying theme is that we have presumed that privacy is…whether privacy is a fundamental right or not is a question which will be answered by the Supreme Court, finally.” 

Pandey was responding to a question from MediaNama, which pointed out the Union of India’s statement in the Supreme Court that ‘Violation of privacy doesn’t mean anything because privacy is not a guaranteed right’, and asked about privacy protections in the law to prevent mass surveillance of citizens.

Pandey added that “We’ve presumed that the privacy is almost like a fundamental right. And if a fundamental right has to be protected, what protection measures should be there? So, whenever the hearing takes place, we are going to take this stand in the Supreme Court, saying that whether the privacy is a fundamental right or not doesn’t concern only Aadhaar, it concerns many other aspects. But so far as Aadhaar is concerned, please test the Aadhaar act on that standard, saying that presume that Privacy is a fundamental right, and whether whatever Aadhaar is doing meets that fundamental right criteria or not. And we’re very sure.”

“Now the Aadhaar act has been passed, it is almost one year, and the way we’re doing it, all other apprehensions that government will become big brother, government will aggregate big data and all kinds of things, data will be misused, private companies will misuse it, all these things, you know all these things today, you know I wouldn’t say there are no complaints, but genuinely there are no specific instances”, and “Nor have such complaints have been brought to the notice of the court.”

Please note that Renuka Sane (visiting fellow at the IDFC Institute, Mumbai) and Vrinda Bhandari (Advocate at the Delhi High Court) had detailed out earlier issues related to privacy in the Aadhaar Act, saying that the Aadhaar Act and the IT Act are “important failures in enshrining privacy.” Read their detailed analysis here. Importantly, they also point out that there is a possibility of a conflict of Internet “since it may be in UIDAI’s interest to cover up breaches of privacy. Without the UIDAI’s proactive action, an individual Aadhaar number holder is left without remedy.”*

The other question we asked Pandey was about the failure rate, and “what recourse do people who have been denied their benefits, have? This concern about fingerprints was also raised by the parliamentary standing committee, under Yashwant Sinha”

To this, Pandey said that “Ideally there should be no failure rate. But what is happening is that we’re seeing a failure rate of 92-98%…I mean success rate. What is that 8% or 2%? That is somebody who could not get authenticated.”

“Sometimes people are very innovative,” he added. “They try to see if their fingerprint works or not (for someone elses Aadhaar number). I’m not saying that that is the only reason. 

Sometimes, you know, some of the fingerprints are worn out. In that case, we have the facility that you can authenticate any of the fingerprints. 10 fingerprints or the iris. Using this you can reach almost near 100%. The telecom companies that have started given SIMs (SIM cards for mobile numbers) using this, their success rate is 98%. Whereas, the business correspondents, who go to the villages and actually hand out cash, have a success rate of 92%. They have to improve that.”

Frankly, even 2% and 8% failure rates are significantly large numbers when you consider a population of 1.2 billion on Aadhaar: it is real people who are getting impacted, and someone denied their rights – rations are critical for many – shouldn’t be seen as just a percentage point. That is one of the problems with the proponents of Aadhaar (and digital payments): a lack of empathy, and thinking of technology as the be-all and end-all of India’s problems. Do read: Technology has never been this politial in India