12241 - Aadhaar in a double bind - DNA

Aadhaar in a double bind

There have been news reports that scamsters, by obtaining Aadhaar details, have defrauded people and siphoned off money from their bank accounts

VIRAG GUPTA | Updated: Oct 24, 2017, 08:10 AM IST, DNA

There is a rare chance SC will invalidate Aadhaar, but high possibility its mandatory nature will be curtailed

Mobile companies and banks are routinely sending SMSs for mandatory authentication of Aadhaar, thereby creating confusion as well as fear among the public in general. The Supreme Court (SC) has recognised the right to get speedy justice as a fundamental right, but has failed to give the final verdict on Aadhaar, which, in turn, has caused multiple petitions to be filed over the years. The latest entrant in the Aadhaar case docket is the challenge to Prevention of Money Laundering Act rules and DoT circular which makes Aadhaar mandatory. Nine judges unanimously decided against the government by holding the right to privacy as a sacrosanct fundamental right, yet the Supreme Court is yet to constitute the bench to hear the challenge to Aadhaar. Further, delay on part of the Apex court may become a classic case of the operation being successful but the patient having died.

Adding to the confusion, the RBI, in a reply to an RTI query, has stated that it has not issued any instructions of mandatory linkage of Aadhaar, but the same has been done after an amendment of PMLA rules in June 2017 by the Central Government. Why does the RBI, as the financial regulator, not issue official directions to all banks stating that linkage of Aadhaar is mandatory? Recognised as an autonomous body since pre-independence days, RBI has already suffered a loss of credibility in the public eyes during the days of demonetisation. RBI is yet to explain how, in contravention of section 26 of the RBI Act, 1934, currency once demonetised was allowed to be selectively used in the system.

The Apex court, in its order dated August 11, 2015, has already directed the government to publicise in the media that Aadhaar is not mandatory. On a plea by NGO Lokniti, the Apex court in February 2017 had directed for verification of all mobile phone numbers within a year. However, in the guise of the SC order, which had not mandated any mechanism, Department of Telecom came up with its circular dated March 23, 2017, directing the telcos to verify and re-verify their customers by Aadhaar authentication.

There exists a multitude of documents such as driving licence, voter ID card, passport, PAN to complete Know Your Customer (KYC) formalities. It is rather preposterous that even though Aadhaar is not a legal ID and address proof, it has been made mandatory for KYC purposes. Moreover, why should a person who has already completed KYC formalities using other legal documents be forced to share his Aadhaar number with the bank or telcos? The argument is bolstered for a person who is not claiming any subsidy or relief from the government schemes and wishes to lead his own private life as envisaged under the right to privacy.

Aadhaar started out as a scheme of the erstwhile Planning Commission and embarked on a journey to collect the biometrics of anyone in India, without any statute backing it. It was only years later in 2016 that the scheme was given the backing of a statute and the Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016 was passed by Parliament. It is questionable as to why Aadhaar has not been made mandatory as per the Aadhaar Act, 2016. Is it that our legislature is too inept to envision the future so that we had to amend the rules in PMLA, 2002 within a year of Aadhaar Act, 2016? Or, did the passage of Aadhaar as a money bill handicap the government from making several changes, which it now passes through the back door.

The government has done little to protect the data of over 100 crore Indians that is stored in the Aadhaar data bank. Where is the guarantee that the government or any private agencies will not misuse the data, which has huge commercial value? There have been news reports that scamsters, by obtaining Aadhaar details, have defrauded people and siphoned off money from their bank accounts. After the Apex court judgment on the right to privacy, should not the UIDAI or other agencies be held liable for violation of security breach as if it were not for Aadhaar, the public would not have suffered any loss?

In all fairness, there is a rare chance the Supreme Court will invalidate Aadhaar, but there exists every possibility that its mandatory nature will be curtailed. The Court, while delivering its order regarding the sale of firecrackers remarked that it knew that the order was going to be violated. Is the Court now waiting for its various interim orders on Aadhaar to be violated by the government itself? In its interim order dated March 24, 2014, the SC had put a ban on data sharing of Aadhaar data as well as its mandatory nature. Supreme Court has the option of initiating contempt proceedings but the public is surely looking to be without legal options. The All India Bank Officers Association has already demanded that the decision on mandatory linkage of Aadhaar be suspended until the Supreme Court gives its verdict. Forcibly making Aadhaar mandatory, which was once said to be optional, will affect the credibility of the government. It will be best for the government to explain its actions, which otherwise seem to be without aadhaar, while all eyes look towards the Supreme Court.

The author is a Supreme Court lawyer and an expert in Constitutional affairs. Views expressed are personal.

12127 - Right to Privacy in digital arena - DNA India

Right to Privacy in digital arena

When it comes to data protection, the real dangers are posed by non-State actors who will stoop to any level to attain their objective

VIRAG GUPTA | Updated: Sep 24, 2017, 07:39 AM IST, DNA

The data law has to create an elaborate framework to prevent information from falling into wrong hands

The historic judgement of the Supreme Court on right to privacy will change the dynamics of Digital India. It should compel the Government to ensure robust data protection law so that personal data of 1.3 billion Indians isn’t sold out in the open market. At the same time, the Government will have to protect its own data and take effective measures to tax foreign internet companies, which neither have their servers nor any office in India. These neocolonialists spread all across the globe are the new age East India Companies and the Apex Court has paved the way for India being the leading nation to tackle an issue so big.

The enormity of the challenge before the SC is clear from its second para wherein J Chandrachud writes, “In an age where information technology governs virtually every aspect of our lives, the task before the Court is to impart constitutional meaning to individual liberty in an interconnected world.” However, the SC took a distant stand regarding ensuring any direct protection through judgment and put the responsibility on the Government by saying, “Formulation of a regime for data protection is a complex exercise which needs to be undertaken by the State.”

After the verdict, Union Law Minister Ravi Shankar Prasad blamed the UPA government for the present fiasco and stated that the Modi government enacted the Aadhaar Act to ensure data protection. However, he failed to disclose that UIDAI illegally collected data for 7 years in both UPA and NDA regimes. 

In spite of different provisions of data protection in the IT Act itself, there are different leakages of data by various government departments and private agencies but no penal action has been taken against such body corporate as per IT Act and various rules. In fact, if Aadhaar is so comprehensive, then why did the Centre form the Srikrishna Committee or why has TRAI floated its own consultation paper for data protection? Data once gone, is gone and putting the horse in front of the cart is not going to do any help.

In 2012, KN Govindacharya had petitioned the Delhi High Court detailing many of the dangers which find a mention in the mammoth 547 page SC judgement. Despite knowing about it at least for 5 years, it was only in February 2015 that the Government notified its Social Media Policy. After strong comments from Delhi High Court, Maneka Gandhi’s WCD ministry tender for appointment of Social Media agency was cancelled in 2014. Instead of following the law, usage of social media took a leap under Modi government, and ministries have now hired professional agencies for as much as Rs 2 crore per year to manage their PR. Even otherwise, a government handle posts a lot of information that has its own content value which is directly pocketed by social media companies, as per their terms of usage. 

Posts on social media are public record as per the Public Records Act, 1993, and are available under RTI to every citizen. Yet rules are being flouted as government organizations delete tweets, negating the fundamental right to “know” available to every citizen. 

The Delhi HC also took note of minors accessing the Internet and directed for appointment of grievance officers, which is yet to be implemented by all Internet and social media companies. 

In spite of the Delhi HC order that children below 13 cannot join social media, as per reports, children as young as three years are on social media. In the SC judgment Justice SK Kaul has observed, “They should not be subjected to the consequences of their childish mistakes and naivety, their entire life. Privacy of children will require special protection not just in the context of the virtual world, but also the real world.”

Data is the new oil for which SC noted, “One of the chief concerns which the formulation of a data protection regime has to take into account is that while the web is a source of lawful activity...web can be exploited by terrorists to wreak havoc and destruction on civilised societies.” The same carries immense security ramifications as was made clear by Edward Snowden and his PRISM disclosures. Public Records Act, 1993, mandates jail term up to five years for a person taking out a public record, which includes email, out of India. The Government in Parliament has admitted to formulating an Email Policy in 2015 and aims to provide official email IDs to around 50 lakh central government officials but the same is yet to fructify. 

Interestingly, the Government does not know how many of its employees use private emails, and what is being communicated through them.

The neocolonialists have details of every imaginable type of personal data. Justice SK Kaul in para 17 writes, ‘Uber’, the world’s largest taxi company, owns no vehicles. ‘Facebook’, the world’s most popular media owner, creates no content. ‘Alibaba’, the most valuable retailer, has no inventory. And ‘Airbnb’, the world’s largest accommodation provider, owns no real estate. Something interesting is happening.” Global conglomerates have designed their corporate structures in such a manner that they barely pay any taxes in India, despite monetising the data worth billions. 

Aadhaar, and India becoming a surveillance State may be another debate, but the real dangers come from these non-State actors who hold no accountability. The Government has proved itself to be completely inept at handling crucial technological-legal issues and has worked only in a piece-meal fashion. 

The Srikrishna Committee on data protection has no deadline to meet, yet Law minister Prasad is optimistic about bringing the Data Bill by December. Even as the law is in the pipeline, the minister has appreciated data mining which otherwise is illegal as per IT Act and Rules. It seems that right to privacy may have little meaning in the digital world.

The author is a Supreme Court lawyer and an expert in Constitutional affairs. Views expressed are personal