SC Aadhaar verdict highlights data protection weaknesses

DELHI: On Monday, the Supreme Court told the Centre it cannot share the biometric information collected by the Unique Identification Authority of India ( UIDAI) with any government agency without consent from UID number holders.

The SC ruling was in response to a 26 February, 2014 ruling by the Mumbai High Court directing the UIDAI to provide the CBI with biometrics of all residents of Goa.

The High Court's ruling was related to the rape of a seven year old in Vasco last January. The case was handed to the CBI which, as the Aadhaar appeal to the SC says, initially asked it for biometric information of "all the persons in the state. That request was modified and only the fingerprints of 3 specified persons were asked for."

Later, the CBI dropped that request. Says the Aadhaar affidavit, "The CBI has now found a chance fingerprint and asked Aadhaar to compare its data and the biometric data provided by the CBI."

Aadhaar refused to share information citing two reasons. One, that such a move would violate privacy of the number-holders. And two, that its biometric database and deduplication systems are not designed for forensic inquiries. When its appeal was rejected by the HC, UIDAI appealed to the SC.

As such, the case highlights the new risks that come with India's adoption of biometrics. With the privacy bill still on the drawing board, India has seen biometric data get collected, by multiple agencies, without any laws governing their collection, use or retention.

Adds legal researcher Usha Ramanathan, "The idea that databases can be used by anyone makes people vulnerable, especially in a state where there is neither law nor much respect for law."

The court's order clarifies matters to some extent. It has, firstly, said that data cannot be shared. In other words, data collected for service delivery cannot be used for aiding investigations. It cannot be extended to forensics.

In the hearing today, the SC also linked this matter to the larger set of petitions it is hearing about the concerns on privacy and validity around the Aadhaar
project.

The Court also reiterated its earlier order that non-possession of an Aadhaar number cannot affect or hamper access to government services.