Supreme Court refers to Cambridge Analytica breach in Aadhaar hearing, raises concerns

New Delhi: The Supreme Court on Thursday raised the controversy involving Cambridge Analytica (CA), which was accused of analysing personal data to help target voters, to express its concern over Aadhaar data leaks.

“Purloining of data… for the purpose of influencing elections in some of the most powerful nations… is an issue,” Justice DY Chandrachud said, referring to the recent controversy surrounding Cambridge Analytica.

Justice Chandrachud is part of a five-judge bench led by Chief Justice of India Dipak Misra that is hearing a challenge to the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act.

Rakesh Dwivedi, counsel for the Unique Identification Authority of India (UIDAI), which administers Aadhaar, dismissed such fears, saying the authority doesn’t have the tools or the algorithms used by Facebook and Google.

“We do not have the tools to analyse these data. The Act precludes us from getting any. If we have that power, please strike it down. To undertake any surveillance, we will have to conspire and collude with the Central government,” he said.

Justice Chandrachud then demanded to know the purpose of storing metadata. “Storage opens up a whole new universe. Technology is a great enabler to surveillance,” he told Dwivedi when he argued that the state did not need Aadhaar to act as a “big brother” and put everybody under surveillance.

“We cannot even tamper with the servers,” Dwivedi told Justice Chandrachud, who was far from happy with the explanations. “The 1.2 billion Indians may be poor, but their data is a goldmine of commercially sensitive information,” Justice Chandrachud said.

The senior advocate, who also argued for the state of Gujarat, tried to explain that identity information without biometric data can only be shared with third parties after getting the consent of the person.

However, Justice Chandrachud dismissed the consent forms as standard forms that deny a service if consent is not given.

The judge flagged his concerns over the alleged lack of control of UIDAI over data shared with third parties requesting verification or authentication.

“You have no control over registering entities. They are in the uncharted sea,” he said.

The court debated whether the government could insist on validation of pre-verified old bank accounts with Aadhaar. The government insisted that it could in view of the spurious bank accounts through which terror financing was carried out.