Title: It’s Now Aadhaar with Caveats

In its 1448-page verdict, the Court held the Aadhaar Act to be a beneficial piece of legislation that involves “parting with minimal information” in service of the “larger public interest.” The marginalized and the poor can use it to obtain government benefits, subsidies, and services paid out of the Consolidated Fund of India. Privacy, while recognized as a fundamental right, has not been held by the court to be the most important. Privacy is considered important to protect an individual’s personal information when they are opening a bank account, using a telecom service to make phone calls, or seeking admission to a school or university. But privacy cannot be claimed when it comes time to pay income tax. Aadhaar has thus been made compulsory to apply for the permanent account number required for filing income taxes. The court has struck down several irrelevant provisions related to Aadhaar card links to private sector programs and initiatives where no public benefits or subsidies are involved. An example of such a provision is Section 57, which provides private entities the legal authority to demand Aadhaar from an individual in order to sell the metadata and use it for targeted advertising or customer profiling.

To determine Aadhaar’s validity, the Supreme Court used the test of proportionality. The principle entails that the nature and extent of the government’s interference with the exercise of a right must be proportionate to the goal it seeks to achieve. The majority judgment held that there was no alternative to the Aadhaar system of authentication and that despite repeated queries the petitioners themselves were not able to suggest any such method. By the same criteria, Section 57 was struck down as the invasion of privacy was considered excessive. While the Indian government has welcomed the judgment and is happy about the areas where Aadhaar is permitted, it will explore options to open areas where it is currently restricted.

For now, the judgment will have an adverse impact on the ease of doing business. Many service-oriented industries, such as telecom, banking, and fintech, relied on Aadhaar to complete their standard process followed by banking and financial service providers to verify the identity of their customer and assess the risk of fraud or identity theft, know-your-client (KYC), digitally. These companies will now have to revert to their previous time-consuming methods of verifying customers’ identities. According to industry estimates, verification via Aadhaar takes about 30 minutes per customer, whereas it takes five to six days for company officers to go to customers’ addresses and verify their details for KYC. This will increase the cost of customer acquisition – from $0.20 (USD) for Aadhaar-linked KYC to $1.40 (USD) per person sans Aadhaar. People can voluntarily present physical Aadhaar cards for KYC right now, but only government entities or government-controlled banks can utilize digital authentication.

The judgment also provides a setback to the Indian government’s Digital India initiative, with Aadhaar being its most ambitious part. One component is India Stack – the use of biometric identification as the bottom-most layer in a value-adding stack of offerings from government as well as private players like fintech companies, developers, banks, healthcare providers, and non-profit organizations. These provide a host of digital services which include e-documentation, payment interfaces, and a marketplace app. However, the initiative faced criticism in light of the commercial use of Aadhaar data in the absence of data security and protection laws in the country. The Supreme Court judgment is a death knell for India Stack in its current form.

To those opposed to compulsory authentication through Aadhaar, the Supreme Court judgment is perceived to be balanced and rational. Following the Supreme Court judgement, it is now up to the Indian government to change the Aadhaar law as per the guidelines laid down by the Supreme Court. The Aadhaar Amendment Bill is the government’s response to the guidelines laid down by the Supreme Court. The bill, among other changes, seeks to allow individuals to voluntarily offer Aadhaar as a proof of identity for services like opening of a bank account or getting a mobile phone connection.

Fintech companies, meanwhile, are exploring alternative mechanisms of using technology to authenticate their customers. There are instances of telecom companies using Aadhaar to issue mobile SIM cards in the absence of specific instructions from the Department of Telecommunications. More clarity will be required for the implementation of Supreme Court judgments in both letter and spirit.

While digital authentication through Aadhaar has only been allowed for customers eligible for direct benefits transfers, the voluntary use of physical Aadhaar cards has also been permitted for the purpose of opening bank accounts and buying mobile phone connections. The voluntary use of Aadhaar as a uniform tool of identity across the country would be similar to the Social Security Number in the US or the National Insurance Number in the UK. With almost 1.1 billion Indians possessing Aadhaar cards, the voluntary use of physical cards for authenticating identities is likely to garner support from service providers as well as consumers.

The judgment, however, has not allayed the concern of Aadhaar being used as a tool for mass surveillance. Supreme Court Justice Dhananjaya Chandrachud, the only dissenting member among the bench of five, provided that the architecture of Aadhaar posed “a risk of surveillance.” A surveillance tool in the hands of a government, even a democracy, is likely to cause concern. Some believe it to be a privacy hazard from several angles: data security, bodily integrity (due to the use of biometrics), personal integrity, and personal data mining. To others, the judgment is flawed, accentuates India’s problem of policies with exclusionary benefits, fails to address data security problems, provides an outlet for the illegal tracking of individuals, and is unconstitutional.

The government of India has a tight rope to walk. On the one hand, there is the uphill task of augmenting the ease of doing business using Aadhaar as the preferred form of authentication for public as well as private service providers. On the other hand, care must be taken to ensure that Aadhaar does not unnecessarily infringe upon individual privacy and that services are not denied to those that either fail to or choose not to subscribe to Aadhaar authentication. The government will have to pass legislation on data sharing and privacy, tailored to the requirements of the various stakeholders in the country. Data protection laws can help restore private players’ access to the central identity repository for verification of an individual’s identity. Incidentally, in the case that the government frames a law to allow private service providers the permission to use Aadhaar for digital KYC, then the highest court may again find reason to take it up for legal scrutiny.

. . .

Kevin C. Desouza is a professor of business, technology and strategy at Queensland University of Technology’s QUT Business School. He is also a non-resident senior fellow with the Center for Technology Innovation at the Brookings Institution and a distinguished research fellow at the China Institute for Urban Governance at Shanghai Jiao Tong University. An International City/County Management Association Research Fellow and a Salzburg Global Fellow, Desouza served on the board of directors of the Alliance for Innovation from 2012 to 2018. He formerly held faculty posts at Arizona State University, Virginia Tech and the University of Washington and has held visiting appointments at the London School of Economics and Political Science, Università Bocconi, the University of the Witwatersrand and the University of Ljubljana.

Kiran Kabtta Somvanshi was a Fulbright Humphrey Fellow at Arizona State University from 2017 to 2018.