SC put guardrails in the users' interests: iSPIRT on Aadhaar verdict

iSPIRT, India’s biggest technology think tank and founder of India Stack, is of the opinion that the Supreme Court, in its judgment on Aadhaar last week, didn’t mean to keep the private sector from using it but put guardrails in the users’ interests.

The Supreme Court struck down parts of Section 57 of the Aadhaar Act, which allowed private companies to ask customers and stakeholders for Aadhaar.

In a post on its website on September 30, Sanjay Jain, a volunteer with iSPIRT and former chief product manager at the Unique Identification Authority of India (UIDAI), said the court wanted to provide for law-based uses of Aadhaar.

The post said a careful reading of the majority verdict suggested the court said Aadhaar use by private companies must be purpose-limited and in line with the data privacy regulations of the country. 

This comes three days after Jain’s article in an English daily in which he made largely the same points and also said regulators such as the Reserve Bank of India (RBI) and Securities and Exchange Board of India (Sebi) could check their regulations and make sure Aadhaar’s use was backed by law.

iSPIRT endorses this thinking. 

Speaking to Business Standard, a senior official said companies not coming under the ambit of any major regulator were not allowed to use Aadhaar. Examples of such entities are cab aggregators Ola and Uber, which use Aadhaar for verifying the identity of their drivers.

“The court has said any contract-based use of Aadhaar is not permissible and it must be backed by law. So, banks and NBFCs have the licence from the RBI and they can use it, so can telecom companies, and many other players. The ones hit will be those without a direct use of Aadhaar authentication like cab companies,” the source said.

“Legal sanction is based on use-case and not the ownership. So it’s not that only public sector banks can use Aadhaar and not private ones. Only unregulated companies are affected,” he added.

In its blog post, iSPIRT acknowledged it received feedback that private sector usage would not be allowed even on a voluntary basis. The body then claimed it reread the judgment and analysed it in the light of the discussion that the Bench provided in different parts of the ruling to come to the conclusion that Aadhaar use by the private sector was not outlawed.

“Having done this, we are confident in our assertion that the judges did not mean to completely blockade the use of Aadhaar by private parties, but merely enforce better guardrails for the protection of user privacy,” the post stated. 

It added that private companies should now relook the way they used Aadhaar and ensure users were given other ways of identifying themselves while also building procedures to bypass failures, including biometric failures.

The post gave the example of banks using Aadhaar to open accounts and transferring subsidies through direct benefit transfer based on Aadhaar authentication. iSPIRIT said each of these cases would have to be looked at separately in the light of the RBI Act and other regulations. 
 

The post ended with a disclaimer that this was not legal advice.

However, Prasanna S, a Delhi-based advocate who assisted the petitioners in the Aadhaar case, said: “The iSpirt reading suffers from at least one obvious mistake. It has struck off the qualifier ‘state’. Once that qualifier is there it is clear that what remains is only two uses of Aadhaar: a) Section 7 use for welfare benefits and subsidies and services where funds are drawn from the Consolidated Fund of India; and b) Section 57 use, where any state authority may use it for a purpose under a law. Private party use is prohibited.”