16-digit virtual identification: UIDAI system to protect privacy partially

A day after the Unique Identification Authority of India (UIDAI) introduced a mechanism to protect the Aadhaar data of 1.2 billion residents in the country, experts and government officials were divided over the effectiveness of the new system.

The government on Wednesday provided an option to individuals that they can generate a 16-digit virtual identification (VID) number and give it for authentication instead of Aadhaar, a 12-digit unique number which was generated after obtaining their biometric details. 

The government action followed media reports alleging a few Aadhaar User Agencies (AUAs), which are authorised to carry out authentication, illegally storing and misusing Aadhaar details. In the new system, the AUAs will not be able to store Aadhaar numbers and data. Senior Central government officials who oversee the roll-out of government welfare schemes on the Aadhaar platform say the new system will address privacy concerns to some extent.

“Our understanding is that people will still need to provide their Aadhaar to banks and other financial institutions as the latter are required to legally store the Aadhaar number as part of their full KYC process,” said a senior government official, requesting anonymity. Under the provisions of the Prevention of Money Laundering Act (PMLA), the government has mandated the linking of Aadhaar with all banking and financial instruments by March 31. The official said Aadhaar would be required for availing of government schemes such as subsidies for gas connections, pensions, scholarships, and subsidised ration. 

“Only for demographic authentication purposes such as getting a SIM card for mobile phones can the beneficiary choose between the 16-digit virtual identification (VID) number and the 12-digit Aadhaar. Both Aadhaar and VID will work in such cases,” the official added. 

THE NEW SYSTEM
 

*  A 16-digit virtual identification (VID) number for authentication instead of a 12-digit unique number 

*  The action followed media reports alleging a few Aadhaar User Agencies (AUAs), which are authorised to carry out authentication, for illegally misusing Aadhaar details

*  In the new system the AUAs would not be able to store Aadhaar number and data

*  Senior officials said new system would address privacy concerns to some extent
 

The UIDAI and its senior officials didn’t respond to Business Standard’s queries regarding the use of Aadhaar and VID. The government says that chances of a data leak by private AUAs are higher than those of government agencies.

The UIDAI has now decided to review the workings of all AUAs and their need for storing the Aadhaar data. This follows a newspaper report that highlighted the possible misuse of Aadhaar data and breach of privacy. The newspaper purchased Aadhaar data for Rs 500 from an agency that had worked previously with the UIDAI. The UIDAI will put AUAs into two categories – global AUAs and local AUAs. The global AUAs will have the right to store an individual Aadhaar in accordance with the requirements of law.
 

Currently there are around 300 AUAs, such as Bharti Airtel Limited, Airtel Payment Banks, All India Institute of Medical Sciences, Allahabad Bank, and Bajaj Finance Ltd, registered with the UIDAI. The new system is likely to kick in on March 1, but the user agencies would have time till June 1 to upgrade their system.
 

Nikhil Dey, one of the petitioners in the UIDAI case before the Supreme Court, said the new system introduced by the government was confusing. “How can the government expect 1.2 billion people to generate virtual identity numbers and use them in place of Aadhaar? Only a few people will go for it. The government has cleverly shifted the ball on privacy to individuals,” Dey said. The other petitioners in the UIDAI case are planning to protest the government move in the Supreme Court on March 16.
 

Sunil Abraham, executive director of the Centre for Internet and Society, said the introduction of VID was an insignificant step. “Privacy can be protected by design and not by choice. Here individuals have been asked to generate VIDs,” Abraham said.  

Another senior official who has worked closely with the UIDAI said the government might face legal hurdles regarding its new system. “The Aadhaar Act only mentions the use of the Aadhaar number not the VID. It can be easily challenged in court.” The official also feared that unscrupulous elements and shopkeepers would now start charging people anywhere between Rs 30 and Rs 200 for generating the VID. Union Minister Ravi Shankar Prasad, however, asked activists to not to overblow the issue of data breach.
 

“Travelling is your private affair. But everything is recorded if you take public transport like flights. What you eat is your personal choice, but if you eat in a restaurant it is recorded by a bill. Therefore, let us not overblow this issue of privacy,” he said.