SC verdict on Aadhaar may lead to overhaul of identity law, say experts

The majority judgment in the Aadhaar case referred to the importance of having a strong data protection regime multiple times

After the Supreme Court delivered a majority verdict reaffirming Aadhaar’s constitutionality in a judgement spawning more than 500 pages, experts suggest that the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, will go through an overhaul to be in line with the court’s directions. 

The apex court struck down certain sections of the Act, read down some others and suggested amendments to a few more in the judgment, which, experts say, is likely to result in a comprehensive privacy and rights-based overhaul of the Aadhaar Act.

“To withstand further challenges to its constitutionality, the Act should be suitably modified to include safeguards suggested by the judgment,” said Tejas Karia, partner, Shardul Amarchand Mangaldas & Co.

Karia said that the new Act will have to be in line with the data protection law, which is under the works too. Justice B N Srikrishna, who submitted the draft Personal Data Protection Bill to the government in July, laid down provisions for having an independent data regulator and curbing data leaks by imposing heavy fines and penalties on errant bodies.

The majority judgement multiple times referred to the importance of having a strong data protection regime.

In terms of substantive changes to the Aadhaar Act, the Supreme Court read down Section 33 (1), which prohibited disclosure of information, except when it is by an order of the court not inferior to that of a district judge. 

“This Section has been read down by clarifying that an individual, whose information is sought, shall be afforded an opportunity of hearing. The person also has the right to approach the higher court against such an order,” said Ganesh Chandru, executive partner, Lakshmikumaran & Sridharan.

Chandru added the apex court has struck down Section 33 (2) of the Aadhaar Act, which provides for disclosure of information and authentication records under the direction of an officer not below the rank of a joint secretary in the interest of national security.

Furthermore, the court took complaints of data privacy seriously and read down Regulation 27 (1) of the Aadhaar (Authentication) Regulations, 2016, which permitted the storage of authentication records for five years. 

“This has been held as being bad in law. Authentication records cannot be kept beyond a period of six months,” said Karia. 

In addition to authentication logs, the Supreme Court's majority Bench also stated that metadata related to authentication transactions cannot be held as permitted under Regulation 26(1) of the Authentication Regulations, which is likely to result in another amendment.

Karia also explained the importance of the suggested amendment to Section 47 of the Act that allows only the Unique Identification Authority of India (UIDAI) to file a complaint in the court on any offence under the Aadhaar Act.

“For Section 47 of the Act, it has been stated that the same needs a suitable amendment to include the provision for filing of such a complaint by an individual/victim as well whose right is violated,” he said.

Meanwhile, Rahul Matthan, Partner, Trilegal, said the court has sought to further secure the system by striking down parts of Section 57 of the Aadhaar Act as unconstitutional. The court disallowed private companies from accessing Aadhaar authentication simply by a bilateral contract and said that any use of Aadhaar by a body has to have the backing of the law.

“By removing access of the private sector to the Aadhaar infrastructure, they have limited the access to only the government entities. This means that KYC user agencies, which are largely manned by the private sector, will need to be shut down. There are fewer points of attack from a network architecture perspective,” Matthan said.

He, however, offered a counter view on the elimination of the private sector from the ecosystem, claiming that now everyone is dependent on the government to ensure security.  “We are now relying on the government fully to keep it secure. If the private sector was actually involved, as and when new APIs were released, the private sector could actually see the vulnerabilities and raise the flag in time,” he stated.

On the issue of illegal immigrants, Gowree Gokhale, partner, Nishith Desai Associates, noted that the apex court recommended suitable measures for ensuring that they do not take the benefits given to Indian residents under Section 2(b) of the Act.

Summing up, Chandru said that the new Act will seek to strike a balance between the right to privacy of citizens and a welfare state. “However, if Parliament decides to come up with a new legislation to overcome certain parts of the judgment, any such move will likely be hotly contested. Even if enacted, the law will be subject to judicial scrutiny,” he added.