SC's Aadhaar verdict opens UIDAI-licensed entities to legal suits

Now citizens can citizens can file criminal complaints against the UIDAI and its licensed entities, if a suitable amendment is effected by Parliament

In its verdict on Wednesday, the Supreme Court (SC) scrapped Section 47 of the Aadhaar Act, which means individual Aadhaar cardholders or citizens can file criminal complaints against the Unique Identification Authority of India (UIDAI) and its licensed entities, if a suitable amendment is effected by Parliament, say legal experts.

Section 47 of the Aadhaar Act stated that only the UIDAI or a person/officer authorised by it could register and file criminal complaints against individuals and companies for offences.
 

“This was a contentious part, as people were worried how they could get legal recourse for breaches of Aadhaar security, especially when the UIDAI was unwilling to accept that data breaches are a reality. You can look at the Airtel Payments Bank scam where bank accounts were created for people without their knowledge. This was a subversion of the principle of natural justice,” says Raghu Godavar, member of advocacy group RethinkAadhaar.

In its order, the court held: “There could be several circumstances where UIDAI itself or some third-party is guilty of having committed offences under the Act. By restricting the initiation of the criminal process, the Aadhaar Act renders the penal machinery ineffective and sterile.”

Ajay Kumar, Associate at MZM Legal, said: “Now that Section 47 is struck down, any person who is aggrieved can file a criminal complaint and set the legal machinery in motion.  Under the earlier situation, only the authority could decide whom to prosecute. The law now empowers citizens to seek punishment of those who violate their right to privacy by misusing data.”

Petitioners to the case had argued that since personal and biometric information collected and stored by the UIDAI in the Central Identities Data Repository (CIDR) is the property of the individual, this clause in the Act violated the individuals’ right to judicial intervention.

There are various offences listed in the Act, under which the UIDAI could file criminal complaints and take cognisable action against individuals and companies. These include unauthorised access to CIDR, impersonation of an Aadhaar holder, unlawful or non-consensual disclosure and transmission of Aadhaar details, mis-use of information in the CIDR, and theft of identity information, amongst others.

Further, Section 43 also makes companies and their management liable for offences committed under the Aadhaar Act.

This means that firms can be taken to court if individuals or a group of individuals find clear violations of personal or biometric data by employees or the company itself. 

“If a complaint is made against a company, then the person in the firm who is responsible for that matter will be prosecuted, along with the company itself. A lot of these prosecutions end up becoming slow because law enforcement and prosecutors lack the necessary training to prosecute these complicated offences. We will need to upgrade the law enforcement agencies to investigate offences under the Aadhaar Act,” Kumar said.

Just this week, the Aadhaar details of over 8.9 million MNREGA beneficiaries were made public on a website-portal run by the Andhra Pradesh government. In another report, the Commisionerate of College Education in Andhra Pradesh leaked personal details and Aadhaar numbers of over 64,000 past and present students, including their caste details.

"People, whose sensitive information has been leaked by state agencies or companies having license from the UIDAI to access the Aadhaar database, can file suits, collectively or individually. Now that the Supreme Court has stuck down Section 47, they can also file criminal complaints today under the Aadhaar Act and the Information and Technology Act. Thereafter, if the case is not properly investigated or prosecuted, they can approach the High courts or the Supreme Court with a writ petition to constitute a Special Investigation Team with a court-appointed public prosecutor," said senior lawyer Murali Neelakantan.  

Business Standard sent queries to UIDAI and its CEO seeking details of how many criminal complaints have been registered by the authority against these blacklisted entities. The agency is yet to respond.

While many hail the SC’s decision as a move in the right direction, legal experts say that individuals are, at the moment, restricted from filing First-Information-Reports with the police against the UIDAI or licensed entities.

“The SC order says there needs to be a ‘suitable amendment to include the provision for filing of such a complaint by an individual/victim as well whose right is violated’. This means the Parliament needs to enact a law that says individuals have the right to file a complaint,” said a spokesperson from the Software Freedom Law Centre, based in New Delhi.