Auditing Aadhaar

Need open deliberation on systems to avoid misuse

Now that a law is being put in place to validate the Aadhaar programme, the focus must shift to the rules which will be framed under it to work the system. It has to be ensured that these rules reflect the spirit and content of the new law. In scrutinising the rules, three primary issues will have to be kept in mind. One is the assurances given to protect the privacy of individuals, so that data relating to their identity are not misused or fall into the wrong hands. The Aadhaar authority will obtain individuals' consent for sharing the data while carrying out fresh registration. It is interesting to speculate if an individual can give consent for her identity data to be shared with ministries distributing subsidies for things like food and kerosene, but not the home ministry whose job it is to identify potential security threats. Further, can the Aadhaar authorities tell a ministry that it can use the data itself but not pass them on to another ministry? As is clear from what the head of Aadhaar has told this newspaper, a suitable mechanism for auditing the operations of Aadhaar to track when and for what purpose its data are shared with others is necessary. This should not be seen as paranoia, but as trying to make sure that when a new system is being set up, it is done the right way.

The second issue is authentication. For Aadhaar to succeed in transferring benefits to the deserving poor, the primary concern must be to ensure that people who are illiterate and in far-flung areas should not be left out because they are unable to participate in a technical process. What happens when there is no electricity or internet connectivity in a truly remote area? Currently a ration shop owner in such a place can look at a ration card and deliver. But what happens when authentication via Aadhaar fails because of lack of connectivity? The head of Aadhaar has told this newspaper that a technology option that can be examined is the use of a "one-time password" received over a cellphone (the national network coverage is now extensive). This very usefully takes forward meeting the authentication challenge for all. Then, of course, there is the physical Aadhaar card which should be useful in case all else fails in ensuring authentication. Today's technology frontier offers one other option. If a Wi-Fi network covers the entire country, then using a data connection to secure authentication will not be a hurdle anywhere.

The third issue to sort out is about the Aadhaar authorities getting paid for the use of the process or data by private players. Microfinance organisations, for example, prefer to lend only to people with two identifications, one of them being Aadhaar. Can an individual ask for a share of the revenue that Aadhaar earns by allowing use of her individual data? Even more interestingly, can the Aadhaar authorities charge a fee from private developers of apps which seek to extract value from the Aadhaar data base? These open questions must be deliberated upon openly and transparently by the authorities concerned even as the operational details for implementing Aadhaar under a new legislative framework are finalised.