Concerned about data security? Wait till March for linking Aadhaar

Virtual ID and limited KYC will address your concerns over data leakage

Your privacy and security concerns about the Aadhaar number are set to go away, with the Unique Identification Authority of India (UIDAI) introducing a virtual ID and limited know-your-customer (KYC). The virtual ID will be a temporary, revocable 16-digit random number mapped with the Aadhaar number. It will not be possible to derive the Aadhaar number from the virtual ID. Another important part of this move is that a user can generate as many virtual IDs as he or she wants.

The older ID gets automatically cancelled once a fresh one is generated. It’s a major change, especially since you can now change your number and don't have to actually give it to anyone. UIDAI plans to launch this by March.

Says Sivarama Krishnan, partner and leader-cybersecurity, PwC India, “This is based on tokenisation technology. The individual needs to visit the institution, say a bank, with his Aadhaar. The institution will do the biometric. Instead of the real Aadhaar number getting stored in the systems of the institution, it will be a virtual number that will get stored. So, if a third-party database is compromised, the real Aadhaar number won’t be leaked. Each institution will be assigned a different unique ID.”

Experts say a lot of people who are unwilling to share their Aadhaar details with banks and mobile companies can wait till March. Says Pavan Duggal, a Supreme Court lawyer and cyber law expert: “While it shows the UIDAI is proactive about protecting the identity of individuals, we will still need to wait and watch how this pans out. We need to see the level of access and security that is given to virtual identity. The government may also need to amend the Aadhaar Act as it is not part of it.”

In recent times, there have been a number of distressing reports on the 12-digit biometric ID – Aadhaar. There are reports about data leak and people being denied rations or policyholders being denied cashless approval as they haven’t enrolled themselves with the Unique Identification Authority of India (UIDAI) even though the government has extended the deadline for mandatory linking to March 31. And of course, there are banks and mobile companies who are constantly mailing you to link you Aadhaar number. 

Last week, there were media reports that an insurance company told the family of a policyholder that they could not avail cashless treatment as she did not have an Aadhaar. Says R Chandrasekaran, secretary general, General Insurance Council: “Insurers are following guidelines issued by the regulator to get the Aadhaar details. Having said that, claims process will not stop if insured/claimants don’t have Aadhaar number. The processing of the claims would not be withheld; however the claims amount would be directly credited to the bank account of the policyholder/claimants.”

Activists and lawyers, however, say there is no compulsion to submit Aadhaar for availing services. “Some companies see an opportunity in the present climate to collect data; and, if data is indeed the new oil, that could mean business and profits. For some others, the government's threat that not collecting unique identity number (UID) will be seen as disobedience of government expectations — it is no longer even necessary for there to be an order or direction — is quite enough. Many others are blindly doing what seems to be the order of the day. The one thing that is clear is that it is the government, and not the law, that seems to matter with the companies,” says Usha Ramanathan, an independent law researcher.

While anti-Aadhaar activists and companies have been consistently clashing over the interpretation of previous Supreme Court decisions till now, the government seems to be coming out with a middle road.

Some relief

— Lawyers say  there is no compulsion to submit Aadhaar for availing services

— The government has extended the Aadhaar linkage deadline to March 31 

— The Supreme Court is hearing the Aadhaar case 

— UIDAI plans to introduce a 16-digit virtual ID for limited KYC