Taking legal views on voluntary use of Aadhaar: UIDAI's Ajay Bhushan Pandey

The SC judgment has clearly held that Aadhaar is constitutional and it does not tend to create a surveillance infrastructure, says UIDAI CEO

A day after the Supreme Court verdict, the Unique Identification Authority of India (UIDAI) was seeking legal opinion on whether authentication could be done for those who voluntarily gave their Aadhaar numbers to firms. Ajay Bhushan Pandey, CEO of UIDAI, spoke to Kiran Rathee about the way forward and how the verdict would impact the Authority. Edited excerpts: 

Section 57 of the Aadhaar Act has been struck down by the Supreme Court. How will the UIDAI address deletion of data and how much time and cost will it involve?

The Supreme Court's majority judgment held a part of Section 57 unconstitutional. If Aadhaar is used pursuant to a contract by a private body and which is not backed by a law, then such use is held unconstitutional. Mandatory use of Aadhaar according to the Prevention of Money Laundering (PML) rules for opening bank accounts or maintaining them has also been struck down. Similarly, the requirement of Aadhaar for telecom connections has been stuck down as well. So as of today this majority judgment is the law of the land and the UIDAI will have to follow that. To the question on whether a person can voluntarily use Aadhaar for either opening a bank account or getting a SIM card, we are taking legal advice and based on the advice, appropriate directions will be issued. It is estimated that there are 400-500 million people who will only have the Aadhaar card and perhaps no other ID document which will entitle them to get a SIM card or open a bank account.

What will happen to the past Aadhaar data which has been used by various companies? Can that be deleted? 

Aadhaar authentication has been happening for the last six years. Now whether the past data which was used for providing services can be deleted is a question which has to be carefully examined. If the authentication happened in accordance with the contract between the two parties (company and individual) and based on that contract if the UIDAI provided the KYC data, now if the person requests the concerned company to delete the data, as per the SC verdict, the matter is between the company and the individual and the two parties mutually should take appropriate action in accordance with the directions of the court.

In case the metadata is deleted and UIDAI requires it (for say grievance redressal), won’t that pose a challenge?

First of all, UIDAI does not require any such metadata. Once the KYC information has been provided to the concerned organisation and based on that the company has given a service to a person, then it is between those two entities and they will have to take a decision as per the SC judgment. As far as UIDAI is concerned, the Authority will have absolutely no objection if the data is deleted by the company as per the request of the individual whose KYC information was obtained from the UIDAI by the company with his consent.

Will the UIDAI ask these companies to delete the Aadhaar data?

We have to see as to what extent UIDAI can intervene in a bilateral matter. We gave the e-KYC data based on the requests of the company which was authorised by the individual. If the individual now wants his data deleted, it has to be decided mutually by the two parties in accordance with their contract and the SC judgment.

In this scenario, what will be the future of virtual ID?

Virtual ID is a protection available to every Aadhaar holder because even after the SC judgment, use of Aadhaar will continue for subsidies, welfare programmes and also for the PAN card and income tax returns. Virtual ID, which masks the Aadhaar number, is an independent security and privacy measure which can be used even for the subsidy schemes or for any other purpose which is backed by law.

Will the fintech model as well as companies in telecom and banking suffer after the judgment?

The SC has said Aadhaar authentication can happen only if the use is backed by law. Unless a law is brought by the legislature, Aadhaar authentication facility will not be available for that service. Whichever sector is able to convince the legislature to bring a law and if the law meets the requirement of legitimate state aim and proportionality, that sector will be permitted to use Aadhaar authentication. So far as the UIDAI is concerned, it will be complying with the orders of the Supreme Court. 

Can you share the details about the work done so far in the UIDAI for Aadhaar and the costs incurred on it?

The total number of Aadhaar that we have given out is about 1.22 billion during the last eight years. The total amount of money that we have spent is in the range of Rs 100 billion. So if you consider the cost of an Aadhaar card, it comes to slightly more than a dollar. 

What is the overall mood at UIDAI after the SC judgment?

This judgement is indeed historic and landmark. It has given great strength to Aadhaar. The SC judgment has clearly held that Aadhaar is constitutional and it does not tend to create a surveillance infrastructure. It does not infringe the privacy. There is a good balancing which is available in the Aadhaar Act itself. The judgment also said that Aadhaar meets the concept of limited government, good governance and constitutional trust. On the other hand, the SC has said it ensures the dignity of marginalised sections and also empowers them. The mandatory use of Aadhaar for benefit schemes has also been upheld. Also for PAN card and income tax returns, Aadhaar will be mandatory as per the verdict, which will go a long way in ensuring better tax compliance, curbing tax evasion, money laundering, black money and benami transactions.

Is there a sense of setback because of the caveat?

See, no scheme is cast in stone. There is always a scope as well as requirement for continuous improvement and balancing because at one point of time what may appear balanced, it may require rebalancing at a later date on account of change in circumstances. The SC has struck a balance between the legitimate aims of a state and privacy and proportionality and has held Aadhaar to be constitutional. 

What are your views on NPCI? How will micro payments work without Aadhaar?

Each individual sector has to be studied. What we do in the UIDAI is authentication. How exactly they are going to use Aadhaar to carry out their own business function is the exclusive domain of that organisation. Each user organisation will have to study the judgment and has to take its own decision as to how they will carry out their operations with or without Aadhaar. So far as the UIDAI is concerned, the Authority is going to look at its system and ensure that Aadhaar authentication is permissible only for the uses backed by law.

What’s the way forward for the UIDAI?

SC has also laid down certain safeguards like the deletion of authentication logs after six months. Similarly, there are several other directions which will further strengthen Aadhaar. Those directions will have to be implemented. SC has permitted use of Aadhaar in welfare schemes, income tax returns and PAN cards. These uses will have to be provided authentication facilities. The UIDAI will also have to provide and maintain Aadhaar enrollment and update facilities at convenient places across the country so that people can avail the services.