From: Sharmila Bellur
AN ANALYSIS OF THE DRAFT BILL
INTRODUCTION
The Unique Identification Authority of India was constituted and notified by the Planning Commission on 28th January, 2009 as an attached office under the aegis of Planning Commission and the National Identification Authority of India Bill, 2010 (referred to as “the Bill” hereinafter), was circulated for public opinion in June. 2010. The Bill, concentrates predominantly on providing legal framework for the establishment of the National Identification Authority of India (referred to as Authority hereinafter) and lays down, in principle, the various functions of the Authority in the context of issuing unique identity numbers i.e., Aadhaar numbers to the residents of India and certain other persons[1]. The Aadhaar numbers can be verified and authenticated online through a setup mooted in the draft Bill and which is to be defined in toto in the Regulations appended to the Bill. The Aadhaar numbers are to be based on biometric information[2] and demographic information[3] of the individual. The entire endeavor is directed towards decreasing identity silos and establishing authentic identity, while evading identity duplication and identity theft.
A CONSPECTUS OF THE DRAFT BILL
The key contents of the Bill are:
Chapter I– defines inter alia Aadhaar number, Aadhaar number holder, authentication, biometric information, Central Identities Data Repository, demographic information, enrolling agency, Registrar and most pertinently, the term resident, in the context of obtaining identity, identity establishment and its authentication.
Chapter II– enunciates the process of collection of personal demographic and biometric information of an individual while providing for an explicit list of information not to be collected for this purpose and provides for the establishment of Central Identities Data Repository (CIDR). It lays down the characteristics and properties of the Aadhaar number and also provides for its periodic update.
Chapter III– lays down the statutory foundation of the National Identification Authority of India. It further makes provisions for the offices of the Chairman and Members of the Authority; and the myriad powers and functions of the Authority.
Chapter IV– makes provisions pertaining to appropriation, accounting, audit and annual reporting to the Central Government of the funds allocated to the Authority by the Parliament.
Chapter V– envisages the constitution of an independent Identity Review Committee for the appraisal of the working of the Authority and the usage of Aadhaar numbers.
Chapter VI– vests the responsibility for identity information of individuals including the information stored in the CIDR in the Authority. It provides for an individual’s access to one’s own information, alteration of such information by the individual and lays down two scenarios for compulsory disclosure if information, i.e., court orders and in the interest of national security.
Chapter VII– enumerates the various offenses in the context of false identity establishment, identity manipulation, disclosure of identity information, unauthorized collection of identity information, unauthorized access to the CIDR, tampering of the CIDR and identity theft; and the penalties for such offenses within the purview of the Bill.
Chapter VIII– excludes the Authority from the realms of taxation and litigation for acts done in good faith, while providing for scenarios in which the Central Government can supersede the Authority. It lays down the law pertaining to Rule-making by the Central Government and Regulations-making by the Authority, while providing for accountability of the Central Government and the Authority in this context, to the Parliament.
THE BASIC POSTULATES OF THE DRAFT BILL
Statutory Body: The NIDAI will be a statutory body created by an act of the Parliament. Consequently, it will be accountable to the Parliament and all its actions will be amenable to judicial review.
Facilitating access to benefits and services: The objective of the Bill states implicitly that issuance of Aadhaar numbers to individuals residing in India and to certain other classes of individuals is pertinent in warranting their access to benefits and services.
The Aadhaar number will only be proof of identity: The function of NIDAI would be to provide Aadhaar number [4]on receipt of the individual’s demographic and biometric information and authenticate the identity of the number-holder in the scenario the service provider demands possession of Aadhaar numbers and its authentication, as a pre-condition for rendering service. It only guarantees identity, not rights, benefits or entitlements. The NIDAI will thus be an interface between the Aadhaar number-holder and service provider.
Implementation: The details pertaining to the working of the Authority and the implementation of Aadhaar numbers is left to the realms of the Regulations[5], the formulation of which falls within the powers of the Authority itself.[6]
The term ‘Resident’: The definition of Resident[7] adopted in the Bill is not the same as the existing definitions in, inter alia, Section 6, the Income Tax Act, 1961 and Section 2 (v), Foreign Exchange Management Act, 2002 which defines the term in co-relation to the number of days a person has been continuously residing within the territory of India. The definition of the term resident is not akin that of the term “ordinarily resident” in Section 20 of the Representation of People’s Act, 1950.
Positive and negative list of the biometric and demographic information to be collected: The Bill expounds the various biometric and demographic information that the individuals seeking Aadhaar numbers has to disclose and expressly lays down a negative list of fields in which the Authority cannot collect information.[8] The purpose of the negative list is possibly to avoid the possibility of profiling individuals[9]
Authentication: The Bill contrives a Central Identities Data Repository for verification of identity on the basis of information, which maybe verbal, documentary and biometric in nature, provided by the individual who seeks authentication of identity. Therefore, while Section 2 (d) of the Bill creates a presumption of online authentication- a real time yes/no response to an authentication query, which will be a purely mechanical exercise based on verbal and biometric information, it also suggests the possibility of offline/physical authentication with the aid of documents.
Voluntary Enrollment in a partnership model: The Bill in Section 3(1) implicitly suggests that the issue of Aadhaar numbers will be voluntary. The Bill provides for enrolling agencies and registrars as independent agencies whose function would be to enroll residents.
CRITICAL ISSUES
Lack of clarity on voluntarily obtaining Aadhaar number: While the objective of the Bill states that the issuance of Aadhaar numbers will facilitate their access to benefits and services, Section 3(1) of the Bill suggests it is not mandatory for residents to obtain Aadhaar numbers. There’s an evident discrepancy between the object of the Bill and its contents. Moreover, there are no provisions in the Bill giving over-riding effect to the Bill over all other future legislation that make possession of Aadhaar number mandatory for availing benefits and services. Though the basic premise has been that obtaining Aadhaar number is voluntary, the Bill does not espouse a clear mandate on the issue.
Accountability of the Authority with respect to identity information: The role of the Authority is to only provide yes/no response to an authentication query which will be made on the basis of biometric information and the Aadhaar number of the individual, which he voluntarily discloses to third parties/service providers. The Authority is not accountable for infringement of privacy by third parties/service providers who seek Aadhaar numbers for providing. Thus, in spite of the vulnerability of identity information to misuse, the responsibility of the Authority assumes no responsibility for identity information only to the extent the information is communicated to and held by, the CIDR
Utility and implementation of Aadhaar number is not specified: The spectrum of usage of the Aadhaar numbers has not been laid down in the Bill. In spite of large sums of budgetary allocation[10], human resource allocation and promises to revolutionize the access to benefits and services, the Bill discloses very little on how the proposed objectives can be achieved.
Moreover, in the absence of a clear mandate, if all service providers require possession of Aadhaar numbers to acquire services, it will result in excessive surveillance and face opposition on the ground of evasion of privacy and civil liberties, as faced by the Access Cards[11] in Australia. The implementation of the Bill, in the absence of provisions initiating it, will be left to the discretion of service providers, who will have to render services subject to possession of Aadhaar numbers in order to compel individuals, who wish to avail their services to obtain Aadhaar numbers.
Unorthodox definition of the term resident: The definition adopted in Section 2 (q) accords wide scope to the Bill. However, it lacks clarity and the Bill circumvents taking of a firm stance on the inclusion of Indians residing abroad temporarily, Non-Resident Indians, Persons of Indian Origin and Refugees, under the garb of the Act.
No accountability for lapses on the part of the Registrars and Enrolling agencies: The Bill on the one hand creates the machinery for disclosure of personal information by individuals to the Registrars and Enrolling officers under the aegis of the Authority, but it makes no provision for accountability of the Authority for lapses on their part in performing the functions bestowed upon them. Therefore, though the Bill lays down the powers and functions of Registrars and Enrolling agencies as functionaries of the Authority, it does not hold the Authority accountable for privacy evasion, information disclosure or identity theft at the stage of enrollment.
Levy of fees: Sections 5 (1) and 23 (o) provide for levy of fees by the Authority, Registrars and Enrolling agencies for the services provided by them i.e., for issuing Aadhaar number and its authentication. This is an obvious conflict in a welfare oriented measure and may deter individuals from voluntarily acquiring Aadhaar numbers, as was the case with National Identity Card (NIC)[12] in Pakistan.
Identity data sharing: Section 23 (k) of the Bill is a blanket provision giving the Authority leverage to divulge identity information to agencies engaged in delivery of public benefits and public services in a manner prescribed in the Regulations, subject to written consent by the number-holder. This provision renders identity information susceptible to misuse and fraud.
Strains of dependence on technology: At the crux of the system of identity establishment and authentication provided for in the Bill, is technology. Even with a five-9 (99.999) efficiency in the system for authentication of Aadhaar numbers, the number of errors for a population of 1.2 billion who shall presumably come to hold Aadhaar numbers, is very high. Therefore, the system in place to authenticate identity of individuals, might deny service to Aadhaar number-holders due to faults inherent in it.
THE DRAFT BILL AND THE CONSTITUTION OF INDIA
Article 12, definition of State: The NIDAI is a statutory body and is under the control of the Central Government and hence falls within the purview of “State” as defined under Article 12 of the Constitution of India[13]. Consequently, the NIDAI will be subject to the limits of Fundamental Rights, which means that its actions and decisions can be challenged with reference to the Fundamental Right under the writ jurisdiction of the Supreme Court and the High Courts; and it will also be subject to the discipline of Administrative Law.
Article 14, Right to Equality: The Bill restricts the ambit of the Act to individuals usually residing within the territory of India and the meaning of the term “ordinarily residing” will be enunciated by the Authority in the Regulations. Therefore, the decision regarding the ambit of the Act will be a policy decision of the Authority through delegated legislation and the question as to whether this is violative of the fundamental right to equality of persons not “usually residing” in India, but who are entitled to the right to equality under the Constitution of India, cannot be raised in a court of law, unless the exclusion is found to be arbitrary and unreasonable.[14]
Article 19 (1) (a), Right to Freedom of Speech and Expression: The fundamental right to freedom of speech and expression includes the freedom of silence. [15] It may be stated that freedom of expression includes the right to not express. [16] Therefore, any provision making disclosure of identity information by individuals, mandatory, would stand in violation of Article 19 (1) (a).
Article 21: Right to Life: In R. Rajagopal v. State of Tamil Nadu[17], the Supreme Court held that the right to privacy is implicit in the right to life and personal liberty. The “right to privacy” means a “right to be left alone”. None can publish anything concerning a person, his family, marriage, procreation, motherhood, child bearing and education among other matters without his consent. If he does so, he would be violating the right to privacy of the person concerned and would be liable in an action for damages. It is relevant to note here that the Bill does not provide for compensation to individuals for infringement of their privacy at the hands of the Authority.
The Bill provides for collection of demographic and biometric information of residents, authentication of the identity of such persons and linking of various services requiring authentication of identity to the UIDAI while laying down provisions for confidentiality of resident information and protection of the privacy of the resident. The question of law is whether such acts are violative of Article 21 or within the ambit of exceptions to right to privacy. Pertinent here are the exceptions to the Right to Privacy laid down by the Supreme Court, according to which any publication concerning a person’s right to privacy is unobjectionable if it is based upon public records [18] and the right to privacy is subservient to security of the State. [19]
[1] Preamble, The National Identification Authority Bill, 2010
[2]§ 2 (e), The National Identification Authority of India Bill, 2010
[3] § 2 (h),The National Identification Authority of India Bill, 2010
[4] a random 12-digit number bearing no attributes or identity data relating to the Aadhaar number-holder
[5] See § 9, 10, 18 (1), 20 (3), 23, 30, 31, 32, 54, The National Identification Authority of India Bill of 2010
[6] This is akin United Kingdom’s Identity Cards Act, 2006 which created the legal framework for the introduction of identity cards, but the detailed arrangements regarding the information on the card, application for an identity card or the fee to be charged and the data sharing provisions were left to the purview of secondary legislation. The Identity Documents Bill, 2010-11 which seeks to repeal the Identity Cards Act, 2006 and the subsequent secondary legislation in order to restore freedom and civil liberties; and save the tax payers around £86 million over the next four years, is now before the British Parliament.
[7] § 2 (q),The National Identification Authority of India Bill of 2010
[8]§ 9, The National Identification Authority of India Bill of 2010
[9] It refers to unauthorized/illegitimate use of information for causing hardships to individuals, on the basis of his race, religion, caste, tribe, ethnicity, language, income or health.
[10] Rs. 1900 crores was assigned to the UIDAI in the Union Budget 2010-11
[11] The Access Card is a non-compulsory health and social services access card which would have required Australians to present the smart card anytime they dealt with certain federal departments, including Medicare, Centrelink, the Child Support Agency, or Veterans’ Affairs.
[12] Obtaining NIC cost Rs. 100 and this inevitably reduced the number of people who could afford it and so, in June 2008, the federal government announced it would start issuing Computerized National Identity Cards for free.
[13] Pradeep Kumar Biswas v. Indian Institute of Chemical Biology (2002) 5 SCC 1857
[14] Maharashtra S.B.S. & H. S. Education v. P.B. Kumarseth AIR 1984 SC 154
[15] Bijoe Emmanuel v. State of Kerala AIR 1987 SC 748
[16] National Bank of Canada v. R.C.U (1984) 1 SCR 269
[17] AIR 1995 SC 264
[18] R. Rajagopal v. State of Tamil Nadu AIR 1995 SC 264
[19] Sharda v. Dharmpal AIR 2003 SC 3450
as raised in your article, the question of violation of the fundamental right to equality of persons not”usually residing” in India, but who are entitled to the right to equality under the constitution of India, will not be risen. Because, Proviso to Section 3(1)takes care of other residents, which says that the Central Government may, from time to time, notify such other category
of individuals who may be entitled to obtain an aadhaar number.
Indian manner that Identifies citizens is not liable to remain forever! A much simpler manner that truly helps citizens of whole world will come up soon. It will make Indian manner worthless. A new cycle started as NATIONAL IDENTIFICATION AUTHORITY OF INDIA can work in a reverse order, by each citizen claiming his/her own uid number. How to do it? A BPL citizen shall not get his ration card without a UID number, ‘No passport’ without a uid number, no driving license without a uid number, no bank account without a uid number…and so on ‘a government’ can easily make uid ‘a citizen need’! Economics of ‘a government need to uid’ or a citizen need to uid differs. Uid is not once ‘allocating uid’ to 120 million citizens and leave it alone. It will have to go on forever, means ever-changing! To make ‘uid’ a citizen-need, Government needs ‘a parliament approval’.