Draft data-protection bill proposes offline verification for Aadhaar; strengthens UIDAI and weakens RTI provisions
Nearly a year ago, the government of India constituted a committee of experts chaired by the former Supreme Court judge BN Srikrishna to draft a data-protection law for India. Almost immediately, the committee became mired in controversy—it was first criticised for the lack of civil-society representatives among its members, and subsequently for the opacity of its proceedings, and its inefficient public consultation on the data-protection framework. In recent months, the media has repeatedly, and inaccurately, predicted the release of the bill. While the Srikrishna committee is yet to officially release it, The Caravan accessed a draft of the proposed law for data protection in India, titled “The Protection of Personal Data Bill, 2018.”
The draft bill is an extensive document comprising 15 chapters, covering data-protection obligations, the separate grounds applicable for processing personal and sensitive data, provisions to govern transfer of data outside India, and the creation of a data-protection authority. The final chapter of the proposed bill includes amending acts to two central legislations—the Aadhaar Act of 2016 and the Right to Information Act of 2005. These amendments are significant—the amendments to the RTI act could upend the fragile balance between transparency and privacy in the exemption for personal information, allowing public officials to withhold details, making them less accountable. Meanwhile, the proposed amendments to the Aadhaar act would create a new adjudication process for disputes arising out of the act that strengthens the UIDAI’s iron grip over Aadhaar-related legal action. The amendments further propose an “offline verification” system that raises more questions than it answers.
Soon after the constitution of the Srikrishna committee, the Supreme Court delivered a landmark judgment declaring that privacy is a fundamental right. In its aftermath, there was a prevailing fear among experts and activists that the verdict would adversely affect the disclosure of information under the RTI act. This has only increased in anticipation of the data-protection bill and the subsequent law.
At present, the RTI act accounts for the right to privacy under Section 8(1)(j), which notes that “information which relates to personal information ... which has no relation to any public activity or interest” is exempt from disclosure unless the “larger public interest justifies the disclosure of such information.” This section has been routinely invoked by information officers to deny RTI requests, particularly those pertaining to the functioning of public officials, such as the case of the RTI applications seeking the prime minister Narendra Modi’s college degree. As a result, RTI activists have demanded clear definitions of key terms such as “public interest” and “public activity.” The draft bill proposed by the Srikrishna committee, however, seeks to take a diametrically opposite position to the current act, by doing away with Section 8(1)(j) altogether.
In its place, the new provision puts an exponentially higher burden for disclosure of personal information under the act. The proposed provision in the bill requires three conditions to be fulfilled before any personal data is disclosed:
(a) the personal data relates to a function, action or any other activity of the public authority in which transparency is required to be maintained having regard to larger public interest in the accountability of the working of the public authority;
(b) if such disclosure is necessary to achieve the object of transparency referred to in clause (a); and
(c) any harm likely to be caused to data principal by the disclosure is outweighed by the interest of the citizen in obtaining such personal data having regard to the object of transparency referred to in clause (a).
As it presently stands, the RTI Act seems to treat transparency and disclosure as underlying principles, and views exemptions for personal information as exceptions. But the strict requirements under the proposed amendments tip the balance against disclosure, and are likely to have the effect of protecting public officials from having to disclose any remotely personal information. In its enthusiasm to raise the standards of data protection in India, the Srikrishna committee appears to have failed in its obligation to account for the competing rights of public accountability.
Apart from the RTI Act, the draft data-protection bill accessed by The Caravan also introduces amendments to the Aadhaar Act. The noteworthy amendments can be broadly classified into three categories—establishing a new adjudication and appeals process for disputes arising from the act, increasing or creating civil and criminal penalties for contraventions of the act, and introducing an offline verification system for Aadhaar authentication. In all three cases, while the amendments appear to respond to prevailing criticisms of the functioning of the Aadhaar programme, they either fail to address these issues—in some cases, even duplicating problematic processes—or raise significant questions about their implementation.
One set of amendments seeks to introduce a new position of an adjudicating officer, not below the rank of a joint secretary to the union government, with the power to inquire into any contravention of the Aadhaar Act. In this regard, it proposes the addition of a new chapter on civil penalties, under which any such violation could invite a penalty of upto Rs 1 crore. It further designates the Telecom Disputes Settlement and Appellate Tribunal as the appellate body for any appeal against an order of the adjudicating authority, and notes that appeals from the tribunal would be heard by the Supreme Court.
Over and over again in the past year, the Aadhaar programme has suffered leaks and data breaches, with government agencies allowing unsecured access to Aadhaar details and sensitive personal information, such as financial, caste and religious identifiers, on public websites. In January this year, The Tribune reportedthe largest breach so far: one of its reporters gained access to a portal with the data of every Aadhaar card holder by paying a middleman a paltry sum of Rs 500.
Ostensibly, in an attempt to respond to these developments, the proposed amendments introduce a range of civil and criminal consequences. These include penalties for the failure to seek the consent of an individual before obtaining their identity information, the unauthorised use of biometric information and the unauthorised publication of an Aadhaar number or photograph. These provisions would have held considerably more weight if not for one fundamental shortcoming—the bill states that only the Unique Identification Authority of India, or UIDAI, would be empowered to make a complaint to the adjudicating authority.
The UIDAI is the parent agency for Aadhaar, and currently retains monopoly over criminal proceedings arising out of the act, which empowers a court to only take cognisance of an offence upon a complaint by the agency itself. The criticism against the misuse of this provision abounds—for both the UIDAI’s dogged pursuit of legal action against reports identifying grave breaches of Aadhaar data, and its failure to identify and prevent these breaches themselves. The exclusive power to initiate criminal proceedings for any violation of the act, as proposed under the draft data-protection bill, would only serve to reinforce the UIDAI’s control over legal action arising from the Aadhaar Act.
To seal this monopoly, the proposed amendments also seek to bar the jurisdiction of any civil court over cases arising out of the act—simply put, only the UIDAI can initiate cases, and only the adjudicating authority can pursue them. It is truly unfortunate that the Srikrishna committee appears to have used its mandate to formulate India’s foremost law on privacy and the protection of sensitive personal data as an opportunity to further insulate the UIDAI and the Aadhaar programme from unwanted legal challenge.
The third category of amendments to the Aadhaar Act are conspicuous because they seek to alter the infrastructure underlying Aadhaar verification through an opaque new system that has not seen any prior public consultation. The draft data-protection bill proposes a series of amendments that would create a new system of offline verification of an Aadhaar number. The amendments fail to describe what offline verification would comprise, but indicate what it would not.
It is evident from the draft bill that the proposed offline verification will not be a process of authentication. Under the Aadhaar Act, authentication is the process in which an authorised body seeking Aadhaar verification—which is called the “requesting entity”—seeks a real-time query with the Central Identities Data Repository, or CIDR, the central Aadhaar database maintained by the UIDAI. The draft data-protection bill is also categorical in stating that an offline verification-seeking entity, or OVSE, shall not “subject an Aadhaar number holder to authentication” or “collect, use or store an Aadhaar number or biometric information of any individual for any purpose.”
The draft bill appears to set limits on entities that are able to perform Aadhaar authentication, by introducing a requirement that authentication is conducted only when “mandated pursuant to law made by Parliament,” or when it is “required by a public authority for performing a public function.” The bill does not envision any such restriction for offline verifications. It does, however, require an OVSE to obtain the consent of an individual before verifying her offline. Moreover, the bill states, the OVSE must inform the individual about the nature of information shared during offline verification, the uses to which such information may be put, and any alternative ways to submit this information. Ironically, the bill does not clarify what any of these—the information, the uses, or the alternative ways—might comprise.
On the surface, the offline verification system appears promising because it addresses certain problems plaguing the Aadhaar programme—including the hurdles of implementation due to change in biometric details or poor internet connectivity, the authentication of Aadhaar by private entities and the centralisation of authentication records with the UIDAI. But the draft bill provides no information on the infrastructure or processes underlying this system, which raises troubling questions about how offline verifications would operate in practice.
For instance, if there is no authentication with the CIDR, against what database is the identity of an Aadhaar card holder purportedly verified? More importantly, would every OVSE have access to this database? The proposed amendments define an OVSE as “any entity desirous of undertaking offline verification.” While this definition is similar to that of a requesting entity under the Aadhaar Act, a requesting entity does not officially gain access to any Aadhaar data, since it is verified online with the central database at the CIDR. But will the offline verification system introduce the decentralisation of Aadhaar data? If so, how would it seek to prevent potential security breaches, if any entity may seek offline verification? The draft bill also fails to clarify whether offline verification will be treated as a measure of last resort—in case an individual is able to provide the information through an alternative manner—or if an OVSE can insist on offline verification. The most critical omission, perhaps, is the nature of the relationship and exchange of information between an OVSE and the UIDAI. After an offline verification of Aadhaar is complete, will an OVSE relay all its transaction information to the UIDAI?
The answers to these questions are crucial to understanding the offline verification process in the context of the ongoing national discourse on privacy and data protection. While the Srikrishna committee and the UIDAI appear not to have provided any answers, one possibility can be inferred from a scrambled collection of media reports and information available on the UIDAI website. It appears likely that the offline-verification system will rely on QR code scanning of e-Aadhaar or Aadhaar letters.
In April this year, media reports noted that the UIDAI was introducing QR codes on e-Aadhaar that would contain photographs of the Aadhaar card holder, to facilitate offline verification. None of the reports identified the procedure through which this verification would take place offline.
The following month, the UIDAI issued a tender seeking an “Expression of Interest (EoI) for participating in ‘QR Code Scanner for Aadhaar.’” The tender noted, “To enable offline verification of Aadhaar data, UIDAI has introduced 2D QR code printed on Aadhaar letters.” It further stated, “By scanning the QR code printed on E-Aadhaar/Aadhaar letters, photograph and other demographic details of the Aadhaar holder will be displayed along with the sign indicating whether it is digitally verified by UIDAI or not.” It is also interesting to note that in the section on requirements for the tender, under the heading “Security Concerns,” the tender noted that the QR code scanner “must not store any data in any internal memory or with any memory chip installed in it.”
Thus, the question remains: where is the data of the Aadhaar card holders stored for the offline verification to work? The tender noted that the code could be verified with the help of a “QR Code Reader application.” This application is available for download on the UIDAI’s website, under the page on authentication devices. After installation, the application requires a user to upload a “secure QR code of e-Aadhaar ... scanned using the physical scanner in line with UIDAI specifications.” It further notes, “The application will display the demographic details of resident once the QR Code of e-Aadhaar is digitally verified by UIDAI at backend and give scan QR Code verified.”
However, it is still unclear how the offline verification would take place, and the location of the Aadhaar database for such verification. It seems unlikely that the application contains the Aadhaar database, not least because the setup to install the application is a mere 11-megabyte file. Regardless, the QR Code Reader application is possibly a component of the offline-verification process, which in itself raises questions over the security of the offline-verification system. According to the UIDAI’s web page on the application, “Anyone, whether a Aadhaar Holder or an User/Service Agencies like Banks, AUAs, KUAs etc can use this facility for offline verification of the data in Aadhaar or e-Aadhaar.”
This is the first in a series of pieces by The Caravan on the Srikrishna committee’s data-protection bill.