Introducing virtual identities appears to be a attractive concept, except the details of its technicalities and cyber security parameters are not fully visible in the circular. Further, the timing at which this so-called virtual identity concept is being sought to be introduced by June 1, 2018, is a suspect. It is like a person whose body has been exposed to radiation is post-radiation exposure given a shirt to wear, thinking that a shirt will help protect the body. But then the exposure has already taken place.



This virtual identity concept, first and foremost, is a voluntary concept. They have not made it mandatory. You are trying to create two set of classes in the Aadhaar ecosystem. One, of those people who are comfortable with virtually negligible levels of security and the other ones who may be more sensitive to their privacy and security. So, there are going to be huge practical challenges as we go forward in now implementing this midstream.

There are other practical challenges as well. First and foremost, the notification has been issued under the Aadhaar Act, 2016. It further seeks to introduce a concept which goes beyond the ambit and parameters of the Aadhaar Act. The circular doesn’t even stipulate as to under what sections has it been issued.

The UIDAI has been given the power to come up with various directions under Section 53 of Aadhaar Act. But the circular doesn’t amount to a rule. Under Section 54 of Aadhaar Act, the UIDAI can introduce regulations. But this is also not a regulation. Obviously, regulations are made with the intention of carrying out the provisions of the Act. It goes a level below the regulation, as per the Aadhaar Act.

Further, the said circular runs contra to the provisions of the Act. Because under the Aadhaar Act, the government specified

A perusal of the Aadhaar Act shows that the Parliament never envisaged any concept of a virtual identity whatsoever. Now, introducing such a concept tantamounts to fundamentally changing the basis of Aadhaar. Therefore, this circular is likely to be potentially challenged in the court, inter alia among others, on the ground that the circular goes beyond the ambit of the Aadhaar Act.

Authentication of Aadhaar numbers can only be done under Section 8 of the Aadhaar Act. As per the legislation, introducing virtual identities in lieu of Aadhaar numbers is not permissible. The UIDAI cannot overreach the provisions of the Aadhaar Act through the circular. Aadhaar users also have this option of not sharing their Aadhaar numbers. But when I look at the detailed provisions as to how this exercise would be carried out, I don’t see any cybersecurity measures being applied, which otherwise should have been an integral part of the architecture.

How will virtual identities end up protecting the data privacy as well as personal details of a person are things that aren’t clear yet.

The way this artificial distinction is being sought to be made between Global AUAs and Local AUAs clearly shows at attempt to overreach the provisions of the law. The basic objective of the Aadhaar Act is to ensure that Aadhaar information is not leaked. But this exercise proposes that Global AUAs be able to store Aadhaar numbers on their systems. The devil will be in the details. The 16 paragraphs of the circular don’t spell out the technical architecture by means of which these virtual identities will be generated, maintained, retained and persevered in a manner that is completely secure. A large number of people have unauthorized access to the Aadhaar database, making it possible for them to use Aadhaar numbers to generate fabricated or forged virtual IDs.

We now have 1.19 billion people on Aadhaar, which is the central reality. The government should come up with cogent solutions to make it more secure rather than coming up with paper notifications.

Indians should not be treated as experimental materials in the laboratories of the government. Already, Aadhaar Act has its own defects. If someone’s Aadhaar number is compromised, they do not even have the power to go to police station and file an FIR. The circular is more like trying to repair a leaking roof with a Band-Aid. There has to be a more holistic, comprehensive and innovative approach that has to be followed.