On 26 September 2018, a five-judge bench of the Supreme Court issued their verdict in respect of the challenge on the Aadhaar project and the Aadhaar Act. The bench, by a 4:1 margin, upheld its constitutional validity and the requirement to link the Aadhaar Number with the national tax identity number - the PAN. However, the court read down and struck off various provisions of the Aadhaar Act as well as the requirement to link the Aadhaar Number with mobile numbers and bank accounts.

This update analyses the salient conclusions of the judgement and, in particular, its impact on the private sector.

What is Aadhaar?

Aadhaar is India's universal identity project that seeks to give every Indian resident a means to identify themselves for various purposes. To avail this, residents signed up to obtain a 12-digit identification number (Aadhaar Number) upon submission of certain demographic and biometric details which was de-duplicated and stored in a database (CIDR). The entity seeking identification could authenticate the individual's details by querying the CIDR (Aadhaar Authentication). To grant statutory authority to the Aadhaar project, the Indian Parliament in 2016 enacted the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (Aadhaar Act).

The use of Aadhaar by the Government

Under Section 7 of the Aadhaar Act, the State can require an individual to produce their Aadhaar Number to receive benefits and subsidies. This provision has been invoked to mandate the use of the Aadhaar for a variety of government schemes. The Supreme Court has upheld the constitutional validity of the Aadhaar Act and held that the State may continue to insist on identification by means of an Aadhaar Number to avail of subsidies and benefits.

However, the Supreme Court has held that State cannot require the production of an Aadhaar Number for all schemes. For a scheme to qualify under Section 7, it must meet the following criteria:

(a) the scheme must be in the nature of a subsidy, benefit or service by the government, typically targeted at the poorer or weaker sections of society; and

(b) the scheme must be financed from the Consolidated Fund of India (CFI).

The requirement for Aadhaar authentication for various schemes has been mandated by means of separate notifications, issued for every scheme. These notifications have not been independently considered by the court, and their legal status is currently unclear.

The use of Aadhaar by Private Parties

Section 57 of the Aadhaar Act allowed private parties to authenticate the identity of individuals who intended to use their services using the Aadhaar Authentication process. Under this section, private parties could carry out Aadhaar Authentication, by means of contract for any purpose that they saw fit.

The Supreme Court has read down Section 57 of the Aadhaar Act and held that the part of the provision that enabled the use of Aadhaar Authentication by private parties was unconstitutional as such use allowed private parties to commercially exploit the biometric and demographic information. The court further held that any other use of Aadhaar Authentication, must be backed by law and expressly prohibited the use of Aadhaar Authentication under a contract. It is however possible, for Aadhaar Number holders, at their option, to present their Aadhaar card as proof of their identity, much like they would any other identity document.

Consequent to the judgement, banks and telecom service providers who met their KYC obligations under law by using Aadhaar enabled e-KYC can no longer do so. This decision will therefore have a significant impact on the financial services industry where the use of Aadhaar Authentication has reduced transactional costs thereby increasing scale and accessibility of financial services. Also, various other services that are currently being provided by private players relying on Aadhaar based authentication, such as e-Sign, will have to be discontinued.

While the ruling does prohibit the use of the online process of Aadhaar Authentication, it does not seem to affect the ability of private parties to use the Aadhaar in other ways (such as the use of offline KYC). Therefore, it appears that this judgement may not impact the data collection practices of private entities so long as their collection of data does not involve the Aadhaar Authentication process.

Aadhaar linking with bank accounts and mobile numbers

Individuals are no longer required to link their mobile numbers or accounts with financial institutions with the Aadhaar Number.

The Supreme Court has declared unconstitutional the requirement under Rule 9 of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (PMLA Rules), that mandated the linking of the Aadhaar Number to accounts opened in various financial institutions like banks, mutual funds, insurance companies etc. According to the Supreme Court, the statement that all bank accounts that have not been linked to an Aadhaar Number will be blocked, was a disproportionate invasion of a citizen's privacy and on that ground held that Rule 9 of the PMLA Rules needs to be struck down.

Along similar lines, the Supreme Court also struck down the requirement to mandatorily link an individual's mobile number with the Aadhaar Number.

Other unconstitutional provisions

The Supreme Court, also read down/struck down the following provisions:

(a) Section 33(1) of the Aadhaar Act allowed District Judges to request for demographic information. This provision has been read down to grant individuals a right of hearing before such an order is passed.

(b) Section 33(2) allowed the Government to access Aadhaar information, including biometric information, for national security purposes. This provision has been struck down because of lack of procedural safeguards.

(c) Section 47 of the Aadhaar Act did not allow Aadhaar Number holders to file complaints for offences. The Supreme Court observed that this provision should be amended to allow individuals to make requests to the Authority to file complaints and issued a direction exhorting the Government to amend the provision accordingly.

Uncertainties

Given that several services will now have to discontinue Aadhaar Authentication, it is unclear what needs to be done about the Aadhaar information that has already been collected. While the majority opinion has simply not addressed this issue, Justice Chandrachud, in his dissenting judgment has mentioned that telecom service providers should delete all Aadhaar information in their possession within a span of two weeks.

Further, reference has been made in various parts of the judgment to the fact that Aadhaar Number holders will, under certain circumstances, be allowed to exit from the scheme. The exact implication of this is unclear and the judgment also does not offer any clarity as to the process for exit or the consequences. However, now that Aadhaar Number holders have been offered this option they will look to avail it and the Government will need to address procedural and data security implications of allowing an exit from the scheme.

Conclusion

The judgement of the Supreme Court has reduced the Aadhaar scheme to a method of identification that can be used largely for State related functions. There is a significant lack of clarity as to many aspects of the judgement, including its full impact on various regulated and unregulated entities that have been using it. It is also unclear as to how various provisions such as exit from the scheme will be addressed.

Finally, given the extent to which the private sector has powered the deployment of the Aadhaar Authentication infrastructure, various financial inclusion measures that use Aadhaar Authentication depend on this infrastructure. If the private sector is absolutely prohibited from Aadhaar, this will drastically affect even those Government schemes that the Supreme Court has upheld.

In the coming weeks and months, the Government is likely to issue orders and directions that will provide greater clarity on all these various issues. For now, the future of the entire Aadhaar project remains uncertain.