Aadhaar program holds details of over a billion people and spawned the second-longest case the supreme court has ever heard

This article is more than 2 years old

This article is more than 2 years old

India’s supreme court has upheld the legality of the government’s Aadhaar system, the world’s largest biometric database containing the personal information of more than a billion Indians.

The five-judge bench of India’s top court decided the benefits of the system outweighed the risks to privacy – but pruned back larger ambitions for the scheme by laying down stringent new limits on how Aadhaar information can be used.

Private businesses or individuals have been banned from requesting an individual’s Aadhaar details, meaning the 12-digit number cannot be a requirement for services such as opening a bank account or establishing a mobile phone connection.

But the court permitted the government to make Aadhaar details mandatory to register a tax file number, file annual returns and, significantly, to claim welfare payments – a key purpose of the scheme but also one of its most contentious features.

The justices also struck down a so-called “national security exception” that allowed investigative agencies to access a person’s data without a warrant.

The decision on Wednesday settles several major questions that have hung over Aadhaar in the decade since it was first proposed by the previous Congress government and then vastly expanded by current prime minister Narendra Modi.

In a 567-page judgment, the court sought to strike a balance between privacy concerns and what the scheme’s evangelists say is its radical potential to streamline welfare payments by reducing duplication and other leakages.

About 40% of Indian social payments are lost to corruption, leakage or middlemen, according to a 2015 study.

“We have come to the conclusion that Aadhaar Act is a beneficial legislation which is aimed at empowering millions of people in this country,” the majority judgment of the court said.

“At the same time, data protection and data safety is also to be ensured to avoid even the remote possibility of data profiling or data leakage.”

The court in January began hearing a clutch of 27 cases challenging the constitutional validity of the system in hearings that stretched for 38 days, eventually becoming the second-longest case ever presented before the highest court.

The system, which now contains biometric and other personal information for more than 1.13 billon Indians, has spawned six years of legal challenges and been a lightning rod for debates about privacy, data sovereignty and digital governance in what will soon be the world’s most populated country.

Advocates say it has granted hundreds of millions of Indians a unique identity document in a country where only 58% of births are registered.

They envision a future where Aadhaar forms the core of a digital identity that could eventually include every Indian’s health records, credit scores, e-signatures, criminal backgrounds, welfare entitlements and other data.

India goes from village to village to compile world’s biggest ID database Read more

Aadhaar, a Hindi word meaning “foundation”, has already been used to give hundreds of millions of Indians their first bank account, proponents say – with another 190 million people still to go.

The data could one day also serve as collateral for loans, bringing hundreds of millions of people into the financial system.

Sharad Sharma, the co-founder of a Bangalore-based technology think tank which has worked closely with Aadhaar’s administrators, said Wednesday’s judgment did not totally eliminate that vision for the future of the scheme, but that private use of Aadhaar details would now need to be voluntary.

“Nothing has been said [by the court] about voluntary usage and nothing has been said about regulating bodies mandating it for services,” Sharma said. “So access to private parties for voluntary use is permitted.”

Critics have raised concerns about the possibility of breaches in a database that could eventually store enough information to create a comprehensive profile of a person’s lifestyle, purchases, friends, financial habits, and more.

Indian media and digital security researchers have documented several instances of Aadhaar records apparently being breached both by sophisticated hacks – as in the most recent case involving a patch that reportedly weakened security measures in the software designed to enrol new users – or by small-time fraudsters who have reportedly sold access to Aadhaar numbers for as little as £6 ($8).

In every case of an alleged breach, the Unique Identification Authority of India (UIDAI), which administers the system, has argued the leaked information – including birth dates, parents’ names or Aadhaar numbers – is not secret and that the biometric data of Indians, meaning their iris scans and fingerprints, have never been compromised.

No ID, no benefits: thousands could lose lifeline under India’s biometric scheme Read more

Opponents have also objected to government policies that make the Aadhaar card mandatory to access about 139 welfare and social service schemes, including for free midday meals at schools and subsidies for rice and other staples.

They claim at least 25 people have died in the past four years because glitches in the system meant they were cut off from rations, healthcare or pension payments, including two in the past week.

Reetika Kheera, an Indian economist and social scientist who has documented the Aadhaar-related deaths, said the court’s decision was disappointing. “[The court] seems to have taken the assurances of the government at face value,” she said.

The court on Wednesday acknowledged there were failures in the system but said they constituted a small fraction of cases, about 0.2%. “If the Aadhaar project is shelved, 99.76% beneficiaries are going to suffer,” the court said.

“It will amount to throwing the baby out of hot water along with the water.”

Legal challenges to Aadhaar last year led the supreme court to convene a bench to examine the question of whether Indians have a right to privacy. The court found in a landmark unanimous judgment that such a right existed, a decision whose ramifications included the decriminalisation of homosexual sex earlier this month.