STRUCTURAL & PRIVACY PROBLEMS CREATED BY AADHAR & QUESTION OF COEXISTENCE WITH THE RIGHT TO PRIVACY?

On May 29, the central government reversed its May 27 warning, which advised citizens to share only masked Aadhaar cards to prevent misuse. The advisory has been withdrawn by the centre due to the risk of misinterpretation of the press release, and it has been removed with immediate effect. Users of Aadhaar cards have been cautioned to use caution when using and sharing their UIDAI Aadhaar numbers. This led to controversy on Aadhaar cards whether it is safe are not, not only now but at the time of the election in ANDHRA PRADESH government handed over Aadhaar details to an IT company so when the time it was introduced it has been facing many criticisms on its leakages so what intention of Aadhaar act & what are the leakages and how can they be prevented? Did Aadhaar and the right to privacy coexist? 

What is the Intention & Security provided by Aadhar Act 2016 & Structural other problems?  

The Aadhaar (Targeted Delivery of Financial and Other Subsidies Benefits and Services) Act, 2016 makes it clear that Aadhaar authentication is necessary for availing benefits coming from the consolidated Fund of India. The central database contains all the Aadhaar numbers and the holder's corresponding demographic and biometric info. The Act makes it clear that confidentiality needs to be maintained and the authenticated information cannot be used for any other purpose.

Since the inception of the UID project, institutions and organizations have laid great focus on linking their databases with Aadhar since it is needed for direct benefit transfer schemes. 2017 - UIDAI said that over 200 central and State government websites publicly displayed details of some Aadhaar beneficiaries.

Structural problems that the UIDAI faces?

 The Aadhaar Data Vault is where all numbers collected by authentication agencies are centrally stored and provides a dedicated facility for the agencies to access details only on a need-to-know basis. CAG report - UIDAI neither specified any encryption algorithm to secure it nor any mechanism to illustrate that the entities were adhering to appropriate procedures.

The CAG's report stated that apart from the issue of multiple Aadhaar’s to the same resident, there have been instances of the same biometric data being accorded to multiple residents.

 As per UIDAI's tech centre, about 4.75 lakh duplicate Aadhaar numbers were cancelled as of November 2019. CAG report said that the measures in place are "not effective enough" in detecting the leakages and plugging them.

Discretionary powers of UIDAI – The Act empowers the UID authority to specific demographic information that may be collected. The only restriction imposed on the authority is that it shall not record information about race, religion, caste, language, records of entitlements, income or health of the individual. This power will allow the authority to collect additional personal information, without prior approval from Parliament. Furthermore, UID has exclusive power to make complaints and the courts cannot take cognizance of any offence punishable under the Aadhaar Act unless a complaint is made by the UID authority.

No Documents for Proof of Residency: UIDAI has not prescribed any specific proof/document or process for confirming whether an applicant has resided in India for the specified period, and takes confirmation of the residential status through a casual self-declaration from the applicant. In India, Aadhaar numbers are only issued to individuals who have resided for a period of 182 days or more in the 12 months before the date of application.

De-duplication Problem: According to the CAG report, the UIDAI had to cancel more than 4,75,000 Aadhaar’s (as of November 2019) for "being duplicate". This data indicates that on average no less than 145 Aadhaar’s generated in a day during the period of nine years since 2010 were duplicate numbers requiring cancellation.

Faulty Enrolment Process: UIDAI appeared to have charged people for biometric updates when poor quality data was fed in during enrolment. UIDAI did not take responsibility for poor quality biometrics and put the onus on the resident and charged fees for it.

Children Below the Age of Five: The audit was also critical of UIDAI's move to issue Aadhaar cards to children and new-borns without biometrics under an initiative known as Bal Aadhaar. This needs to be reviewed because anyway after 5 years, a child has to apply for new regular Aadhar. The unique identity is not matched anyway because it is issued on the basis of documents of parents.

Using it for various purposes makes its intention of introduction is unclear so it should be rationalised 

Problems related to Data Security 

 Aadhaar has now evolved as one of the primary identity documents and a vital instrument for the targeted delivery of various government scheme benefits. It can hardly be negated that Aadhaar has been a major game-changer if transparency is taken into account. Yet, privacy issues remain a concern. Due to lake of stringent data protection laws like UK this Aadhar leak creating new oil for illegal activities like 

Identity theft – Aadhaar may be prone to practices like illegal harvesting of biometrics and identity fraud. This acts as a risk to the privacy of the individuals concerned.

Identification without consent – There are concerns regarding the unauthorized use of biometrics to identify people illegally. Elements with evil motives may identify people by inappropriate matching of fingerprint or iris scans, or facial photographs stored in the Aadhaar database, or using the demographic data.

Illegal tracking and surveillance – Parties that are in power or private agencies and service providers may use the Aadhaar data by using the authentication and identification records and trails in the Aadhaar database for illegal and unauthorized surveillance to fulfil their vested interests.

Correlation of identities across different domains – It may become possible to track an individual’s activities across multiple domains of service using their Aadhaar IDs, which are valid across these domains. This would lead to identification without consent.

Lack of clear data usage policy – The lack of a clear data usage policy and regulatory framework adds to the problem. The Aadhaar users are not informed about the purpose and limitations of their data usage by third party agencies.

Other issues – These include lack of protection against insider threats, lack of virtual identities and inadequate privacy safeguards which may hamper the civil liberties of citizens.

These are the data privacy problems but the Indian government drafted a PERSONAL DATA PROTECTION BILL which is in the parliamentary committee for further scrutinization there are some recommendations made by CAG Report they are 

Recommendations 

Prescribe a Procedure for Self-Declaration: UIDAI may prescribe a procedure and required documentation other than self-declaration, to confirm and authenticate the residence status of applicants, in line with the provisions of the Aadhaar Act.

Tighten the SLA parameters of Biometric Service Providers (BSPs): UIDAI may tighten the Service Level Agreement (SLA) parameters of Biometric Service Providers (BSPs), devise foolproof mechanisms for capturing unique biometric data and improve upon their monitoring systems to proactively identify and take action to minimize, multiple/ duplicate Aadhaar numbers generated.

Explore Alternate Ways to Capture Uniqueness of Biometric Identity for Minor: UIDAI may explore alternate ways to capture the uniqueness of biometric identity for minor children below five years since uniqueness of identity is the most distinctive feature of Aadhaar established through biometrics of the individual.

Review Charging of Fees for Voluntary Update: UIDAI may review the charging of fees for a voluntary update of residents' biometrics since they (UIDAI) were not in a position to identify reasons for biometric failures and residents were not at fault for the capture of poor quality of biometrics.

Thorough many countries like America - Social Security Number (SSN)UK - National Insurance Number (Ni No/NINO) Germany - Social Security Id (Sozialversicherungsausweis or Rentenversicherungsausweis)

Netherlands - BSN (Burger Service Nummer) France - numéro de sécurité sociale (Social Security Number- INSEE number) Canada - Social Insurance Number (SIN)Singapore - National Registration Identity card (NRIC)Sweden - Personal Identity Number (Personnummer)Denmark - Civil Personal Registration (CPR) through this country needs only demographic data are also subjected to data breach so every individual should be very vigilant to protect your data  

 Aadhar Card and Right to Privacy – Can They Co-Exist?

In its zeal to aggregate data in electronic form and target subsidies better, the government cannot ignore its responsibility to protect citizens from the perils of the cyber era.

Legislation- it is imperative that the Union Government enact privacy legislation that clearly defines the rights of citizens and it should be consistent with the provision of the Constitution.

The government should factor in privacy risks and include procedures and systems to protect citizen information in any system of data collection.

It should create an institutional mechanism such as the Privacy Commissioner to prevent unauthorised disclosure of or access to such data. Our national cyber cell should be made well capable of dealing with any cyber-attack in the shortest time. We need to educate people on the risks involved and highlight examples of ID thefts and fraud.

The government should recognise all dimensions of the right to privacy and address concerns about data safety, protection from unauthorised interception, surveillance, use of personal identifiers and bodily privacy. We need to take a level-headed approach and ensure that ample safeguards are put in place for data protection and privacy.

These are the Problems and some recommendations to use Aadhaar properly Aadhaar created many social benefits for Indian citizens like JAN DHAN ACCOUNTS, DBT etc.& Indian government also exported Aadhaar technology to various countries like Srilanka this shows how Aadhaar is used to deliver social and other benefits to citizens by using it properly with a rational approach, so as per its intention Aadhaar is fulfilling the need that it was introduced so to make it more secure and leak-proof this kind of recommendations and feedback should be taken into consideration.