Aadhaar Data Breaches Affected 135 Million Indians: Petitioners Tell SC [Read The Rejoinder Affidavit]

“Reports by privacy and security researchers indicate that such breaches have already affected 135 million Indians. These data breaches are in flagrant violation of Section 29 of the Aadhaar Act read with Regulations 6 and 7 of the Aadhaar (Sharing of Information) Regulations 2016”, states the rejoinder.With the final hearing on the string of writ petitions challenging the constitutionality of the Aadhar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act of 2016 scheduled to commence in the Supreme Court on January 17, Chief Justice Dipak Misra on Friday permitted Advocate Vipin Nair to file the rejoinder affidavit on behalf of activist and feminist researcher Kalyani Sen Menon, one of the petitioners.The apex court also permitted the filing of an additional affidavit to bring on record the documents relevant to determine the controversy and pertaining to security of biometric data and leakages in social security schemes.The rejoinder affidavit gives a detailed account of how Aadhaar has caused widespread exclusion from access to welfare services such as PDS, MGNREGA, Old Age Pension, Scholarship for EWS etc and even fatalities among the most vulnerable and marginalized, and that its claimed benefits as to savings are all gross exaggerations.Further, the affidavit sheds light on the issues of surveillance, breach of privacy and identity theft of individuals in violation of their rights under Articles 14, 19 and 21 of the Constitution have been reiterated. Scepticism regarding data protection-The affidavit refers to a report of the London School of Economics in so far as it states that the Central Identities Data Repository (CIDR), the centralised database containing demographic as well as biometric information of 1.3 billion Indians, becomes an inherent target for foreign governments and hackers, rendering it vulnerable to being breached.The claim of security and privacy of the data stored within the CIDR is further called into question due to the creation of the ‘DBT Data Seeding Viewer’, a mechanism that allows any department or agency to access demographic data directly from the CIDR.Revealing the glaring security lacunae in the UIDAI’s enrolment procedure and its misplaced reliance on biometrics, the affidavit cites the September, 2017 incident where the Uttar Pradesh Special Task Force had unearthed operations of a group of individuals issuing fake Aadhaar numbers by accessing the UIDAI’s enrolment software as well as cloning the fingerprints of the authorised agents.The affidavit relies on the December, 2016 reply of the UIDAI to not furnish, in a RTI query, information related to breach of personal information, as an ex-facie violation of an individual’s fundamental right to privacy- “Reports by privacy and security researchers indicate that such breaches have already affected 135 million Indians. These data breaches are in flagrant violation of Section 29 of the Aadhaar Act read with Regulations 6 and 7 of the Aadhaar (Sharing of Information) Regulations 2016”. Copies of recent news reports relating to bank frauds caused on account of Aadhaar linking have been annexed to the affidavit.Laying emphasis on how the Aadhar mechanism is insecure, error-ridden and full of malpractices by private players, the April 2017 statement of the Minister of Law and Minister of Electronics and Information Technology in the Rajya Sabha that the UIDAI has cancelled and blacklisted 34,000 Aadhaar “operators” since the inception of the Aadhaar project has been relied upon- “As per latest reports, by UIDAI’s own admission, 49,000 private enrolment operators have been blacklisted owing to contraventions of its own operating procedures. These enrollment operators were entrusted by the UIDAI to capture sensitive biometric information of over 1.3 billion Indians”.Further, on December 29, 2017, the Minister for Electronics and Information Technology provided a list of 210 websites of the Central Government, State Government departments and some educational institutes displaying the Aadhar numbers of the beneficiaries in public domain.The affidavit brings to light the loophole in section 33 of the Act of 2016, which is couched as an exception to Section 29, allowing every Indian’s personal information, including biometrics, to be shared pursuant to any order by a Court or in ‘the interest of national security’. The provision fails to lay down any meaningful safeguards for the exercise of this power and the phrase ‘national security’ has been left undefined. Also, section 2(g) permits the executive to expand the purview of “biometric information” beyond fingerprints, iris scan and photograph at its discretion.Finally, the affidavit laments that pursuant to Section 47 of the Act of 2016, the right of an aggrieved person to approach the relevant authority in the event of a data breach or identity theft has been taken away. Taking away legal remedies otherwise available to an individual is a gross...

Aadhaar Data Breaches Affected 135 Million Indians: Petitioners Tell SC [Read The Rejoinder Affidavit]

Mehal Jain