Aadhaar Act, 2016 is very different from the earlier Aadhaar Bill brought by the UPA in 2010. The new law incorporates some of the best internationally accepted principles for protection of privacy such as informed consent, purpose limitations, use limitations and data access with consent of the individual.
The UID or Aadhaar number has been designed as a completely random number without any intelligence. Similar numbers in many countries follow a pattern which indicates several things like date of birth, place of issuance, nationality, gender, geographical location and check digit. India’s 10 character alpha-numeric PAN number is for instance, not a random number. In fact, being a late entrant has given India the undoubted advantage of learning from other countries regarding both the design of the number and its storage and we have, as a deliberate policy, adopted a completely random number as Aadhaar.
In the 2010 Aadhaar Bill it was provided that in the interest of national security any officer of the rank of joint secretary or above can order for disclosure of Aadhaar information wherein it would have been theoretically possible for the Central Government to notify a large number of officers who could order disclosures of information in the interest of national security. The 2016 Act ensures that Aadhaar information is not misused and not disclosed without the prior consent of the individual to whom such information relates.
Under the Act, disclosure of personal identity information without the consent of the individual to whom the information relates, has been permitted only under two circumstances. First, the disclosure can be made in the interest of national security and that too when a Committee headed by the Cabinet Secretary approves such disclosure. Second, a Court not inferior to a district judge can order disclosure of non-biometric information. This is undoubtedly the strongest privacy protection clause available in any Indian law. The new law also provides that any violation of the above privacy provisions will lead to prosecution and imprisonment up to three years.
The biometric and demographic information collected during Aadhaar enrollment is stored in encrypted form. The data can be decrypted only in the Aadhaar Technology Centre through specialised software which decrypts it only for a fraction of micro seconds for the purpose of de-duplication and authentication. The 2048 bit encryption system is one of the strongest in the world according to experts in the knowledge of such matters. Thereafter the data remains encrypted for the rest of its life, making the Aadhaar system robust.
It has been argued in the media and various forums that the word ‘national security’ has not been defined in the Act, and, therefore, is liable to be misused. Under Article 19 of the Constitution of India, restriction on freedom of expressions can be imposed in the interest of security of the State. The Constitution does not define the term ‘security of state.’ In the National Security Act too, ‘security of India’ is not defined. It is one of the well accepted principles in advanced liberal democracies to permit disclosure of personal or private data in the interest of national security. For example, in UK under Section 28(1) of Data Protection Act. 1998, personal data is exempted from provisions of protection principles if it is required for the purpose of safeguarding national security. The Aadhaar Act has very strong privacy protection and anti-profiling provisions incorporated in the law itself and it would be unfair to build a hypothetical case of ‘arbitrary’ state power.