Even if the state can interfere with a constitutional right based on some legitimate state interest, the intrusion can’t be arbitrary.
The Indian Constitution, like several others, guarantees a set of rights against the state. The nature of rights is not that they are absolute, but that intrusions must satisfy certain conditions – and these conditions and intrusions are being tested in the debate over Aadhaar.
One important condition is that even if the state can interfere with a right based on some legitimate state interest, the intrusion cannot be arbitrary. The reason is simple enough: if the state can violate my right at any time, then what is the point of that right?
Arbitrary intrusions may take many forms. One kind of arbitrary intrusion is the absence of checks and balances on state power, because such absence allows the state to intrude upon a right without clear and effective boundaries.
A major set of legal concerns relating to Aadhaar involve this argument. The concerns may be borne out by three features of the scheme:
1. UIDAI only stores information about the use of Aadhaar for authentication, but not the reason for the authentication. For example, it knows Arun used his Aadhaar number at an Airtel store without knowing why he used it, what his call records are, etc. (Section 32 of the Aadhaar Act).
2. The linking of Aadhaar with various schemes and services, both public and private (Sections 7, 8, and 57 of the Aadhaar Act).
3. The fact that as a result of such linking, there are several more end points in the system. That is, there are several more devices through which one authenticates one’s Aadhaar number, and there are also several intermediaries who provide such devices and connect them with the central server.
Inviting trouble?
The argument offered by the petitioners is that these three features invite trouble.
In the first instance, even though the UIDAI may not know why an individual used her/his Aadhaar number at an Airtel store, the very fact of authentication itself provides sufficient information. After all, one could reasonably presume that the individual wanted a new connection, and one would know the kinds of services to which an individual subscribes.
In this respect, Kapil Sibal’s submissions quite rightly underlined the dangers of even simply the “meta-data”. A further point brings this out. In practice, the UIDAI enters into agreements with requesting entities (say, Airtel), under which it issues letters of appointment specifying the purposes for which the entity is using Aadhaar authentication. From this itself, it is evident that UIDAI knows the purpose for which authentication occurs.
In the second and third instances, the problem is two-fold.
First, if the data is linked to several services, and the details of the services to which it is linked are public, then a person could potentially try to access an individual’s records from the different services and put them together to form a somewhat complete picture of the individual. It is true that this could already be done in a non-Aadhaar world by various identifiers, but Aadhaar makes it easy to find an individual’s records; I don’t need to access the main UIDAI server if I can match records across different services.
The second problem is that the greater the number of end points and intermediaries, the greater is the risk of technical penetration of the system. The chances for data breaches go up substantially.
State response misses the point
The state offered two kinds of responses to this. The first was simply that these imagined scenarios were violations of the Aadhaar Act, and that any law can suffer violations. This is, however, a poor argument. Any law, it is true, can suffer violations, and this is precisely why state action must have checks and guidelines to see that violations are limited, and arbitrary state power is prevented. Precisely this reasoning has led to courts providing checks and guidelines in cases involving police powers.
The real question, then, is whether the Aadhaar Act sufficiently mitigates against the risks of the three features mentioned above. That it does so was the state’s second kind of response, exemplified by the presentation that the UIDAI CEO made before the Supreme Court. The CEO argued that Aadhaar involves one-way linking (“optimal ignorance”), a federated database, and the collection of only minimal data.
This response is fair, but it misses the point — that in practice, getting around the existing guidelines seems easy enough, especially in the case of the first point. The UIDAI may be, in theory, “ignorant”, but it does not take very much for it or for an external party to become knowledgeable. This means that the constitutional rights in question are, as Shyam Divan argued, hollowed out.
Which rights are affected?
The rights in question here – of the state gaining access to my private activities and storing my information without sufficient security – are not only the right to privacy (now firmly accepted as implicit in Articles 19 and 21 of the Constitution) but also the right to equality in Article 14 (because any potential use of the data through aggregation can result in unlawful differential treatment of individuals).
We can see that the argument that privacy is not absolute relates to a different issue. The question, here, isn’t whether the state’s intrusion into privacy is per se allowed. As the court recently noted in the privacy judgment (Puttaswamy), the question is also whether the intrusion is arbitrary.
Here, moreover, the intrusion seems vulnerable on another ground, namely it is overbroad. Sections 7 and 8 of the Aadhaar Act specify that the scheme is for authentication. But Section 32 allows the preservation of authentication records. As Meenakshi Arora noted in her submissions, the reason for this retention of data is not specified.
Why not require that there is erasure of records? Some dynamic data may need brief storage for technical reasons (like a computer cookie), but Section 32’s broad wording (allowing the UIDAI to “maintain authentication records in such manner and for such period as may be specified by regulations”) seems troublesome.
If Aadhaar is about authentication at any given time, why is the storage of one’s authentication history necessary? This feature, moreover, suffers from a further and different legal problem – excessive delegation – to which our next piece shall turn.
This is the second piece in a four-part series covering the legal challenge to Aadhaar. Read the first and the third part here and here.
Madhav Khosla, co-editor of the Oxford Handbook of the Indian Constitution, is a junior fellow at the Harvard Society of Fellows. His Twitter handle is @M_Khosla. Ananth Padmanabhan is a Fellow at the Centre for Policy Research. His Twitter handle is @ananth1148.