Digital Identity and Biometrics

In one line

The Court upheld a national biometric identity because it delivers welfare, and cut out every part of it that did anything else.

In the wording a student can write in an exam: in Justice K.S. Puttaswamy (Retd.) v. Union of India (2018) a Bench of five judges upheld the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 as satisfying the triple test of a law, a legitimate State aim and proportionality, holding that only matters over which there is a reasonable expectation of privacy are protected by article 21; but it declared unconstitutional the part of section 57 enabling a body corporate or individual to seek authentication, struck down section 33(2), read down section 33(1) to require a hearing, struck down the regulation permitting authentication records to be archived for five years, held retention beyond six months impermissible, held the metadata regulation impermissible in its present form, held rule 9 of the Prevention of Money-Laundering (Maintenance of Records) Rules 2005 on the linking of bank accounts disproportionate, and held the Department of Telecommunications circular of 23 March 2017 on the linking of mobile numbers illegal and unconstitutional as it is not backed by any law.

What a biometric identity does to privacy

Before the case, the analysis. A biometric identity system has four features that no earlier identity document had, and each is a distinct rights problem.

It is not revocable. A password can be changed after a breach; a fingerprint cannot. The consequence is that a compromise is permanent.

It is the same key everywhere. A single identifier used across welfare, banking, telecom and employment allows records held for different purposes by different holders to be joined, which is the combination problem of [Informational Privacy and the Proportionality Test]. Purpose limitation is the answer, and it is only as strong as the rule that enforces it.

It generates a record every time it is used. Authentication is not merely identification; each use leaves a log of where the person was and what they were doing, so the system produces a running account of a person's life as a by-product.

And it becomes a condition of participation. Where a benefit is available only on authentication, a person who cannot authenticate is excluded from it, so a technical failure becomes a denial of a right. That is the exclusion problem of [Equality and the Digital Divide].

The case

Facts. The Aadhaar scheme enrols residents and issues a unique number against demographic and biometric information held in a central repository. Section 7 of the Aadhaar Act 2016 makes authentication a condition of receiving a subsidy, benefit or service the expenditure for which is met from the Consolidated Fund of India. The Act was certified by the Speaker as a Money Bill and passed accordingly. It was challenged as violating the right to privacy the same Court had recognised in 2017, and on the ground that a Bill containing provisions outside article 110(1) could not be a Money Bill.