India – Privacy Law Update
On March 26, 2016, the Indian government promulgated the Aadhar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (the “Aadhar Act”) with the objective of, inter alia, providing good governance, and an efficient and transparent delivery of subsidies, benefits and services, to individuals residing in India by assigning of a 12-digit unique identity number (“Aadhar”) issued by the Unique Identification Authority of India (“UIDAI”). The primary aim of the Aadhar Act, its rules and regulations (the “Aadhar Scheme”) was the social betterment of all strata of society. To this end, the government linked all its important schemes to Aadhar, including the Mahatma Gandhi National Rural Employment Guarantee Act, 2005 (an Indian labour and social security measure aiming to enhance livelihood security), the public distribution system (responsible for distributing subsidized sustenance to India’s poor) and the scheme under which admission is granted for subsidized government education. In addition, the government also made mandatory the linkage of Aadhar to taxpayers’ permanent account number required to file income-tax returns, and for obtaining mobile phone numbers and opening bank accounts.
In Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (W.P. (C) 494 of 2012), the constitutional validity of the Aadhar Scheme was challenged before India’s Supreme Court (the “Supreme Court”) on the basis that the Aadhar Scheme was: (i) against the rule of law; and (ii) in violation of the right to privacy, and it was prayed before the Supreme Court to abolish the Aadhar Scheme.
In 2017, in Puttaswamy’s case, the Supreme Court held that the right to privacy is a fundamental right stemming from the right to life and liberty under Article 21 of the Constitution of India (the “Constitution”). However, the Supreme Court left open the issue of the validity of the Aadhar Scheme.
On September 26, 2018, a 5-member Constitution Bench of the Supreme Court (in a majority 4:1 judgment) upheld the constitutional validity of the Aadhar Scheme, except for certain provisions, which the Supreme Court deemed unconstitutional. The judgment, which runs into approximately 1,500 pages, is the culmination of 38 cumulative weeks of hearings before the Supreme Court, making it the second longest hearing in the history of the Supreme Court.
Key arguments for the Aadhar Scheme
The Indian government, as promulgator of the Aadhar Scheme, argued that the architecture of the Aadhar Act did not contemplate the creation of a surveillance state. Moreover, the Aadhar Act, as designed, was a purpose blind legislation. On the question of right to privacy, the government argued that only minimal data of residents was required for the purpose of enrollment, which in no way pervaded the privacy of an individual.
The Supreme Court has adopted a give-and-take approach. It has held that various provisions of the Aadhar Scheme are in contravention of the Constitution, but it has not outlawed the Aadhar Scheme in its entirety. Listed below are the provisions of the Aadhar Scheme that have been struck down:
- Section 2(d) of the Aadhar Act – This provision defines “authentication records” and includes within its ambit the “metadata” of the records. The Supreme Court has held Section 2(d) to be unconstitutional on the ground that the definition of “metadata” in the Aadhar (Authentication) Regulations, 2016, is too broad and must be narrowed in scope. Until this is done, Section 2(d) will remain inoperative.
- Section 33(1) of the Aadhar Act – This provides for the mandatory and arbitrary disclosure of information of the Aadhar holder if an order is passed by a District Court or other court having superior jurisdiction without affording a chance to the Aadhar holder to challenge the disclosure. This has been held to be arbitrary and against the principles of natural justice.
- Section 33(2) of the Aadhar Act – This provides for disclosure of information of the Aadhar holder for reasons of “national security.” It has been held to be unconstitutional on the grounds that “national security” reasons can be very subjective, vague and arbitrary, and a violation of the fundamental right against self-incrimination, among others.
- Section 47 of the Aadhar Act – This provision prevents individuals from filing complaints under the Aadhar Act and has been held to be unconstitutional as it bars the legal remedy of an affected individual.
- Section 57 of the Aadhar Act – This provision, pursuant to which Aadhar information could be used to establish the identity of an individual by both, the government and private corporations, without any restraints, has been held to be partially unconstitutional inasmuch as it enabled private corporations to collect and store Aadhar information.
- Regulation 27 of Aadhar (Authentication) Regulations, 2016 – This provision allowed the UIDAI to store transaction data for 7 years. The Supreme Court has reduced this period to 6 months, which is a positive shift.
In addition to the foregoing provisions of the Aadhar Scheme, the Supreme Court has given other ancillary reliefs as follows:
- Rule 9 of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (the “PMLA Rules”), which required linking of the Aadhar number with bank accounts, has been held to be unconstitutional on the ground that it violates the right to privacy.
- The Department of Telecommunications’ circular dated March 23, 2017, which required linking of Aadhar with mobile numbers, has been held to be unconstitutional as violating the right to privacy.
- Linking of Aadhar for school and college admissions, and to appear in examinations has been done away with.
All the foregoing points in the ruling, except the requirement of linking the Aadhar with bank accounts as per the PMLA Rules, were given by the mutual decisions of 4 out of the 5 Supreme Court judges. However, the fifth judge, Justice D.Y. Chandrachud, gave a completely dissenting decision and held that by introducing the Aadhar Act as a “Money Bill,” which does not require a discussion in the Upper House of Parliament, the government had defrauded the Constitution. He further held that the entire Aadhar Act is in complete violation of fundamental rights enshrined under the Constitution and needs to be thoroughly re-worked before it can be enforced.
This judgment has rendered nugatory some of the very contentious provisions of the Aadhar Scheme. The non-linkage of Aadhar for bank accounts, cell phone connections and school admissions is welcome, especially considering that the Aadhar Act was promulgated to provide an efficient and transparent delivery of subsidies, benefits and services. Further, by reducing the time limit of data storage by the UIDAI from 7 years to 6 months, the Supreme Court has upheld the widely recognized data minimisation principles, under which data collectors and processors must delete personal data when the purpose for which the data is collected has been fulfilled.