It Isn't Compulsory To Link Your Aadhaar Everywhere Anymore, But It's Still A Privacy Time Bomb

With its landmark ruling delivered today, the Supreme Court has made its feelings on the Aadhaar Act loud and clear.

Aside from striking down a couple of Aadhaar Act's sections, the court upheld the constitutionality of the system. But in the process, did it overlook a few other things?

So is Aadhaar for welfare schemes or to establish identity?

When the proposal for Aadhaar was first put forward, it was described as a way to identify welfare recipients, so corruption could be rooted out and rations meant to go to the poor wouldn't end up in the hands of fraudulent parties just looking to resell them. Eventually though, the idea grew in size and ambition. Applied to the entire population, it could be a citizen ledger cataloguing every living Indian. In such a scenario, what stops UIDAI's Aadhaar from being the one identification system to rule them all?

ALSO READ: Supreme Court: Aadhaar Not Required For Banks & Phone Numbers, Companies Can't Store User Data

Of course, things didn¡¯t exactly work out that way. The Aadhaar Act was cannonballed through parliament and the card subsequently made compulsory for everyone. Yet with over a billion Indians registered by UIDAI (the Aadhaar authority) Aadhaar still couldn't eliminate other IDs. After all, you still need your driver's license to drive your car, still need your PAN card to file income taxes, Voter's Card to cast your vote. All the order really did was compel people who were unsure about the system¡¯s security to apply for an Aadhaar card anyway, whether to open a bank account, or get a new SIM card, etc.

Reuters

ALSO READ: Your Worst Fears Are Realized: Aadhaar Has Been Hacked With A Rs 2,500 Software Patch

Of course now the SC says you don't need your Aadhaar Card to create a bank account -- or link it to an existing account. However, you do need both your Aadhaar card and PAN card to file IT returns, which makes this effectively moot for a lot of people.

Critical Aadhaar questions still remain unanswered

While the Supreme Court ruling does strike down the rule ordering for Aadhaar transactions to be archived for five years, as well as prevents metadata storage, protecting your data from third parties' abuse. But for those of you worried about how secure Aadhaar is, you have good reason to have a healthy amount of doubt.

The Supreme Court in its verdict observed that Aadhaar is "foolproof" and that it's satisfied with the database's security. However, there's limited technical description of the security precautions taken, if any.

However, the UIDAI has repeatedly played fast and loose with what is essentially the entire personage of every citizen under Aadhaar. Third party companies were contracted to register people for the system, which was unsafe in itself. It became even worse when we learned these employees, upon being severed, retained access to legacy versions of the verification software, and can use them to create falsified entries. Additionally, it¡¯s also been shown the official government app for the system is ludicrously simple to crack into.

There is no legal framework to protect Aadhaar from data breaches

We have no national data protection, and no law governing its privacy. Tech companies that are hacked are under no direct legal obligation to report breaches within a time period. In this environment, the Aadhaar database might've been hacked multiple times -- either at source or through third parties -- and we may never even know about it. That's a scary reality to acknowledge.

Still, the Supreme Court says it¡¯s satisfied that ¡°sufficient security measures¡± have been taken. And it did ask the government to come up with a data protection law in earnest.

Aadhaar is great for establishing identity and ensuring government services reach the people who need it the most, but there has been enough evidence that Aadhaar has some serious problems as well. Today, we needed acknowledgement that these problems need to be dealt with, before it's much too late.