In a landmark decision in August 2017, the Indian Supreme Court held that privacy was a fundamental right. In holding that the “right to privacy is protected as an intrinsic part of the right to life and personal liberty," the court created new challenges as it relates to India’s privacy protections, and in particular, the Aadhaar program. Prior to the Supreme Court’s 2017 decision, a degree of privacy was protected in India through a variety of laws and rules. However, even now with the recent ruling, the application of the privacy protections outlined are unclear, in particular, as they relate to Aadhaar.

Aadhaar is India’s biometric identification scheme in which Indians voluntarily enroll certain biometric identifiers, such as fingerprints or irises, and in return receive a unique identification number. Once enrolled, Indians can use fingerprint or retina scans to establish their identity for a variety of goods and services. Those enrolled can use these identifiers to access subsidies of food, fertilizer and other goods, as well as link to bank accounts, and even monitor attendance at jobs. As the largest biometric identification system in the world, with over one billion individuals enrolled, the privacy and security implications of the program are immense.

Proponents of Aadhaar point to the efficiencies built into the program, including easy identification via physical presence, especially for those who lack ready access to documentation, such as those without birth certificates or other forms of identification. Likewise, the requirement for biometric identification prevents the types of fraud that lead to government waste and unqualified individuals receiving goods or services to which they are not entitled. Prime Minister Modi is on record as having stated, “These days you keep hearing about Aadhaar. I want to say Aadhaar has added great strength to India’s development. What would earlier get into wrong hands is now going to the intended beneficiaries.”Studies have even shown that requiring the use of biometric identification for state employees to “clock in and clock out” has increased the amount of time employees spend at their desks each day.

Despite the efficiencies and benefits of the program, privacy risk remains a concern. An examination of the Aadhaar program through the lens of the Fair Information Practices (FIPs) is useful for analyzing these concerns. A complete FIPs analysis of Aadhaar is impossible in this article, but the principles of choice and consent, along with security, provide an interesting view and raise many questions about how Aadhaar can fit within established privacy norms.

The Aadhaar program is voluntary; however, the central government has strongly encouraged all Indians to enroll, and the use of Aadhaar has become so ubiquitous that not having Aadhaar can be problematic, even in the private sector. Indian Member of Parliament Jairam Ramesh is reported to have described the the program as “compulsorily mandatorily voluntary.” Likewise, concern has arisen wherein the government could theoretically use the database to data mine or do profiling; allegations that it denies.

Similarly, the security ramifications of a database of personal information on more than a billion individuals is stunning. News reports have already cited a number of breaches, including where 210 government agencies published the full names, addresses and Aadhaar numbers of welfare beneficiaries. The Unique Identification Authority of India claims that the strongest protection measures and most up to date technology is used to protect the database and the information within it. However, recent hacks of large public and private databases in the United States, such as at Equifax; show us that it is only a matter of time until a security incident occurs.

What is clear is that technological innovation in areas that encroach upon personal privacy are a part of the world we live in and their growth will continue. India is only the first among many countries, including Russia and Tunisia, eagerly considering biometric identification for various services. As a result, privacy protections must continue to evolve and provide new answers to technological innovation.

photo credit: ustung India (Agra) Magnificient view of Taj Mahal via photopin (license)