19 April, 2019
Aadhaar and other Laws (Amendment) Ordinance, 2019
Aadhaar and Other Laws (Amendment) Ordinance, 2019 has received the Presidential assent on March 4, 2019. The Ordinance effects changes to the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, the Indian Telegraph Act, 1885 and the Prevention of Money-laundering Act, 2002. Certain salient changes effected by the Ordinance is as follows:
- Deletion of Section 57: Earlier, the Supreme Court of India in the case of Justice Puttaswamy (Retd.) & Anr. vs. Union of India, had held Section 57 of the Aadhar Act to be partly unconstitutional, in so far as it enabled use of Aadhar number for establishing identity of an individual for any purpose by the State or a body corporate or a person pursuant to any law or any contract. The Ordinance removes Section 57 entirely from the statute but allows private entities to use Aadhaar or alternate virtual identification for authentication based on a framework of safeguards set out in the Ordinance.
- Definition of Aadhaar ecosystem: The Ordinance defines the Aadhaar ecosystem, to include enrolling agencies, Registrars, requesting entities, offline verification-seeking entities and other entities which may be specified by regulations within the ambit of an Aadhaar ‘ecosystem’. Persons who qualify as part of the ecosystem will be governed and bound by the be directions and regulations by the UIDAI.
- Creation of an alternate virtual id: An alternative virtual id which is connected to each Aadhaar number. Those who do not wish to provide Aadhaar number can provide a virtual id for electronic authentication. Each virtual id is connected to one Aadhaar number. The UIDAI may decide whether an entity can use Aadhaar number or must restrict itself to the virtual id for authentication.
- Offline verification: Introduction of offline verification process to establish identity which does not involve authentication using biometric or electronic means. The Ordinance however does not spell out the offline verification methods but leaves such processes to be spelt out by UIDAI through separate regulations.
- Voluntary option to provide Aadhaar number: A voluntary process for providing Aadhaar number for authentication to private entities, such as telecom and banking companies. Such use is only with the informed consent of the Aadhaar number holder.
- Conditions for authentication by an entity: Section 4 has been amended to allow an entity to perform authentication if it is satisfied that the requesting is compliant with standards of privacy and security which are specified by regulations and permitted to offer authentication services under the provisions of any law made by Parliament or a purpose prescribed by the Central Government.
- Purposes for use/ disclosure of information to be specified in writing at the time of data collection: Section 29(3) has been amended to clarify that any entity which requests authentication or offline verification shall not use or disclose any information available with it for any purpose, other than purposes informed in writing to the individual at the time of submitting information for authentication or offline verification.
- Stipulation of regulation-making power of UIDAI: The UIDAI will now have power to make regulations governing the Aadhaar ecosystem, biometric and demographic information and the process of collecting the same, standards of privacy and security, etc.
- Other updates: There are other updates such as provision for children to cancel their Aadhaar number on attaining the age of eighteen years, prevention of denial of services for refusing to undergo authentication, establishment of a Unique Identification Authority of India Fund, provision of civil penalties, etc.
The Ordinance which has been assented to by the President after the Aadhaar Amendment Bill lapsed in the Rajya Sabha. While, the Ordinance may be welcomed by banks and telecom companies, it does appear that other financial services players such as mutual funds, wealth managers will not benefit from the ability to use Aadhaar data immediately. Such intermediaries will need to firstly, determine based on rules and regulations the nature of processes than can be used for authentication of Aadhaar data and rationalise their KYC rules with the amendments to the money laundering regime effected by the Ordinance.
Further, and more importantly the Ordinance may be subject to constitutional challenge. The Ordinance disregards the judgment of the Supreme Court which held that the use of Aadhaar information by private parties enabled commercial surveillance and was therefore unconstitutional. The Ordinance may be further scrutinized in light of the judgment of the Supreme Court as it has been passed in the absence of a comprehensive data privacy law, which in the view of the Supreme Court enhanced the level of privacy rights violations of the original Aadhaar legislation.
For more information, please contact:
Sameer Sibal, Partner, Jerome Merchant + Partners
sameer.sibal@jmp.law
