Finger in every pie regular theft of biometric data shows how lax information storage is and why we need a strong law

Finger in every pie regular theft of biometric data shows how lax information storage is and why we need a strong law

In yet another unnerving case of mass biometric theft, Hyderabad police recently caught a man with around 2,000 fingerprints of separate individuals that were being used to purchase SIM cards, create bank accounts, and then engineer more frauds. It is of course not just police and UIDAI that collect and deploy biometrics these days. Smaller public and private entities have now taken to this with passion. Bengaluru Metro is mulling a facial recognition-based pass and similar boarding is being planned for various airports as well. Biometric access systems are proliferating in offices and apartments. The immense problem with this trend is that it is running apace without strong data protection protocols being put in place.

India has comprehensively embraced the digital economy without a matching data protection regime. Tons of personal data is being constantly collected alongside tons of confusion about how it will be stored and used and who will have access to it. Plus, disincentives in the Aadhaar Act are weak relative to the damage criminal behaviour can wreck. For example, impersonation by providing false demographic or biometric information is punishable only by imprisonment up to three years or a fine of Rs 10,000 or both. Even such provisions are brought to bear on only a fraction of the cases of data misuse.

A UIDAI warning against unlicensed entities misusing Aadhaar card photocopies and e-copies was swiftly withdrawn even as identity thefts and financial losses caused by impersonation are constantly underplayed. Granted, options such as turning on the biometric lock and Virtual Identity can give users meaningful control over their security. But when even tech-savvy urbanites can willy-nilly fall prey to biometric theft, imagine the vulnerability of the rest. The only way to fight this is to appreciate its seriousness and take appropriately serious counteraction. For India this means two key measures. First, UIDAI should gird its walls, like the CAG audit has called for. Second, Parliament should no longer delay a comprehensive data protection law – with the strongest possible regulation against security-poor or unauthorised storage of identity information.