There is a need for privacy laws and standards in aadhaar system

There is a need for privacy laws and standards in aadhaar system

It is welcome that the minister for information technology, Ravi Shankar Prasad, has held out the assurance that the biometric data collected for Aadhaar are safe, encrypted and secure, even as the Aadhaar database is used for authentication with the permission of the individual concerned. But it is also a fact that government websites have published Aadhaar numbers, alongside the names of beneficiaries under assorted government schemes.
This shows two things. One, the essential mistake that any cyber security primer would point out, of obsessing over technological fixes while glossing over the protocols of process and procedure that people need to be trained in, to secure sensitive data and data systems. Two, the need for a strict law to penalise breaches of privacy, including via Aadhaar.
If someone’s Aadhaar number and a one-time password sent to the linked phone number are sufficient to complete a financial transaction, as has been reported, that would clearly be inadequate. Since Aadhaar allows for verification using biometrics, financial transactions using Aadhaar should ideally make use of this capability, with point-of-sale equipment that can scan and authenticate biometrics by querying the Aadhaar database without such data getting locally stored and being used without the data owner’s explicit permission.
This would be possible only with a combination of technology and standards of data security on the lines of, and possibly superior to, the Payment Card Industry Data Security Standard. These could specify who can and cannot ask for Aadhaar data — today, nursery schools demand the parents’ Aadhaar numbers.
This would stem from clarifying to what end the government is enrolling everyone into Aadhaar. Preventing misuse of Aadhaar — for example, using just the number to collate the data that resides in standalone silos for health, finance, taxation, etc — calls for an explicit law on privacy that goes beyond Aadhaar. Aadhaar would be rendered more wholesome by swift enactment of a rigorous law to protect privacy.