Interview: ‘Aadhaar is not a secret number like your password or PIN,’ says UIDAI chief
As a five-judge bench of the Supreme Court gets ready to
hear petitions on Tuesday and Wednesday challenging the government’s decision
to make Aadhaar mandatory for accessing vital services, Ajay Bhushan Pandey,
chief executive officer of the Unique Identification Authority of India, spoke
with Scroll.in on Monday. The Authority is the nodal
agency that maintains the database of the biometrics-based 12-digit unique
identification number that the Centre wants all Indian residents to have.
Pandey said the Unique Identification Authority of India
is vigilant about data breaches and citizens should not be too concerned even
if their Aadhaar numbers are leaked. His comments come in the backdrop of
numerous reports of the personal details of Aadhaar
holders being leaked, and close on the heels of an alleged security breach of telecommunications major Reliance
Jio Infocomm’s database last week.
Affirming that Aadhaar data sits securely
on the Authority’s servers, Pandey, however, said there have been several
instances of the Aadhaar Act’s enrolment guidelines being violated. As a result
of this, the Authority has penalised close to 5,000 operators. These violations
ranged from sending people away when they showed up at the enrolment centre to
demanding money for enrolment or updating of information in the Aadhaar
database.
Excerpts from the interview:
Many private companies are building
parallel databases using Aadhaar authentication, which adds Aadhaar numbers to
their data banks. Are there enough safeguards and legal recourses available to
people in case of a breach?
You see, Aadhaar data is not with anyone.
Aadhaar data means your biometric and demographic data and Aadhaar number are
securely with us. What private companies have is their own database and the
corresponding Aadhaar number. It is just that the 12-digit number is there. We
have a very strict protocol saying that the number should not be misused and
should be used only for the purpose it was obtained for, and that it must not
be leaked or shared and so on.
If anything happens, then it is a criminal
offence. If the person does it knowingly, then it is a criminal offence. If the
person fails to protect Aadhaar data, then it is a case of criminal negligence
for which the person can be held criminally liable under the Aadhaar Act, and
for such cases we do this.
This is the punishment that can be taken
against a person who has leaked Aadhaar data.
But those who get impacted…
What I would like people to understand is
that Aadhaar is not a secret number like your password or PIN [personal
identification number], which can materially affect your life tomorrow if it is
leaked without your knowledge. It is not like your Aadhaar number is leaked and
your bank account gets emptied out.
In case of Aadhaar, let us say the 12
digits are leaked. The question is, by merely knowing your Aadhaar number, will
someone be able to harm you? My answer is no. The Aadhaar number by itself does
not give away any information. It has to be used with biometrics. Or, you know,
it has to be used with the one-time-password that is sent to your phone for a
transaction.
Let us take another example. Aadhaar is
not a secret number but it is personally sensitive information. Let me give you
a parallel. The bank account number is also a personally sensitive number. We
say that it should not be publicly disclosed. But suppose it is known to the
public, is your bank account then at risk? Even if your bank account number is
known, it does not put you at any risk.
But at the same time, you would not like
sensitive personal information to be freely available to the outer world. We
are being so particular that even though we say that your Aadhaar number is not
secret, we also say that you should protect it. But in case the number does get
out, should people be worried? My answer is no. People reveal their Aadhaar
number, bank account number and address all the time. Your biometrics are with
you, you cannot be impersonated. But if your biometrics are disclosed, then
that could be a problem.
Recently, there have been multiple leaks
from the government end with ministries and departments found to be sharing
Aadhaar and other information of people on their websites.
What happened was that several government
departments were disclosing Aadhaar numbers, names, addresses and bank account
numbers. And the reason they gave us when we asked them was that they had
divulged this data under the Right to Information Act. When we told them that
they should not display such information, they immediately complied. We have
asked them to be careful in future. However, by publishing these numbers, the
people have not been put at risk.
Why then are we bothered about these data
breaches if the leaking of the Aadhaar number cannot hurt its holder?
If everyone starts publishing Aadhaar
numbers, there is a danger that someone will make a 360-degree profile of you.
So, unless and until we can prevent everyone from publishing your Aadhaar
information freely, I cannot prevent such a profiling. If one person does it
and if I stop it, I nip the problem in the bud and the threat of a 360-degree
profiling ceases to exist.
Basically, we have prohibited publishing
Aadhaar numbers to ensure that nobody can make a full profile of you and
connect databases. That kind of harm has not been done yet. But at the same
time, we will be very very tough on anyone who does it; we will hold them
accountable.
Did you file a case against any of these
government departments for publishing Aadhaar numbers?
We did not file a case because there was
no criminal intent. It was a question of understanding. They thought they were
doing something under the Right to Information Act. We asked them not to do it
and they complied. But suppose they had continued to do so, then they would
have become liable for action.
Earlier, there were reports of the
licences of around 34,000 private operators who enrol people for Aadhaar being
suspended. What has happened since then? Do you continue to monitor and take
action against such operators?
See, our enrolment happens through the
registrar. The registrar goes to an enrolment agency, which employs the
operators. We have a strict quality control process, so we not only depend on
complaints that we receive but also proactively monitor and see what is
happening in the field.
Whenever such violations have been brought
to our notice from the field, either through our own monitoring or through
complaints, we have taken action. So we have taken action against these 34,000
people and imposed fines and we have also blacklisted some.
One complaint that we have been getting of
late is that people visiting Aadhaar enrolment centres are being turned away or
they are being asked to pay. In the case of information updates, they are being
charged more than the amount specified. In all such instances, we impose a fine
of Rs 10,000 for the first violation. In the case of a second violation, the
fine goes up to Rs 50,000. We blacklist the operator on the third instance.
We have data on this. In the last seven
months, we have fined or blacklisted about 4,700 private operators. We are also
setting up an internal cell. The good thing about Aadhaar is that we have the
address and number of every person enrolled. So instead of waiting for people
to register a complaint, we call them and ask them how their Aadhaar enrolment
experience was.
