SC's Aadhaar verdict opens up UIDAI to legal suits

'People, whose sensitive information has been leaked by State agencies or companies having license from UIDAI to access the Aadhaar database, can file suits, collectively or individually.'
Advait Rao Palepu reports.

In its verdict, the Supreme Court scrapped Section 47 of the Aadhaar Act, which means individual Aadhaar cardholders or citizens can file criminal complaints against the Unique Identification Authority of India (UIDAI) and its licensed entities, if a suitable amendment is effected by Parliament, say legal experts.

Section 47 of the Aadhaar Act stated that only the UIDAI or a person/officer authorised by it could register and file criminal complaints against individuals and companies for offences.

"This was a contentious part, as people were worried how they could get legal recourse for breaches of Aadhaar security, especially when the UIDAI was unwilling to accept that data breaches are a reality," says Raghu Godavar, member of advocacy group RethinkAadhaar.

"You can look at the Airtel Payments Bank scam where bank accounts were created for people without their knowledge. This was a subversion of the principle of natural justice," Godavar points out.

In its order, the court held: 'There could be several circumstances where UIDAI itself or some third-party is guilty of having committed offences under the Act. By restricting the initiation of the criminal process, the Aadhaar Act renders the penal machinery ineffective and sterile.'

"Now that Section 47 is struck down, any person who is aggrieved can file a criminal complaint and set the legal machinery in motion," says Ajay Kumar, associate at MZM Legal.

"Under the earlier situation," Kumar adds, "only the authority could decide whom to prosecute. The law now empowers citizens to seek punishment of those who violate their right to privacy by misusing data."

Petitioners to the case had argued that since personal and biometric information collected and stored by UIDAI in the Central Identities Data Repository is the property of the individual, this clause in the Act violated the individuals' right to judicial intervention.

There are various offences listed in the Act under which UIDAI could file criminal complaints and take cognisable action against individuals and companies.

These include unauthorised access to CIDR, impersonation of an Aadhaar holder, unlawful or non-consensual disclosure and transmission of Aadhaar details, mis-use of information in the CIDR, and theft of identity information, among others.

Further, Section 43 also makes companies and their management liable for offences committed under the Aadhaar Act.

This means that firms can be taken to court if individuals or a group of individuals find clear violations of personal or biometric data by employees or the company itself.

"If a complaint is made against a company, then the person in the firm who is responsible for that matter will be prosecuted, along with the company itself," says Kumar.

"A lot of these prosecutions end up becoming slow because law enforcement and prosecutors lack the necessary training to prosecute these complicated offences. We will need to upgrade the law enforcement agencies to investigate offences under the Aadhaar Act," adds Kumar.

Last month, Aadhaar details of over 8.9 million MNREGA beneficiaries were made public on a Web site portal run by the Andhra Pradesh government.

In another report, the commisionerate of college education in Andhra Pradesh leaked personal details and Aadhaar numbers of over 64,000 past and present students, including their caste details.

"People, whose sensitive information has been leaked by State agencies or companies having license from UIDAI to access the Aadhaar database, can file suits, collectively or individually," says senior lawyer Murali Neelakantan.

"Now that the Supreme Court has stuck down Section 47, they can also file criminal complaints today under the Aadhaar Act and the Information and Technology Act," Neelakantan adds.

"Thereafter, if the case is not properly investigated or prosecuted, they can approach the high courts or the Supreme Court with a writ petition to constitute a Special Investigation Team with a court-appointed public prosecutor," explains Neelakantan.

While many hail the Supreme Court's decision as a move in the right direction, legal experts say that individuals are, at the moment, restricted from filing First Information Reports with the police against the UIDAI or licensed entities.

"The Supreme Court order says there needs to be a 'suitable amendment to include the provision for filing of such a complaint by an individual/victim as well whose right is violated'. This means Parliament needs to enact a law that says individuals have the right to file a complaint," says a spokesperson from the Software Freedom Law Centre based in New Delhi.