Last week, the Supreme Court of India issued a judgment regarding the constitutionality of Aadhaar, a digital identity system that has enrolled more than 1.2 billion people. Its decision reinforced the importance of privacy, security, and user control – three pillars of Good ID that we recommended in our perspective on Aadhaar, shared in April.
We believe in Aadhaar’s potential, as a critical public infrastructure, to enable India’s digital evolution, prevent dissipation of scarce public resources, and facilitate inclusive innovation. For example, more than 75 percent of rural households in three major states used Aadhaar to open bank accounts in the past four years, according to the most recent State of Aadhaar report.
We also see three challenges. First, we believe Aadhaar should not be compulsory or allowed to become a “singular point of failure”. Second, more can be done to drive adoption of privacy-by-design features. Third, individuals need greater agency within the Aadhaar Act. We are glad the Supreme Court’s verdict made some progress on each of these aspects.
In addition to upholding the program, the judgment also provides new guidance on several, evolving technology and policy choices that all governments designing a digital ID system will need to consider. This is a critical moment for all governments to learn and respond in ways that strengthen their digital identity systems and fully empower people to participate meaningfully in the modern economy while also protecting their rights.
For example, we hope that the principle of data minimization, which the court lauded, will serve as an additional reminder to data fiduciaries – both public and private – to be more thoughtful about what data they are collecting and how they are processing it. Additionally, we hope the new principles added to the Aadhaar Act will also inspire others to make choices in line with Good ID. For example, the judgment awarded more agency and control to individuals to be able to file complaints and prevent the release of their information. It has also catalysed conversation about reducing the time for which authentication logs are maintained and other such measures, which is central to privacy-by-design.
We welcome the judgement’s attention on exclusion as well; this significant and continuing challenge has been a top priority of our digital identity work in India and serves as an important lesson for all governments. The Indian government has asserted that nobody would be denied subsidies because of authentication failure yet it also has an obligation to prevent dissipation of scarce state resources. The court’s decision to uphold the mandatory usage of Aadhaar for programs like food rations does not fully address risk such as the most vulnerable segments of society possibly being denied basic services. Exclusion is intrinsically linked to state capacity and is therefore an issue that may not go away overnight. In the meantime, an alternative would be useful to provide more choice and reduce exclusion.
On the other hand, the court struck down the mandatory linking of Aadhaar to bank accounts and mobile phones on the basis that they violate the proportionality principle of the right to privacy. One of the prescribed next steps is the enactment of comprehensive data protection legislation. We’ve always welcomed greater protections for individuals in the modern digital economy, and hope the draft personal data protection bill will be debated thoroughly and passed soon. This will ensure India has a robust framework under which all data processing can be regulated, including Aadhaar. In response, private sector business models will need to evolve in order to provide greater privacy protections to individuals while also ensuring inclusive innovation. As other governments consider similar pieces of legislation they can learn from the experience of India.
The appropriate use of ID is one of the most important question left unsettled by the court. While the verdict upheld mandatory linking to public subsidies and income tax, it provided some limits based on lawfulness and proportionality for commercial applications. It’s clear with these two examples, the question of where ID should be used is not merely a legal one. It requires an ethical framing within which economists, lawyers, technologists, sociologists, and others can discuss the potential benefits and costs of using ID for various objectives.
Despite the open questions, the Supreme Court’s judgment arrived at a pivotal moment. It is a timely reminder to improve the empowerment and protections that our digital identities allow. To this end, Omidyar Network will continue to support research that generates evidence on the costs, benefits, use cases, and opportunities to improve Aadhaar. We hope that such research will be helpful to individuals, governments, civil servants, academics, civil society, and businesses around the world. The verdict ultimately forces us in India, and countries globally, to think more deliberately about digital identities, their appropriate uses, and the required safeguards.