Currently, privacy protection under Aadhaar is not strong: Pavan Duggal

The recent Supreme Court judgment that right to privacy is 'intrinsic to life and liberty' may have repercussions on Aadhaar scheme which collects personal details and biometrics for generating a unique identification number. Cyber law expert and Supreme Court lawyer Pavan Duggal, in an interview with Mansi Taneja, said the SC ruling is the 'Dawn of a new beginning' but Aadhaar Act needs to be amended in view of the same as it violates privacy in its current form.

How will the SC judgement on privacy impact the Aadhaar scheme?

The SC judgement will have a direct impact on the Aadhaar scheme. Though the judgement is prospective and people have a fundamental right to privacy, as on this date, Aadhaar data continues to be on a central database. Currently, privacy protection under Aadhaar is not strong as cybersecurity has been just given a lip service. Aadhaar has been walking on thin ice. Since 2009-16, there was no law governing it. It was granted legality presuming that Aadhaar will be voluntary. The Act needs to be amended as Aadhaar has been made mandatory -- for bank accounts, income tax returns and others. SC will now decide privacy matters related to it.

An entire ecosystem has developed around Aadhaar. How secure is it?

This ecosystem around Aadhaar is completely insecure and in its current form, it violates privacy norms. When the Aadhaar Act was passed, it was with the presumption that Aadhaar would be voluntary, so it only talked about the security of the Central Identities Data Repository. The more the cybersecurity, more are chances that privacy of Aadhaar will be protected. There have been many instances of Aadhaar leaks, which show that it is not completely secure. That is why UIDAI (Unique Identification Authority of India) is filing FIRs right, left and centre. No responsibility has been fixed for stakeholders involved in the ecosystem. Also, there is no individual redressal mechanism if there is some breach related to Aadhaar. Aadhaar has cut off the hand of its users. Especially, if your Aadhaar data is compromised, you as an Aadhaar user are not authorised/empowered to report the matter directly to police. Only UIDAI can report the matter to the police. Aadhaar should be made voluntary. Making it mandatory is like putting entire citizens of the country in a river of fire without adequate protection.

Technology is changing rapidly. And at a time when the government is talking about Digital India, where does our Information Technology (IT) Act stand?

The current IT Act is a thoroughly outdated legislation. The last amendments were done in 2008; that too, were changes and all issues were not addressed. Technology has changed so much in the last ten years, the IT Act needs to reflect existing realities of today's world. And in context of Aadhaar, how it is compliant with IT Act, we don't know. Aadhaar is nothing but data and information in an electronic format.

Lastly, how do you think the SC judgement will impact the ongoing case of WhatsApp/Facebook?

The SC ruling does not cover private players. The judgement has only made a right to privacy enforceable against states actions. The IT Act covers third-party service providers, but the government has not specified parameters for privacy protection in it. The government needs to come out with rules and regulations and ask providers to take steps for protection and preserve the privacy of users.