Can Private Entities Still Choose to Use Aadhaar After SC Verdict?

This analysis clears the confusion that persists about private use of Aadhaar for eKYC even after the SC verdict.

Despite the Supreme Court reading down Section 57 as unconstitutional, there persists confusion and fuzziness about the section that allowed private entities to use Aadhaar authentication.

(Photo: Arnica Kala)

Aadhaar, the second-longest case in the Supreme Court’s history, drew to a conclusion in the form of a 1,448-page judgment on 26 September. The debate surrounding Aadhaar and its use, however, continues to rage.

Although the SC judgment appears unambiguous about Aadhaar authentication by private entities being unconstitutional, the media, public and private organisations have kept the debate churning. This has led to further debates and considerable confusion about what the judgment actually says.

A specific section of the Aadhaar Act is at the centre of this fuzziness around the judgment’s intent. Section 57 of the Act is the provision that allowed private entities, in addition to the State, to perform e-KYC and to authenticate individuals using Aadhaar.

What Did Section 57 Say ?

“Nothing contained in this Act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect:

Provided that the use of Aadhaar number under this section shall be subject to the procedure and obligations under section 8 and Chapter VI”

Section 57, then, provided legitimacy to private entities to use Aadhaar and its biometric infrastructure to perform eKYC and authenticate customers. A few provisions in this section warrant closer scrutiny, and are ones that were strongly challenged by petitioners in the SC.

1. “any body corporate or person”
2. “for any purpose”
3. “or any contract to this effect”

Let’s take a look at what the judgment had to say specifically about this section and these three phrases.

What the SC Judgment says about Section 57

On Page 560 of the judgment, the majority opinion deals with the section in three parts, each of which deals with a phrase mentioned above.

The judgment goes on to say that as far as “Section 57 in the present form is concerned, it is susceptible to misuse inasmuch as:

• It can be used for establishing the identity of an individual ‘for any purpose’. We read down this provision to mean that such a purpose has to be backed by law. Further, whenever any such “law” is made, it would be subject to judicial scrutiny.
• Such purpose is not limited pursuant to any law alone but can be done pursuant to ‘any contract to this effect’ as well. This is clearly impermissible as a contractual provision is not backed by a law and, therefore, first requirement of proportionality test is not met.
• Apart from authorising the State, even ‘any body corporate or person’ is authorised to avail authentication services which can be on the basis of purported agreement between an individual and such body corporate or person. Even if we presume that legislature did not intend so, the impact of the aforesaid features would be to enable commercial exploitation of an individual biometric and demographic information by the private entities. Thus, this part of the provision which enables body corporate and individuals also to seek authentication, that too on the basis of a contract between the individual and such body corporate or person, would impinge upon the right to privacy of such individuals. This part of the section, thus, is declared unconstitutional.”

Why SC Finds Parts of Section 57 to be Unconstitutional

All the five judges, including Justice Chandrachud and Justice Bhushan in their separate opinions, unanimously held the use of Aadhaar authentication by private entities or “body corporate and individuals” to be unconstitutional. The question then is, what made the apex court pronounce it as such? There are two primary reasons:

1. The section “would enable commercial exploitation of an individual biometric and demographic information by private entities”.
2. Private entities cannot seek Aadhaar from individuals on the basis of a contract. The purpose has to be specified and backed by a law.

“But What About Paragraph 367?”

However, paragraph 367 of the majority opinion has also left the door of confusion slightly ajar. Private entities and those in favour of private use of Aadhaar-based authentication may point towards this paragraph to make a case for their interpretation. Here’s what it says:

“The respondents may be right in their explanation that it is only an enabling provision which entitles the Aadhaar number holder to take the help of Aadhaar for the purpose of establishing his/her identity. If such a person voluntary wants to offer Aadhaar card as a proof of his/her identity, there may not be a problem.”

While this paragraph may come across as an endorsement of private use of Aadhaar, it is important to note that the language does not specify if the authenticating agency to whom an individual voluntarily offers her Aadhaar is part of the state or private.

Sajan Poovayya, a Supreme Court advocate, suggests a holistic reading of paragraph 367 along with the previous paragraph to get a contextual sense of the opinion. “Sikri J, in his analysis of Section 57 at paras 366-367 of the majority opinion had clearly held that upon a proper balancing of the adverse effects of the legislation on the rights, liberties or interests of persons, keeping in mind the purpose which the statute intended to serve, Section 57 does not pass the muster of the proportionality doctrine.”

Moreover, In paragraph 412, Justice Sikri’s majority judgment once again iterates that “In any case, a part of Section 57 has already declared unconstitutional whereby even a body corporate in private sector or person may seek authentication from the Authority for establishing the identity of an individual.” 

The Proportionality Test

The Court found the use of Aadhaar in such a manner by private organisations to be disproportionate. In other words, section 57 violates the right to privacy as it fails the test of proportionality.

After the Puttaswamy Judgment in August 2017, which held that the right to privacy is a fundamental right under the Constitution, ‘proportionality’ has become the standard of review for privacy cases in the future.

The majority opinion in the Aadhaar case, authored by Justice Sikri, quotes Justice Chandrachud’s majority opinion in the Right to Privacy case and states, “Proportionality is an essential facet of the guarantee against arbitrary State action because it ensures that the nature and quality of the encroachment on the right is not disproportionate to the purpose of the law.”

Jutice Chandrachud, in the Right to Privacy judgment, had added that proportionality “ensures a rational nexus between the objects and the means adopted to achieve them.” Justice Sikri’s opinion quotes this as applicable to the majority’s opinion on Aadhaar as well.

According to this test, a measure restricting a right has to fulfill certain conditions:

• First, it must serve a legitimate goal (legitimate goal stage);
• Secondly, it must be a suitable means of furthering this goal (suitability or rational connection stage);
• Thirdly, there must not be any less restrictive but equally effective alternative (necessity stage); and
• Fourthly, the measure must not have a disproportionate impact on the right-holder (balancing stage).

So, Can I Use Aadhaar If I Want To?

“No, even prior to the judgment, they could not use it that way. The only way Aadhaar can be used as identifier is when it is authenticated,” said Prasanna S to The Quint.

A holistic interpretation of the judgment would make it clear that “the majority opinion proceeds to qualify/read down the phrase ‘any purpose’ as used in Section 57 to imply a purpose sanctioned by a law,” Poovayya said.

“Further, contractual use of the Aadhaar authentication process has been struck down since it does not have any correlation with a legitimate public objective, thereby failing to pass muster under the proportionality test. Also, that part of Section 57 enabling body corporates or persons to seek authentication through Aadhaar, is struck down as being violative of the fundamental right of privacy and, sub silentio, being foul of the proportionality test,” Poovayya added.

The judgment also appears to preclude not just biometric authentication, but any other form of identification (including offline KYC, etc) since it specifically mentions ‘commercial exploitation of demographic data’.

The only narrow interpretation which could be applied is that a private party can give you the option of submitting your Aadhaar for KYC, but only to corroborate another document, since they can’t cross-check one’s Aadhaar details against the Aadhaar database.

What About Aadhaar as Just a Paper ID?

The card has no signature by any responsible officer, nor does it have any security features.

Supreme Court advocate Sajan Poovayya is of the opinion that an Aadhaar number by itself, whether in a physical form or otherwise, is not a proof of identity under the existing statutory scheme.

“In this light, although stricto sensu, the majority opinion permits the use of Aadhaar for identification on a consensual basis by private parties, it is of no practical relevance, since it is only upon an authentication as contemplated under Section 8 which grants the Aadhaar any colour of an identity document,” says Poovayyah.

Essentially, anyone can replicate that card. Identification using an Aadhaar card without online authorisation with the Central Identities Database Repository (CIDR) has no integrity.

“Therefore, in sum and substance, a private player such as a body corporate shall not be able to meaningfully utilise the Aadhaar framework for purposes of identity verification after the judgement in Puttaswamy – II,” added Poovayya.

Can Private Use of Aadhaar be Resurrected through Legislation?

A reading of the language used by Justice Sikri is instructive:

“Thus, this part of the provision which enables body corporate and individuals also to seek authentication, that too on the basis of a contract between the individual and such body corporate or person, would impinge upon the right to privacy of such individuals.”

This appears to indicate that the judgment does not envisage the possibility of private players being allowed to authenticate by a subsequent law. This is because the Aadhaar Act itself, as it now stands, can only be viewed as applying to the State, nobody else.

Moreover, the SC could only get around the Money Bill argument by reading down the Act to exclude any application to private players, and the language in the judgment when dealing with the Money Bill issue indicates the same (para 412, pages 486-487). It says that the part of section 57 that allowed a body corporate or person to seek authentication to establish the identity of an individual, has been declared unconstitutional:

“In any case, a part of Section 57 has already been declared unconstitutional, whereby even a body corporate in private sector or person may seek authentication from the Authority for establishing the identity of an individual.”

To sum it all up, although there seem to be spaces that allow interpretation of the Supreme Court verdict, at least for now, private entities cannot use Aadhaar for biometric authentication.