Can eKYC make a comeback if it addresses Right to Privacy? Parag Kar explains

Updated: October 02, 2018 2:07 AM

As an impact of this order, private entities (mobile operators and banks) now have to resort to physical means of validating customers before they enrol, thereby incurring more cost, time and the added risk of identity theft.

aadhaar, supreme court, section 57Sec 57 must take into account privacy rights

The Supreme Court, in a landmark judgment, has declared Section 57 of the Aadhaar Act as unconstitutional. This is specifically important, as this section enabled private entities to use the Aadhaar system for eKYC (Know Your Customer). As an impact of this order, private entities (mobile operators and banks) now have to resort to physical means of validating customers before they enrol, thereby incurring more cost, time and the added risk of identity theft (caused by the possibility of connivance at the ground level).

Aadhaar Act (Section 57)
For the purpose of this discussion, Section 57 of the Aadhaar Act is reproduced below:
“Nothing contained in this act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect.

Provided that the use of Aadhaar number under this section shall be subject to the procedure and obligation under section 8 and Chapter VI.”

Justification (Supreme Court)
The justification given by the Supreme Court (majority judgment) for declaring Section 57 of the Aadhaar Act as unconstitutional is reproduced here verbatim:

a) Section 57 creates an open ended and unspecified set of laws and contracts for which Aadhaar can be used and defeats the principle of informed consent at the time of enrolment and purpose limitation (Page 280).
b) “…we are of the view that a part of Section 57 does not pass the muster of proportionality doctrine” (Page 434).
c) It can be used for establishing the identity of an individual “for any purpose”. We read down this provision to mean that such a purpose has to be backed by law. Further, whenever any such “law” is made, it would be subject to judicial scrutiny (Page 560).
d) Such purpose is not limited pursuant to any law alone but can be done pursuant to “any contract to this effect” as well. This is clearly impermissible as a contractual provision is not backed by a law and therefore first requirement of proportionality test is not met (Page 560).
e) Apart from authorising the State, even “any body corporate or person” is authorised to avail authentication services which can be on the basis of purported agreement between an individual and such body corporate or person (Page 560).
f) Even if we presume that legislature did not intend so, the impact of the aforesaid features would be to enable commercial exploitation of an individual biometric and demographic information by private entities (Page 560).
g) Thus, this part of the provision which enables body corporate and individuals also to seek authentication, that too on the basis of an contract between the individual and such body corporate or person, would impinge upon the right to privacy of such individuals. This part of the section, thus, is declared unconstitutional (Page 561).

The problem (Section 57)
The problem clearly emanates due to the absence of clear statute enabling the provision of eKYC in this section or any other part of the Act. This is quite unlike Section 7 of the Aadhaar Act (which has passed the test of proportionality) reproduced below for reference:

“The Central Government or, as the case may be, the State Government may, for the purpose of establishing identity of an individual as a condition for receipt of a subsidy, benefit or service for which the expenditure is incurred from, or the receipt therefrom forms part of, the Consolidated Fund of India, require that such individual undergo authentication, or furnish proof of possession of Aadhaar number or in the case of an individual to whom no Aadhaar number has been assigned, such individual makes an application for enrolment:

Provided that if an Aadhaar number is not assigned to an individual, the individual shall be offered alternate and viable means of identification for delivery of the delivery of the subsidy benefit or service.”

But even if the statute is clearly defined, such law has to pass through the test of proportionality for it to be held valid by the courts. In the current form, Section 57 is too broad and lacks specificity, unlike Section 7 as described above. Also, the section so drafted has to be an enabling feature for the Act for it to be qualified as a “Money Bill”.

The solution (eKYC)
The current judgment provides clues whether eKYC using the Aadhaar system can pass judicial scrutiny for it to be held valid for execution.

a) As per the Supreme Court, the Aadhaar system in the current form has many features that do not allow customer profiling, and therefore it cannot be used for state surveillance (Page 257/301). If that is so, then how can a private entity exploit/misuse authentication process for commercial gains since customer profiling is not possible?
b) As regards passing the test of proportionality, the whole eKYC process can be made voluntary. In that way individuals who are concerned about the misuse of their biometric data can opt out of this system and use other options.
c) The government needs to amend the Act to include this provision clearly for it to pass the test of judicial scrutiny, just like Section 7 of the Aadhaar Act did.
d) The Aadhaar system should have an option of individuals opting out of the Aadhaar system, if he/she so decides in the future. This will make the process of judicial scrutiny easy and straightforward.
The current judgment of the Supreme Court is clearly thought through and balanced. It has held the Aadhaar system valid by directing only minor amendments. The reason eKYC got stuck off is that there aren’t any clear sections in the Aadhaar Act enabling this provision. Section 57 in the current form is broad and quite expansive. This needed restructuring, given that the “Right to Privacy” has been elevated to the stature of a “Fundamental Right”. As a result, the state cannot draft any laws but laws which are just, fair and proportional. Once that is done, I think the Aadhaar system can be leveraged for many other purposes, thereby benefiting the individual/society, without infringing his right to privacy.

Parag Kar
(The author is VP, Government Affairs, Qualcomm India & South Asia. Views are personal
Reproduced from Parag Kar’s post on LinkedIn.)

Get live Stock Prices from BSE, NSE, US Market and latest NAV, portfolio of Mutual Funds, Check out latest IPO News, Best Performing IPOs, calculate your tax by Income Tax Calculator, know market’s Top Gainers, Top Losers & Best Equity Funds. Like us on Facebook and follow us on Twitter.

Financial Express is now on Telegram. Click here to join our channel and stay updated with the latest Biz news and updates.

Next Stories
1Personal Data Protection Bill, 2019 – special provisions concerning data relating to children and their impact on EdTech and other online businesses
2Regulating digital lending
3The Fed is way behind the curve