Seven important questions on Aadhaar answered
- Published
Over a billion Indians have already registered and obtained their unique identity card
India's ambitious and controversial biometric ID scheme, Aadhaar, has been embroiled in various challenges ever since its inception. The BBC spoke with experts to explain how the programme works and what implications it may have on your data.
More than a billion Indians have enrolled in Aadhaar and have received a 12-digit unique identification number after submitting biometric data.
It started out as a voluntary programme by the Unique Identification Authority of India (UIDAI) to tackle benefit fraud. But it has greatly expanded since, and one's Aadhaar or identification number has become increasingly necessary for common services, from carrying out bank transactions to acquiring a SIM card for a mobile phone.
Most recently, the Indian Supreme Court extended its deadline on ruling whether it was mandatory to link one's Aadhaar with a host of services, including banking and social welfare.
To better understand what this means, we asked experts to help demystify the scope and reach of the Aadhaar scheme.
Ten fingerprints, two iris and facial photographs are taken for issue of the unique identity card
If someone has my Aadhaar number, what kind of information about me can they access?
Based on what the government has said so far about Aadhaar, no one should be able to access any information about you through your Aadhaar number.
A third party can only send a query to the database with your Aadhaar number and your name (or your number and your fingerprint) - the database will respond "YES" if there is a match and "NO" if there is none. In other words, it is only meant to authenticate.
However, there is also an "authentication plus" service - where other details such as gender, age and address are stored, which a querying agency or service provider can access because the law requires them to carry out a 'know your customer' (KYC) verification process. This allows any business to verify the identity of its clients.
For example, telecom operators have used this to quickly fill up customer forms, bypassing the earlier, and more tedious, process of verifying information on paper forms.
Other private firms and third parties could also create their own "Aadhaar-plus" databases - their own customer data coupled with Aadhaar numbers to provide for a more definite identity.
For instance, an e-retailer already has the detailed spending and buying profile of customers. A cab aggregator has the travel profile, including home, office and other frequent stops, of riders.
If all of these add Aadhaar identification numbers to their databases, it becomes an easy way to match these databases.
"The Aadhaar number is a means to getting more information," Nikhil Pahwa, a digital rights activist, told the BBC.
Indians will need the identity number to receive benefits from more than 500 welfare schemes
What if they have only part of my number - can they still use that to get my information?
It depends on how many digits in the number are available to them - they can't access information with only a few digits.
But if they have most of them, they can make multiple attempts to search your name and fill in the blanks with possible number combinations in the UIDAI database until it matches.
If someone has my Aadhaar number or it gets 'leaked', does this mean it can be misused? And if so, in what ways?
Usually, it can't be misused if the only thing that has been leaked is the number. But telecom operators and, in the near future, banks too could use your biometrics with the Aadhaar number for a match.
However, if databases kept by third parties (such as e-commerce companies) include Aadhaar numbers, and those databases are leaked - that is a privacy issue.
This would allow very detailed profiles of citizens being available to buyers, or worse, criminals who may be looking for people with high disposable incomes, for instance.
But any sloppy system can lead to misuse - for example, a service that accepts a photocopy of an ID card, including your Aadhaar card, as proof of identity.
"The Aadhaar number is a permanent ID. As it gets linked to more services, it becomes a single point of failure," Mr Pahwa said.
"Once compromised, all someone needs is another verification number, such as a copy of the thumb and/or fingerprints, or a one time password to gain access to personal information or the bank," he added.
But the Indian government has always insisted that the biometric data is "safe and secure in encrypted form", and anybody found guilty of leaking data can be jailed and fined.
An Aadhaar number has become increasingly necessary for carrying out bank transactions
How safe is it to attach my Aadhaar number to services like online marketplaces or retail stores?
Increasingly such services are likely to demand an Aadhaar number for easy identity verification.
The danger lies in the detailed profile they can build over time based on Aadhaar-linked customer data.
If such data leaks, extremely valuable databases can be built from cross-referencing individual databases to build up detailed profiles of customers of retail services, taxi aggregators and utilities.
This could potentially lead to a serious breach in privacy.
However, the UIDAI maintains that their database "is not linked to any other databases, or to information held in other databases".
If I am an expat, do I still need an Aadhaar?
If you are a foreigner working in India, you can get an Aadhaar for convenient access to some services; a few of which may mandatorily require an Aadhaar number based on the upcoming Supreme Court verdict - such as a mobile phone, or SIM, and possibly all bank accounts and credit cards.
This would depend on the Supreme Court, which has indefinitely extended the deadline to link Aadhaar to multiple services until it delivers a verdict.
The benefits of the biometric scheme are huge, but how big are the risks, asks Justin Rowlatt
What about Non-resident Indians (NRIs)/ Person of Indian Origin (PIOs)?
"Aadhaar is not a citizen number, but a resident number," pointed out Mr Pahwa.
NRI and OCIs (Overseas Citizenship of India) are not eligible to get Aadhaar numbers unless they have stayed in India for a certain period (182 days in past 12 months).
Is it legal for a service to ask me for my Aadhaar details, given that a case about it is still pending before the Supreme Court?
As of now, the Supreme Court has indefinitely extended the deadline for mandatory linking of Aadhaar to multiple services.
So it is legal for them to ask for your Aadhaar details, "but improper," said Mr Pahwa.
Essentially, you can choose to not divulge your Aadhaar number or biometrics when asked to do so - but this could also prompt a business to refuse their service if you do not comply.
"In my opinion, Aadhaar needs to be voluntary and changeable, not linked to biometrics, and you should be allowed to cancel your Aadhaar if you want," said Mr Pahwa.
According to the UIDAI website, "there is no policy to give up Aadhaar". Holders can secure their biometrics using a "lock/unlock biometrics" function on the agency's official website.