After demonetisation: Is the thrust on digital transactions a violation of privacy?

In most liberal democracies, citizens have realistic fears whether the ban on cash and digitalisation of banking will erode the foundations on which the State-citizen relationship has historically been structured. An important attraction of using cash is that it leaves no trail, and ensures the privacy of transactions. On the other hand, digital transactions leave a trail and can be traced back even after decades.

In most modern legal systems, the right to personal liberty subsumes the right to privacy. Thrusting cashless and digital transactions robs citizens of this fundamental right, and this has been a matter of contention even in countries that are the home to cutting-edge innovations in financial technologies, like Switzerland. The SNB’s Zurbrügg [Fritz Zurbrügg, Vice-Chairman of the Governing Board, Swiss National Bank] articulated this deep-rooted concern in his country:

“Are my electronic payment and account data protected against unauthorised access and misuse? In other words, is my financial privacy guaranteed? In contrast to cashless payment methods, cash presents no data security problems. It offers the certainty that one’s privacy is protected. Please do not misunderstand me: the suppliers of cashless payment applications invest a great deal of money in ensuring the security of their systems, and the existing systems can generally be considered to be secure. However, the availability of cash means that anyone can decide, at any time, exactly how secure they consider it to be, and how much information they want to share with whom. Or, as my Bundesbank colleague, Carl-Ludwig Thiele, put it recently: ‘The right to informational self-determination and respect of privacy is a valuable commodity, which should not be watered down or ceded lightly.’”

The distinction between privacy and informational self-determination, which Thiele emphasises in the above quote, is a more recent outcome of the phenomenal growth of computational technology and the Internet. The early view of privacy, as enshrined in the famous Warren and Brandeis essay of 1890, was the “right to be let alone”. While the fundamental principle enshrined in the 1890 formulation remains powerful, the growth of computing technologies and the Internet over the years have meant that personal information of citizens are collected and stored by multiple agencies, public and private; this is what Nilekani referred to as a “data-rich” world.

What happens to the bits of personal information lying scattered all around? Can anyone access it without the knowledge of the individual?

If accessed without the knowledge of the individual, can it be characterised as violating the spirit of “the right to be let alone?” Consequently, the understanding of privacy has been enriched into the idea of informational self-determination, which underlined the importance of “consent” of individuals. The right to informational self-determination of an individual was defined by a German constitutional court in 1983 as follows:

“…in the context of modern data processing, the protection of the individual against unlimited collection, storage, use and disclosure of his/her personal data is encompassed by the general personal rights of the German constitution. This basic right warrants in this respect the capacity of the individual to determine in principle the disclosure and use of his/her personal data. Limitations to this informational self-determination are allowed only in case of overriding public interest.”

In sum, inside a cashless and digital world of finance, it is not just the right to privacy that is potentially violated. The right to informational self-determination is also violated. This is the reason why activists demand both a privacy law and a data protection law that go hand-in-hand. A country like India, unfortunately, has neither a privacy law nor a data protection law.

There are two further issues. One, in competitive market societies, can personal information be turned into a commodity for private profiteering? If yes, it may be tantamount to the commodification of the person itself. Two, given that enormous amounts of personal information will be available to the State, can the State misuse it to target dissenting citizens and monitor their everyday activities? If yes, the outcome would be a surveillance state, where the assumed trust between the citizen and the State breaks down. As governments push cashless transactions, the potential for surveillance of the citizens rise. In countries like India with no privacy or data protection legislations, the threat is only more real.

A major threat to privacy and informational self-determination in India comes from Aadhaar, the country’s massive unique identity scheme.

Here, all Indian residents are provided a unique identification number linked to their demographic particulars and biometrics – photograph, fingerprints and iris scans. On the one hand, the government has been forcing the hands of citizens to compulsorily register for an Aadhaar number and “seed” it into the service providing agencies. On the other hand, it has been trying to “leverage” Aadhaar to create a cashless economy.

The UIDAI has, for years, been working in close coordination with multiple private providers of cashless payment instruments such as credit cards, debit cards, mobile banking and digital wallets. After demonetisation, the government also launched a new mobile application – Bharat Interface for Money (BHIM) based on the UPI – to encourage electronic payments through mobile devices. The efforts to render Aadhaar ubiquitous in a cashless world has strengthened fears of commodification of personal data as well as the entrenchment of a surveillance State.

In a financial ecosystem driven by Aadhaar, there are also strong and genuine fears of exclusion of the poor. In Aadhaar-based cashless transactions, fingerprints of users are used to authenticate individual identities. However, given that a large share of India’s population is involved in manual labour and the share of the elderly in the population structure is rising, the average quality of fingerprints is poor. As a result, as has been documented, there are large error rates in the centralised biometric authentication of beneficiaries in addition to the presence of disruptive factors like lack of electricity and poor Internet connectivity.

Even a one per cent error rate in a population of 1.2 billion implies the exclusion of more than 10 million persons. In reality, however, the error rates have been unacceptably large. The Indian government’s own Economic Survey 2016–17 presented a depressing picture in this regard:

“While Aadhaar coverage speed has been exemplary, with over a billion Aadhaar cards being distributed, some states report authentication failures: estimates include 49 per cent failure rates for Jharkhand, 6 per cent for Gujarat, 5 per cent for Krishna district in Andhra Pradesh and 37 per cent for Rajasthan. Failure to identify genuine beneficiaries results in exclusion errors.”

Biometrics are also poorly secured as an authentication token. Normally, when a password or PIN (personal identification number) is stolen or lost, the user can change the password; only the user knows the password. In contrast, biometric passwords like fingerprints cannot be changed. Fingerprints are also left behind wherever one goes and on whatever one touches. Once stolen or lost, the security of a user’s account is permanently compromised.

In other words, when Aadhaar-based biometric authentication becomes pervasive, identity thefts are likely to rise. Such glaring threats to security and freedom have not been appreciated in India before making Aadhaar compulsory for all residents and using it in financial transactions.

Typically, liberal societies need to uphold the freedom of the individual to choose his/her mode of payment.

Such a freedom of choice should be the foundational principle that guides currency management policies. For instance, according to Zurbrügg, the SNB had no plans to do away with cash in Switzerland, and:

“…moreover, it has no preference for one payment method over the other – cash or cashless. Instead, it ensures both that the demand for cash is satisfied and that cashless payments function smoothly. We are mandated by law to perform both tasks, and they have equal status. The public is therefore free to choose between cash and cashless payment methods. This is an important point. The possibility of carrying out payments is a basic prerequisite for participation in economic life, and must be available to all. It should not be attached to conditions such as the need to hold a bank account.” (Emphasis added.)

Unfortunately, the Indian liberal response to demonetisation was not distinguished by such an “enlightened” view. Liberal, and libertarian, articulations on demonetisation, which typically pitch the war on cash as adversarial to free markets and individual liberties, came not from India but from the West. Two examples should suffice.

In a January 2017 article, Steve Forbes drew parallels between demonetisation and India’s forced-sterilisation programme in the 1970s. For Forbes, a cashless economy should be created not by force but by people’s choice, and a free market economy would over time lead to a reduced use of cash. Instead, to create a cashless economy, the Indian government had committed “a massive theft of people’s property without even the pretense of due process.”

A Wall Street Journal editorial was another sharp indictment calling the imposition of a cashless society as “antithetical to economic liberty”. It argued that the policy thrust to forcefully create a cashless society was a “blunder”, and India “should respect citizens who want to keep at least some cash”. Indian liberals, it would appear, had fallen between two stools: neither able to argue for a free market nor up to the task of protecting individual liberties!

Excerpted with permission from Note Bandi: Demonetisation and India’s Elusive Chase For Black Money, Edited and Introduced by R Ramakumar, Oxford University Press.