Supreme Court has banned private companies from using Aadhaar. What does it actually mean?

For many in India’s private sector, the Supreme Court’s ban on private companies using Aadhaar means it is time to rethink business strategies. They may have to do so only temporarily, going by signals coming from the government. Indeed, high-stakes legal and policy clashes have already begun.

Amitabh Kant, the chief executive officer of Niti Aayog, the government’s think tank, is reportedly unhappy with the court’s order while Ravi Shankar Prasad, minister for law and information technology, has asked the Unique Identity Authority of India, which manages the Aadhaar project, to prepare a plan of action in light of the judgement. Finance Minister Arun Jaitley has indicated that the Narendra Modi government will consider introducing a new law to allow the private sector to use Aadhaar. The Payments Council of India, a part of the industry group Internet and Mobile Association of India, is said to be lobbying finance and law ministries to overturn the order.

Clearly, the fight over Aadhaar is far from over.

Inconsistency in the judgement

On September 26, the Supreme Court upheld the constitutional validity of most of the Aadhaar Act, but struck down parts of it, including Section 57, as being unconstitutional.

Section 57 allowed the state as well as any corporate body or person to use Aadhaar “for establishing the identity of an individual for any purpose”. Such use of the biometric identity number could be based on law or contract, and was conditional on meeting certain procedural and security obligations under other provisions of the Aadhaar Act.

In his judgement for the majority, Justice AK Sikri finds “some portion of Section 57” to be unconstitutional. This portion is that which “enables body corporate and individual to seek authentication” [sic]. He also rules that a part of Section 57 is disproportionate, and an unconstitutional interference in an individual’s fundamental right to privacy.

It appears the majority wants to restrict the use of Aadhaar for verifying the identity of an individual seeking to avail subsidies, benefits or services financed by the Consolidated Fund of India. A corollary is a ban on private entities using Aadhaar to establish identity. Except, the judgement has more to say, giving rise to inconsistency and rather curious outcomes.

Sikri notes that Aadhaar can be used for “other purposes”, likening it to identity proofs such as passport, PAN card, driving licence and ration card. So, if anyone voluntarily uses Aadhaar as identity proof, “there may not be a problem”. The consequence is a rather curious situation: a person may voluntarily want to use Aadhaar as identity proof but may not be able to since non-state entities are not allowed to accept Aadhaar to verify identity.

There is still more confusion.

Commenting again on Section 57 just before concluding his judgement, Sikri observes, “In any case, a part of Section 57 has already been declared unconstitutional whereby even a body corporate in private sector or person may seek authentication from the Authority for establishing the identity of an individual”. It is a departure from his observations earlier in the verdict. Here, Sikri speaks specifically about excluding private sector companies from using Aadhaar for identity verification, as opposed to all body corporates earlier. If only this observation is relied on and not the majority’s earlier ones, it would allow public sector companies such as Air India, Bharat Sanchar Nigam Limited or the Life Insurance Corporation to accept Aadhaar as proof of identity but not their private sector competitors such as Vistara, Reliance Jio or Kotak Life Insurance. It would mean a competitive advantage to public sector and an increase in operational costs for the private sector, eventually passed on to the consumer.

But, hold on, for the majority is not yet done.

Sikri’s final set of observations on Section 57 come in the judgement’s “Summary and Conclusions”. Here, he finds Section 57 in its “present form” to be “susceptible to misuse”, indicating that he may not be averse to a modified version of Section 57. This too is a departure from some of his previous observations and the question now becomes one of changes that need to be made to Section 57, or an equivalent provision, to make it constitutional. Sikri provides some direction. First, Aadhaar must be used to establish an individual’s identity only for purposes backed by law, as opposed to “any purpose” under Section 57. Second, such a law will be open to judicial scrutiny. Third, Aadhaar may only be used pursuant to a law, and not a contract as was permitted by Section 57.

Sikri’s concluding observations provide some guidance about the use of Aadhaar by non-state entities but they offer no clarity on the dichotomy that his words may have created between public and private sectors. On the one hand, he is concerned about private entities being able to commercially exploit Aadhaar data, biometric and demographic, and on the other, he strikes down the part of Section 57 which allowed all “body corporate and individuals also to seek authentication, that too on the basis of a contract between the individual and such body corporate or person” [sic].

Not all body corporates are private entities; using the terms interchangeably only creates confusion.

Impact on the private sector

After the Aadhaar judgement, private companies across sectors are looking at increased operational costs and changes to their business models, at least in the short to medium term. These changes are not insignificant and will impact not just the companies but also consumers and markets as a whole.

For example, Aadhaar-enabled KYC played a large part in Reliance Jio’s success story, which caused a ripple effect across India’s telecom sector, including a sharp fall in service rates, even market consolidation and mergers. Now, barring a new law that enables non-state entities to use the Aadhaar infrastructure, disruption at this scale in the near future may prove difficult.

For the country’s digital payments industry, particularly fintech startups, Aadhaar-based verification helped keep costs low. Startups are especially sensitive to operational costs. The increased costs of non-Aadhaar based KYC will now be met either by burning investor capital or, more likely in the long term, passing them on to the customers. In case of fintech firms such as cryptocurrency exchanges, verifying users’ identity through Aadhaar was essential to prevent illegal trading.

Perhaps most importantly, the ruling on Section 57 will affect how vast sections of India’s population access services such as micro ATMs, which are designed to serve people in rural areas, microcredit lenders and fintech startups offering products and services to people excluded from traditional banking channels.

Many customers such financial inclusion platforms serve might have no other way of verifying their identity, and the exclusion of Aadhaar as an identity verification mechanism will mean exclusion from such services altogether.

What’s the way forward?

None of this is to say the Supreme Court erred in striking down Section 57, for it clearly went well beyond the intended scope of the Aadhaar Act. But the court should have struck it down in a clearer manner. As an aside, invalidating Section 57 was likely the only way Sikri saw of saving the Aadhaar Act from being held unconstitutional in its entirety, not least because it was passed as a money bill under Article 110 of the Indian Constitution.

What is now needed is for the government to pass a law enabling voluntary use of Aadhaar in the private sector. That is, people seeking to use Aadhaar to verify their identity should be able to do that, but the private sector must not be able to compel its use and must offer alternative means of identity verification. This would allow an individual to make decisions about their own information, an essential aspect of the fundamental right to privacy, which includes informational privacy.

Of course, any such law passed by Parliament must be subject to judicial scrutiny and meet the proportionality standard put forth in the 2017 right to privacy judgement. Some have argued that any law allowing the private sector to access the Aadhaar infrastructure will be unconstitutional. I disagree. A legislation that restricts the use of Aadhaar to private entities in regulated sectors such as banking, telecom and insurance; makes Aadhaar use voluntary and requires companies to offer alternative means of identity verification; encompasses stringent data protection requirements, including consent, accountability and strong penalties for breach, is likely to be held constitutional.

Not allowing the voluntary use of Aadhaar in the private sector even under a new law with sufficient safeguards would take away an individual’s ability to make decisions about their own information. Moreover, public sector firms would gain unfair competitive advantage if they are allowed to use Aadhaar-based authentication, but not private companies. Most of all, it would exclude “the marginalized sections of society” which the Supreme Court intended to empower through this judgement in the first place.

Nehaa Chaudhari heads the public policy practice at Ikigai Law, a policy and law firm focused on emerging technologies including fintech services. In the past, the firm has provided corporate advisory to some members of the ‘Coalition for Aadhaar’, but has not advised any of the parties on the Aadhaar dispute. Her twitter handle is @nehaachaudhari.