SC Bars Companies From Using Aadhaar, But What About Existing Data?

Terming the Supreme Courtroom verdict on Aadhaar a jiff of fresh air for Indian citizens, experts said a completely new government has to be put in place to protect the Aadhaar data that is lying with private companies.

Stating that private entities or individuals cannot avail Aadhaar information to provide consumer services, the apex court struck downward Section 57 of the Aadhaar Act which allowed sharing of data with private entities.

It ways that telecom companies, eastward-commerce firms and private banks cannot ask for biometric and other data from consumers to provide their services.

"The Aadhaar verdict is a huge sigh of relief for citizens. The humongous task now is to ensure that the data that is already with private companies is not misused or sold," Pavan Duggal, the nation's leading cyber law expert, said.

"The data now needs to be dismantled but the onus is to make sure companies exercise not brand copies of the data and use it to monetise their operations. The big question is which agency will audit this humongous task," added Duggal, also a leading Supreme Court lawyer.

The noon court also said that Aadhaar information can't exist shared with security agencies in the name of upholding national security and individuals likewise can complain about theft of their Aadhaar data.

"Private companies played a large gamble of integrating Aaddhar information with their systems wherein they spent a lot of money. The whole do is now futile and the country now needs a fresh Aadhaar ecosystem," Duggal noted.

The Unique Identification Potency of India (UIDAI), said Duggal, had already lodged more than 50 FIRs against private companies for Aadhaar data alienation.

"Today'due south judgment as read out in court signals massive changes in the Aadhaar project and the Human activity. The legitimacy of its stated purposes is destroyed. Even the majority signals significant business organisation by reading down portions," tweeted New Delhi-based lawyer Apar Gupta.

Although experts are yet to read the verdict in fine impress, they said the Supreme Court'due south directive to Centre to bring a robust information protection law is the need of the hour.

"The Aadhaar data is saved in data centres outside the boundaries and law of our country. There is an urgent demand for addressing newly emerging legal and cyber security challenges concerning Aadhaar ecosystem on an urgent basis," Duggal said.

The Supreme Court, in a landmark judgment last year, declared privacy a cardinal right. This set the authorities in motion to take steps to bring a new information protection legislation for the country.

The Justice B.Due north. Srikrishna Commission submitted the Personal Information Protection Neb 2018 in July, suggesting amendments to the Aadhaar Act to provide for imposition of penalties on information fiduciaries and compensations to data principals for violations of the data protection police.

The 213-page report suggested amendments to the Aadhaar Act from a data protection perspective.

According to Duggal, "not just cosmetic changes, there is an urgent need for addressing newly emerging legal and cyber security challenges concerning Aadhaar ecosystem on an urgent ground."

Supratim Chakraborty, Associate Partner at law firm Khaitan & Co, said the verdict that private parties cannot have access to individuals' information was a double-edged thing.

"From a socialistic perspective and individualistic perspective, you demand to accept proper safeguards as to how your data is being used past a private party.

"Still, from a business perspective, information technology could increase their expenses if they need to collect likewise much data one by one from an individual. It compels us to ponder whether there is a correct way to do business while protecting the privacy of users," Chakraborty said.

Airtel Payments Bank Must Perform KYC Of Users Again: RBI — Airtel Payments Bank misused Aadhaar KYC to open bank accounts for users without consent

In Europe, equally function of the European Union's Full general Data Protection Regulation (GDPR) that came into force from May 25, Eu citizens at whatsoever point may object to an organisation's handling of their personal data.

The regulation specifically names "direct marketing and profiling" as personal data uses to which individuals may object.

Co-ordinate to Duggal, India should not cut-paste whatever other country'south law and must strive for data localisation. "There is a need for more comprehensive legal frameworks to protect and preserve data and privacy of individual Aadhaar account holders in specific and the Aadhaar ecosystem stakeholders in full general," Duggal noted.