Thread by @gautambhatia88

Aadhaar Day 29 Session 2.

Rakesh Dwivedi says that even under Section 57, the UIDAI will exercise supervisory control over private parties using Aadhaar. He says that there must be a law or a contract, and that's an important limitation under the Act.

RD says that because of this, all the State Resident Data Hubs have been destroyed.

Chandrachud J asks whether, once there is a contract under Section 57, the UIDAI is bound to offer authentication services.

RD says no. The UIDAI will determine if authentication is needed.

Chandrachud J says, what if I want use a software app, and the developer asks me to authenticate.

RD that there must be a contract, and the UIDAI has to permit it.

Bhushan J says that Section 57 doesn't envisage the UIDAI coming in the way of a contract.

RD says that UIDAI comes in after the contract, to check whether for that contract, authentication is needed.

Chandrachud J says that there is nothing in Section 57 that allows the UIDAI this discretion.

RD says that this flows from the provision itself.

RD says that the contract must come before registration as a requesting entity and doing authentication. He says this flows from the phrase "pursuant to any law or contract." He says that the UIDAI will not blindly allow it.

Some debate between RD and the bench on this point.

RD says that the contract must also state that authentication must be in accordance with Section 8 and Part VI of the Aadhaar Act.

RD says that under Section 30, the Information Technology Act also applies to issues of storage.

RD is reading out some provisions of the IT Act.

RD says that the IT Act and the Aadhaar Act require the machines to be reasonably secure. He says that this is all that is humanly or legislatively possible.

RD says that there are strict penal provisions under the IT Act. An intermediary who breaks the law faces three years in prison.

RD says that the CIDR has been declared critical information infrastructure under the IT Act.

RD says that anyone who attempts to secure unauthorised access to such protected systems can be imprisoned for ten years.

RD says that access to CIDR is restricted. Each room can only be accessed biometrically.

RD says that you have to go through five layers of biometric checks before you can reach the severs. It is guarded by CRPF men. It is not connected to the internet, so there's no question of software tinkering.

RD says that the mode of encryption has been prescribed.

RD says that reasonable security practices have been prescribed.

RD says that as you go in the public domain, the expectation of privacy is diluted, although it's not lost.

RD says that any body corporate using Aadhaar must have a privacy policy in place.

RD says that recently UIDAI has imposed disincentives on Airtel and Axis Bank for misuse of Aadhaar.

RD shows the Court the notification declaring the CIDR as critical information infrastructure.

RD says that so far as the UIDAI is concerned, Aadhaar is an entitlement - apart from Section 7.

RD says that UIDAI has not made Aadhaar mandatory. It's only mandatory under Section 7, everywhere else it is consensual. As far as other laws go, the Court can examine it.

RD says that there is no excessive delegation under the Act.

RD says that fingerprints and iris scans are not genetic information, not intrusive, are only modes of identification, and are capable of instant authentication. So any further biological attribute can be added later only if it meets this condition and enhances accuracy.

RD says that therefore, there is a limit on what can be added under the Aadhaar Act later. Not just anything - such as DNA - can be added just like that.

RD says that every village has a stamp of casteism. The people who work in the fields and till the soil were rarely going to the PDS. Anybody else would go and collect. So there was theft.

RD says that one important change with Aadhaar is that the person has to come face to face with the distributor. So no longer can someone else go and claim on your behalf.

RD says that when more and more people come face to face with the providers, these issues will get resolved. They will get it, and where they don't get it, they will protect. He says this is the most important aspect of Aadhaar, and it is revolutionary.

RD says that Aadhaar compels face to face interaction. And if someone tries to use their power as a distributor to deny even in that case, the Democratic spirit will be unleashed, and people will protest. That is the result revolutionary aspect of Aadhaar.

RD says that no ID card prior to this was universally held. They are held in a segmented way. Besides, they are only starting points. The point of Aadhaar is deduplication. So nobody has an interest in giving a wrong address. Whichever address you give, it gets frozen.

RD says that therefore, your fingerprints are linked to your identity.

Sorry, have had to rush to another court. Follow @prasanna_s and @SFLCin in the meantime.

Got back just as bench rose.

To continue tomorrow.

Cheers.