Contributor: Shruti Trikanad
Organization: Independent researcher
Last update:
Stock of legislation / current regulation on digital ID
Chapeau
India stands out as (one of?) the first countries to implement a digital identity system (called the Aadhaar system) and (one of?) the first to be legally challenged on the basis of constitutionally protected rights of privacy. Notably, the Aadhaar system was initially implemented via an executive order in YEAR, and not made law until YEAR. Even then, it was passed as a financial bill that did not require input from [the upper house], despite the fact that it is used for more than just financial purposes, including filing taxes, voting, government services… A Data Protection law was enacted in 2023, despite the Aadhaar system functioning for nearly 14 years up to that point, and it is unclear as of yet how much of the Act will be applied to processing of data within the Aadhaar system.
India notably has the Aadhaar program which is a model of identification for those living in India. This is not a citizenship program and is not mandated. Yet, to access certain programs such as paying taxes you have to be enrolled in the Aadhaar program. Since the Act that created Aadhaar was a money act, there was no civil engagement and the top tier legislation was not involved. There have been judicial challenges to the law, but India’s Supreme Court has upheld the majority of the program. There are no human rights safeguard within the program. There is a charge to the UIDAI to take specific measures to ensure that vulnerable people communities have access to the program, but it has not been very successful.
1.1. Which are the specific laws creating and regulating Digital ID and what is their hierarchy (constitutional, organic laws, regional/sub-state laws, regulations, procedures)?
- The Aadhaar program in India is backed by the Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act, 2016 (“Aadhaar Act.”) This Act was challenged before the Supreme Court of India for its impact on the constitutionally protected rights of privacy, but the court upheld most provisions of the Act.[1]
- Although the Aadhaar Act sets out most of the terms of the Aadhaar ID, and the rights and obligations of Aadhaar holders, it is implemented by a statutory body— the Unique Identification Authority of India (“UIDAI”)— through an ever-growing set of Regulations and Notifications.
[1] K.S. Puttaswamy v Union of India, (2019) 1 SCC 1
1.2 What is the definition of Digital Identity brought by the Law or regulation, if any?
The Act does not define digital ID, but lays emphasis on a unique identification number— the Aadhaar number— as being the key feature of the Aadhaar system. It also defines authentication of the Aadhaar ID as a process through which the Aadhaar number, along with the ID holder’s demographic information or biometric information, is submitted to a central database for verification.
1.3 Which are the corresponding Data Protection laws, if existing?
1.4 What are the main elements of the Digital ID framework (scope, eligibility criteria, remedies)?
- Scope & eligibility: Residents of India are entitled to get the Aadhaar ID (and in some specific circumstances, non-residents as well.) Legally, it is not mandatory for residents to obtain the Aadhaar ID; however it is mandatory to use it to verify their tax records, and for access to some government services, and is thus mandatory by default. Aadhaar registration is open for both adults and children.
- Remedies: The Act sets up an officer of the UADAI to hold inquiries on complaints by ID holders to the UIDAI. Appeals can be made from the officer’s decisions to an appellate tribunal, and finally, the Supreme Court of India.
1.5 Are there specific complaint mechanisms foreseen in the Digital ID and Data Protection laws?
- Digital ID: Yes
- Data Protection: Yes, but not yet sure how applicable it will be to the Aadhaar system.
1.6 Was public participation ensured when these were drafted and enacted? How?
The Aadhaar Act was enacted about 7 years after the Aadhaar system was operationalised in India, operating only on the basis of an executive order until then. As a result public participation was not assured in any meaningful way. Additionally, the Aadhaar Bill was passed in the legislature as a ‘Money Bill’, which meant that it did not need the assent (or involvement) of the Upper House of the Legislature— this was widely contested because the Constitution of India defines a Money Bill to be one that only deals with specific financial provisions.[1]
1.7 Was there a Human Rights Impact Assessment prior to the enactment of the laws?
No
1.8 Does the country’s Digital ID framework reflect any particular digital ID model existing elsewhere (e.g., similar/comparable to X country)?
There are now a lot of similar models, but not at the time.
1.9 What is the interrelation of these Digital ID laws with existing nationality laws (does Digital ID reflect nationality status, is nationality an eligibility criterion or only legal residence)?)
The Aadhaar ID is not proof of citizenship, as it is available for all residents. However, it is now being linked to voter identification (which is only available to citizens) and is being imbibed in other laws and civil registration systems.
1.10 Court cases: Is there litigation going on? Has there been prior litigation? What are the specifics of those cases (list and summarize)?
Court cases: Is there litigation going on? Has there been prior litigation? What are the specifics of those cases (list and summarize)?
1.11 How has Digital ID been rolled out?
Since it has been operationalised for many years now— and is mandatory for several purposes— it has reached high levels of enrolment across the country, but still lacks in particularly vulnerable communities.
1.12 Has there been any special measures to ensure access for vulnerable and isolated communities (e.g., for PwD, minorities, elderly) such as mobile offices or free legal aid? Are those measures provided for in law?
The Aadhaar Act requires the UIDAI to take special measures for issuance of Aadhaar numbers to women, children, senior citizens, persons with disability, unskilled and unorganised workers, nomadic tribes or to such other persons who do not have any permanent dwelling house.[1]