Source: https://cis-india.org/internet-governance/blog/privacy/privacy-uiddevaprasad
Timestamp: 2019-04-19 07:00:50+00:00

Document:
In the below note, Deva Prasad, LLM Candidate at NLSIU, explores the challenges that the UID project faces from a legal perspective.
The Unique Identity (hereinafter UID) project has been depicted to be a new face of development that technology could bring about. The UID project has also been sold to masses in India as a solution for accessibility to the service delivery, and as a tool for the eradication of ill-governance. Though the UID tries to build up recognition and legitimacy on the basis of transparency, and delivery of good governance there are also issues of larger importance that have gone unnoticed by many. These include issues of the privacy and dignity of an individual being affected by the proposed UID scheme. An alarming fact is that little concern has been raised by opposition parties regarding the constitutionality and human rights implications that the UID scheme could cause. It is natural to have apprehensions and doubts about the effectiveness of implementation of the UID project, as this scheme is traversing through uncharted waters. Thus, it is important to analyze the socio-political implications in the context of the present political economy in India.
The UID scheme could be viewed as an intended shift in relationship between the state, the market, and the citizen in the new age of globalization and technological advancement. It is very important to note that by merely providing a UID number to an individual, there is no guarantee of developmental accessibility, or rights and benefits that would be accrued to the poor and marginalized communities in India. The National Identification Authority of India Bill, 2010, which has been mooted for the purpose of providing legal status to the UID project, has raised many concerns including, privacy issues, and mechanisms for effective service delivery. More over civil society has pointed out that the legislative and administrative mechanisms created by the UID authority have not been created through a consultative - democratic process.
This paper will look at the challenges that the UID project faces from a legal perspective. Specifically the paper will focus on how the project will affect the privacy and dignity of individuals impacted by the project.
UID is a product of what started as an idea of biometric identity cards for the border states in India in the wake of the increased terrorist activity. In a report, the consulting agency that was meant to determine the feasibility of the biometric card for border communities suggested that the identity cards could be implemented to the entire country. Now the government is trying to implement the new UID scheme by masking it as a developmental agenda. Deeper questions of surveillance by the state, invasion of privacy at all levels, and the very fact of human beings being depicted to be mere numbers in the eyes of state leading to violation of dignity arise as a result of the UID project.
An important aspect of the project that needs to be understood is that as of now, the various data that is collected is stored across multiple sources, and data required for a particular purpose is being taken from individuals at one time. This leads to the creation of informational silos . For example, the data required for booking a rail ticket shall be different from that of opening a bank account. But now with UID, which aims to be used as a multipurpose identification system, all the data pertaining to an individual could be accessed at one time. This could lead to a situation where an individuals’ autonomy, which is a well enshrined concept in human rights philosophy by the great philosophers such as Emanuel Kant , could be severely compromised. In other words, every decision made by a human in India could be under state surveillance. This could potentially lead to the denial of, and access to, many important social opportunities and other facilities for a particular section of people, who could be discriminated against by the state, using the information gathered from the UID. This has been referred to as “functional creep”, which constitutes the expansion of the ambit of usage of a particular system from its initial limit .
UID in the post-9/11 scenario of ‘state paranoidism’, could lead to unwanted monitoring and surveillance by the state. One of the objectives claimed by the UID is that of assisting the state in national security. But as mentioned above, the functional creep aspect may lead to the state monitoring at a level where an individual’s decision making is negatively affected. The UID scheme could also lead to providing the State and intelligence agencies information to legitimate surveillance, but in doing so would infringe on individuals privacy . It is evident that the UID scheme could lead to providing more power to the hands of the state, impact the lives of the citizen, and also may lead to the implementation of hidden agenda's . We should not forget the fact that in the Rwandan genocide it was by using identity cards that the demarcation of the Tutsis and Hutus could be done.
Almost every country that tried to implement national identity cards based on integrated systems had public resistance, because of concerns over privacy. There are many dimensions to privacy, including the privacy of a person, privacy of communications, territorial privacy and privacy of personal data . Privacy of the person concerns the privacy of body, and its integrity and freedom of not being infringed upon. Privacy of communications deals with the freedom to have communications by any means without being infringed upon by surveillance, telephone tapping etc. Territorial privacy addresses freedom from encroachment into domestic and official spaces by the way of surveillance. Identity and informational privacy or data privacy deals with the protection of information, especially sensitive information.
The UID leads to a situation of access to all the sensitive information of the people enrolled in the UID. This information could be misused by authorities. The risk that the UID poses to an individual’s privacy is enormous as information that is now scattered in the public domain will be brought into one point of convergence through the UID. Further, there are issues of privacy infringement due to the use of biometric information in the project. The collection of, and identification based on biometric information could be understood as a breach of one’s territorial privacy and one’s data privacy .
As persons are being identified on the basis of sensitive biometric information, the risk of being profiled, targeted and marginalized by the state on the basis of this sensitive information is very high. Hence, there is a requirement for the protection of data privacy and territorial privacy. The claims that the UID number will provide efficient access to developmental projects and facilities, should be viewed with suspicion, because when sensitive information of this nature is placed in the control of the state, it gives enormous power to the state.
The greatest aspect of human rights could be identified as the acknowledgment of dignity of human beings. The UN Charter and the Universal Declaration of Human Rights both emphasize this point. Dignity signifies the innate rights of human beings to be treated with respect and ethical conduct . Dignity is an extension of the thought, and the recognition that all individuals have inherent inviolable rights . Freedom is also an aspect that has underpinnings in the concept of dignity.
In the UID project, the risk of surveillance, and breach of privacy clearly violates human dignity, as it curtails the freedom of choice that human beings are able to make, by placing individuals continuously under the threat of intrusive surveillance by the state, and the public domain. The factor of the UID scheme that truly robs human beings of their dignity is the treatment of human beings as mere numbers. In the case that an individual’s UID number is manipulated, used by someone else fraudulently, lost, or a technical problem occurs - the individual will be a non-existent entity before the state, having no value, as all the benefits and rights could be claimed only through the UID.
Actually, in the claim of public interest the UID scheme may cause more harm than good to the rights of the citizens, which are enshrined in the Constitution of India, 1950. Furthermore, the developmental claims by the UID of security and administrative efficiency cannot be a valid justification for infringement on the right of life under the Article 21 and the right to freedom of expression and movement as provided in the Article 19 of the Constitution of India, 1950. Identifying the right to privacy and dignity, and its scope under the Constitution of India, 1950 is very important for the purpose of gauging the impact that the UID scheme will cause upon these rights.
There is no direct provision providing for the right to privacy in the constitution of India. Hence the right to privacy needs to be understood on the basis of the decisional jurisprudence developed by the constitutional courts in India. Furthermore, the reason which the right to privacy is a non-defined right has its basis in the social context of India . The development of the right to privacy in India could be traced from the case of M.P. Sharma v. Satish Chandra , in which case the Supreme Court held that the Indian constitution does not conceive the right to privacy while determining the contours of search and surveillance by the police. This narrow interpretation of the constitution reflects the view point of the judiciary of that particular time period .
In the case of Kharak Singh v. State of Punjab , the Supreme Court observed that: “The right of privacy is not guaranteed under our Constitution and therefore the attempt to ascertain the movements of an individual, which is merely a manner in which privacy is invaded is not an infringement of fundamental right guaranteed by Part III”. This again reflects a restrictive interpretation of the constitution. But, in the case of Govind v. State of M.P , the Supreme Court took a viewpoint which represents a paradigm shift in perspective from their earlier rulings. In this case the Supreme Court observed that: “There can be no doubt that the makers of our Constitution wanted to ensure conditions favourable to the pursuit of happiness”. They certainly realized, as Brandeis, J. said in his dissent in Olmstead v. US, the significance of man’s Spiritual nature, of his feelings and his intellect. They sought to protect the individual in their beliefs, thoughts, their emotions and their sensations. To do this they must be deemed to have conferred upon the individual a sphere where he should be left alone, free from governmental access”.
In P.U.C.L. v. Union of India  , the Supreme Court of India, while laying down the standards for telephone wiretapping had observed that the right to privacy is an integral part of the fundamental right to life enshrined under Article 21 of the Constitution and this right shall be available only against the state. Further in the case of Mr. ‘X’ v. Hospital ‘Z’  also Supreme Court acknowledged the right to privacy, but held that it is not an absolute right.
The cases mentioned above clearly establish that the right to privacy is very much a part of the fundamental rights under the Constitution of India. Furthermore, one must not forget that the right to be left alone, and to be free in one’s private space is an important right, which the Supreme Court has accepted in the case of Naz Foundation v. Government of NCT and Others . Right to privacy cannot be claimed to be a negative right restraining the power of the state, but it should be viewed to be a positive duty casted on the state to crated institutions that would help in protecting the private space and life of the individual .
Further, in the case of Prem Shankar Shukla v. Delhi Admn the Supreme Court observed that human dignity forms part of our constitutional culture, and in Francis Coralie Mullin v. Administrator, Union Territory of Delhi and Ors.
 the Supreme Court through Bhagwati, J. observed that: “...We think that the right to life includes the right to live with human dignity and all that goes along with it, namely, the bare necessaries of life such as adequate nutrition, clothing and shelter and facilities for reading, writing and expressing oneself in diverse forms, freely moving about and mixing and commingling with fellow human beings. Every act which offends against or impairs human dignity would constitute deprivation pro tanto of his right to live and it would have to be in accordance with reasonable, fair and just procedure established by law which stands the test of other fundamental rights .” Hence one could observe from the above cases that the Supreme Court accepted that human dignity implies expressing oneself in diverse forms and acknowledges the value and worth of all the individuals in the society.
In the following part, the UID project is contextualized with the Right to privacy and dignity as provided for in the Indian Constitution. Ways to tackle the various issues brought about by the UID project are discussed.
In the above two chapters, issues concerning the UID, the right to privacy, and dignity, upon which the UID scheme has heavy implications for, are discussed. Now it is important that we look at aspects of how the right to privacy under the Constitution of India and the UID could be reconciled, and ways to approach the issues arising out of The National Identification Authority of India Bill, 2010.
Regarding the right to privacy in India, the decisional jurisprudence has clearly acknowledged the fact that it forms part of Article 21. In this context privacy can be understood as the right to be left alone, as envisaged by the Justice Louis Brandeis . Being a right, that is acknowledged to be part of Article 21; violation of this right by the proposed UID scheme would seem to be unconstitutional.
When considering this, one aspect that needs to be kept in mind is that the cases that have come before the Supreme Court have thus far been related to the privacy of a person and privacy of communications. There have been no affirmative rulings of the right to privacy in any cases regarding personal data and territorial privacy. Also legislations such as the Anti-Terrorism Act of 2002, Information Technology Act of 2000 and the Telegraph Act of 1885 have limited restriction on privacy .
Looking at the different dimensions of privacy, and the contextual need for protection of privacy in India, clearly there is need for specific affirmative rights to be established in the constitution regarding privacy, rather than deriving the right to privacy from the Article 21 or Article 19. The affirmative right of privacy would help to bring in its ambit the aspects of territorial privacy and personal data privacy. If privacy was an established right, it would lead to a clearer definition of what is the right to privacy in the Indian context. Such clarity is important as projects such as the UID are increasing the need for individuals to have the right to privacy. Also, there is a need for a comprehensive privacy legislation, which would ensure the protection of personal and sensitive data, and which may also establish a regulatory body. Perhaps such a privacy legislation could be structured along similar lines as the data protection commissioner’s office, which exist in Canada, Ireland , and other developed informational economies.
Further it is also important to highlight the fact that The National Identification Authority of India Bill, 2010 , completely ignores the issue of privacy. Within the Bill there exist no provisions that would help in the protection of an individual’s personal privacy. Further, there is a great amount of brouhaha around Clause 33 of the proposed Bill. Clause 33 states that the disclosure of information for national security, which runs the risk of surveillance, tracking, profiling and social, shall be controlled by the state and its agents .
The Bill does not make the UID a mandatory requirement - as per the Clause 3 - it is the option of the individual to choose if he/she wants the UID. Hence the Authority claims that there is no breach of privacy as the people have consented, and have voluntarily provided their information. But there are two aspects that must be considered. One is that even though there is no explicit compulsion for a person to obtain a UID number, there may be indirect compulsion, due to exclusion and inaccessibility to services and facilities for those who do not have a UID number. Thus, in this sense the UID number will become mandatory. The second point to consider is that even though the information is given voluntarily, the right to privacy over sensitive personal information does not exist. To avoid situations where an individual’s privacy is violated by the UID scheme, there needs to be both a specific provision that states clearly that no particular services or facilities shall be denied to citizen on basis of lack of UID, and a provision protecting the privacy of collected information.
From the discussion above, it is evident that the dignity of an individual in the context of UID would come into question. Furthermore, the dignity of human life is questioned by the UID project, because of the infringement of private space of an individual by the state, and the constant surveillance that the UID could bring about. Furthermore, the choices made by human beings will be seriously influenced by the changing power equation between the state and the individual.
It is also being claimed that a UID number will provide the poor of this country with a real identity. It will also provide the poor access to developmental programs and effective governance. But there is a point that is missed here. The UID cannot by itself provide any identity, rights or facilities to the poor . In reality these entitlements can only be provided by the law, by policy measures, and by treating the constitution and law to be tools of social engineering.
Thus, to protect the dignity of individuals it is important to protect the privacy of individuals. This includes taking measure that would help in limiting the extent of surveillance by the state, and pro-actively protecting the worth of human beings by not solely linking all the facilities and services of the government to the UID. Hence, The National Identification Authority of India Bill, 2010, should include the provisions that would help in protecting the above points. Furthermore, as mentioned above, a specific provision addressing the privacy of individuals should be included in the Constitution of India, a privacy legislation addressing the protection of personal information, and a privacy regulator should be formed.
In view of the increased protection required specifically for territorial privacy and data privacy, there should be a provision added to the Constitution of India that deals with multiple dimensions of privacy- such as personal, territorial, communication and data/information. Such a provision would bring clarity as to the extent of the right to privacy.
There is need for a comprehensive privacy legislation which would ensure the protection of personal and sensitive data of people. There is also the need for an established regulatory body. This could be structured along similar lines as that of the data protection commissioner offices, which exist in Canada, Ireland, and other developed informational economies.
As regards to The National Identification Authority of India Bill, 2010 - there is a need for a specific provision that states clearly that no particular services or facilities shall be denied to citizen on basis of lack of a UID number. Also, there is the need for a provision that protects the privacy of the already collected information. Clause 33 of the Bill, which allows for the disclosure of information for national security, needs to be restricted and events of national security need to be clearly defined.
Usha Ramanthan, A Unique Identity Bill, Economic and Political Weekly, 10-14 (2010).
Ravi Shukla, Reimagining Citizenship: Debating India’s Unique Identification Scheme, Economic and Political Weekly, 31-36 (2010).
Sheetal Asrani-Dann, The Right to Privacy in the Era of Smart Governance: Concerns Raised By the Introduction of Biometric-Enabled National ID Cards in India, 47 The Journal of India Law Institute, 53-95 (2005).
Immanuel Kant (Translated by Herbert James Paton) The moral law: groundwork of the metaphysic of morals, 42 (2005).
Shuddharbrata Sengupta, Every Day Surveillance in Sarai Reader 2002: The Cities of Everyday Life, 297-301 (2002).
Lawrence H. Tribe, American Constitutional Law, 1305 (1988).
Ruchi Gupta, Justifying the UIDAI: A Case of PR over Substance, Economic and Political Weekly, 135-136 (2010).

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.