Lok Sabha Question No. 4460 (UNSTARRED), answered on 2016-12-14
Subject: Linking of Documents with Aadhaar
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: NINONG ERING

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 4460

TO BE ANSWERED ON: 14.12.2016

## LINKING OF DOCUMENTS WITH AADHAAR

## 4460 SHRI NINONG ERING:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a)     whether the States have been directed to link caste/domicile certificates with Aadhaar Card number which violates Section 4(2) of the Aadhaar Act, 2016;
- (a) if so, the details thereof and the reaction of the Government thereto;
- (b) whether  the  Government  has  proper  security  system  to  prevent  the  misuse  of  data collected and linked and to protect the individual privacy; and
- (d)        if so, the details thereof?

## ANSWER

## MINISTER OF STATE FOR   ELECTRONICS AND  INFORMATION TECHNOLOGY (SHRI P.P. CHAUDHARY)

(a) and (b): No, Sir. There is no provision in the Aadhaar (Targeted Delivery of Financial and  Other  Subsidies,  Benefits  and  Services)  Act,  2016  ('Aadhaar  Act')  for  linking caste/domicile  certificates  with  Aadhaar  number.  The  demographic  information  collected during enrolment of residents is strictly in terms of definition of 'demographic information' appearing  in  Section  2(k)  of  the  Aadhaar  (Targeted  Delivery  of  Financial  and  Other Subsidies, Benefits and Services) Act, 2016 which inter alia specifically excludes collecting of  information  relating  to  caste.  The  Aadhaar  number,  being  a  random  number,  bears  no relation  to  the  attributes  or  identity  of  the  Aadhaar  number  holder  [Section  4(2)  of  the Aadhaar Act]. The caste/domicile certificate is one of the accepted documents for Proof of Address collected during the enrolment process for generation of Aadhaar number, which is a random number devoid of any intelligence.

The manner of usage of Aadhaar number by the Central Ministries in delivery of services, benefits and subsidies funded from the Consolidated Fund of India is governed by Section 7 of  the  Aadhaar  Act.  Pursuant  to  the  provisions  of  the  said  Section  7,  the  Ministry  of Electronics  and  Information  Technology  has,  vide  OM  No.  2(10)/2016-EG-II  dated  17 November,  2016,  assigned  the  power  of  issuing  a  notification  to  the    Central  Ministries which plan to use Aadhaar for establishing identity of an individual as a condition for receipt of subsidies, benefits or services funded from the Consolidated Fund of India.

(c): Yes, Sir.

(d):    Appropriate  measures  have  been  taken  by  the  Government  to  ensure  the  security  of identity  information  and  authentication  records  of  individuals.  The  Aadhaar  (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, provide that no core-biometric  information  (fingerprints,  iris  scan)  shall  be  shared  with  anyone  for  any reason  whatsoever  (Sec  29)  and  that  the  biometric  information  shall  not  be  used  for  any other purpose other than generation of Aadhaar and authentication.

Chapter  VII  of  the  Aadhaar  Act  provides  for  the  penalties  for  contravention  of  any provisions of the Aadhaar Act. Section 38 under the said Chapter more specifically deals with the penalty for unauthorized access to the UIDAI CIDR in the form of   unauthorized accessing,  downloading,  introducing  virus,  damaging  the  data,  disruption  of  access  to  the CIDR,  denial  of  access  to  an  authorized  person,  revealing,  sharing,  using  or  display  of information,  destroying,  deleting  or  altering  of  information,  stealing,  concealing  any computer course code used by the Authority which shall attract an imprisonment for a term which may extend to three years and shall also be liable to a fine which shall not be less than ` 10 lakhs.

Additionally, Section 39 provides that any unauthorised use or tampering with data in CIDR or  in  any  removable  storage  medium  with  the  intent  of  modifying  information  relating  to Aadhaar  number  holder  or  discovering  any  information  thereof,  shall  be  punishable  with imprisonment for a term which may extend to 3 years and also liable to a fine which may extend to Rupees ten thousand.

Further, the  Aadhaar  (Authentication)  Regulations 2016  have  also been  notified in September  2016.  These  Regulations  inter  alia  provide  for  biometric  authentication  to  be done only by Authentication Users Agency (AUA) authorized by UIDAI, transmission of biometric  information  in  encrypted  form,  use  of  only  certified  device,  etc.  In  case  of biometric  authentication,  response  of  UIDAI  is  signed  digitally,  assuring  its  veracity  and additionally user is alerted about the said transaction/authentication.

UIDAI's CIDR facilities, Information Assets, Logistics and Infrastructure and Dependencies installed  at  UIDAI  have  been  classified  as  Protected  System  under  Section  70(1)  of  the Information  Technology  Act,  2000  w.e.f.  11  December  2015.  UIDAI      has  received  ISO 270001 certification which is globally accepted as the highest standard for IT security.

*******