Lok Sabha Question No. 1558 (UNSTARRED), answered on 2018-12-19
Subject: Leakage of Aadhaar Data
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: S.P. MUDDAHANUMEGOWDA

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 1558

TO BE ANSWERED ON 19.12.2018

## LEAKAGE OF AADHAAR DATA

## 1558. SHRI S.P. MUDDAHANUME GOWDA:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a)        the  steps  taken  by  the  Government  for  the  protection  against  leakage  of  data  submitted  to  the Government authorities like UIDAI;
- (b)   the action taken against employees found guilty of leaking data of individuals or citizens to unauthorized persons; and
- (c)      whether it is a fact that Government has set up a Committee for Data Protection and if so, the details thereof?

## ANSWER

## MINISTER OF STATE FOR   ELECTRONICS AND  INFORMATION TECHNOLOGY (SHRI S. S. AHLUWALIA)

- (a): Unique Identification Authority of India (UIDAI) data is fully secured/ encrypted at all the times i.e. at rest,  in  transit  and  in  storage.  For,  further strengthening of security and privacy of data, security audits are conducted on regular basis and all possible steps are taken to make the data safer and protected. Strengthening of security of data is an ongoing process.

UIDAI's  existing  security  controls  and  protocols  are  robust  and  capable  of  countering  any  attempts  or malicious designs of data breach or hacking. Security of Aadhaar is of critical importance to the Government and  has  given  it  paramount  significance.  UIDAI  constantly  strengthens  and  reviews  its  infrastructure  and ecosystems in line with the best International security practices and technological standards. UIDAI has multilayered security and privacy considerations built into the core strategy of Aadhaar with three basic doctrines of minimal data, optimal ignorance and federated database which give higher level of security.

Various  policies  and  procedures  have  been  defined,  which  are  regularly  reviewed  and  updated  thereby appropriately controlling and monitoring any movement of people, material and data in and out of secured and well-guarded UIDAI premises, particularly the data centers.

Legal status of UIDAI has further strengthened the security assurance of Aadhaar ecosystem manifold with enactment of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 which has stringent penalties/ punishments for offenders. In the ibid Act, Chapter VI is on Protection of Information.

UIDAI is ISO 27001:2013 certified by STQC with respect to Information Security which has added another layer of information security assurance. Further in pursuance of sub-section (1) of Section 70 of the IT Act 2000, UIDAI data has also been declared as Protected System by National Critical Information Infrastructure Protection Centre.

- (b):  There  have  been  no  incidents/cases  where  Aadhaar  data  was  leaked/  breached  from  UIDAI's  Central Identities Data Repository (CIDR).
- (c): Yes, Sir. Ministry of Electronics & Information Technology (MeitY) is in process for bringing a Personal Data Protection Bill for protections of personal data of Indian Citizens'. In this regard, MeitY, on 31st July 2017, constituted a Committee of Experts under the Chairmanship of Justice (Retd.) B N Srikrishna. A White Paper outlining key data protection issues and international best practices was released by the said committee

to  solicit  public  comments.  Inputs  were  received.  The  committee  deliberated  on  various  inputs  &  has submitted its report along with draft Bill to MeitY.

The Draft Personal Data Protection (PDP) Bill-2018 was published on MeitY website and comments were solicited from General Public, Central Ministries, State governments and UTs. Responses have been received from a wide spectrum of stakeholders, which are presently under analysis after which the said PDP Bill, 2018 is intended to be laid in the parliament as soon as possible.

*******