The General Data Protection Regulation and You

A cursory look at your email inbox this past month presents an intriguing trend. Multiple online services seem to have taken it upon themselves to notify changes to their Privacy Policies at the same time. The reason, simply, is that the European Union’s General Data Protection Regulation (GDPR) comes into force on May 25, 2018.

The GDPR marks a substantial overhaul of the existing data protection regime in the EU, as it replaces the earlier ‘Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.’ The Regulation was adopted by the European Parliament in 2016, with a period of almost two years to allow entities sufficient time to comply with their increased obligations.

The GDPR is an attempt to harmonize and strengthen data protection across Member States of the European Union. CCG has previously written about the Regulation and what it entails here. For one, the instrument is a ‘Regulation’, as opposed to a ‘Directive’. A Regulation is directly binding across all Member States in its entirety. A Directive simply sets out a goal that all EU countries must achieve, but allows them discretion as to how. Member States must enact national measures to transpose a Directive, and this can sometimes lead to a lack of uniformity across Member States.

The GDPR introduces, among other things, additional rights and protections for data subjects. This includes, for instance, the introduction of the right to data portability, and the codification of the controversial right to be forgotten. Our writing on these concepts can be found here, and here. Another noteworthy change is the substantial sanctions that can be imposed for violations. Entities that fall foul of the Regulation may have to pay fines up to 20 million Euros, or 4% of global annual turnover, whichever is higher.

The Regulation also has consequences for entities and users outside the EU. First, the Regulation has expansive territorial scope, and applies to non-EU entities if they offer goods and services to the EU, or monitor the behavior of EU citizens. The EU is also a significant digital market, which allows it to nudge other jurisdictions towards the standards it adopts. The Regulation (like the earlier Directive) restricts the transfer of personal data to entities outside the EU to cases where an adequate level of data protection can be ensured. This has resulted in many countries adopting regulation in compliance with EU standards. In addition, with the implementation of the GDPR, companies that operate in multiple jurisdictions might prefer to maintain parity between their data protection policies. For instance, Microsoft has announced that it will extend core GDPR protections to its users worldwide. As a consequence, many of the protections offered by the GDPR may in effect become available to users in other jurisdictions as well.

The implementation of the GDPR is also of particular significance to India, which is currently in the process of formulating its own data protection framework. The Regulation represents a recent attempt by a jurisdiction (that typically places a high premium on privacy) to address the harms caused by practices surrounding personal data. The lead-up to its adoption and implementation has generated much discourse on data protection and privacy. This can offer useful lessons as we debate the scope and ambit of our own data protection regulation.

Advertisements

Dealing With Revenge Porn in India

In March of 2018, a man in West Bengal was sentenced to five years imprisonment and fined Rs 9,000 for uploading private pictures and videos of a girl without her consent as revenge for ending their relationship. Under the promise of marriage, the accused pressured the complainant into providing explicit images of herself, and leveraged his threats to upload these pictures onto social media to acquire more pictures. Later, he accessed her phone without her knowledge to retrieve more private pictures and videos. When the complainant refused to continue their relationship, he uploaded this material onto a popular pornographic website along with both her and her father’s names. In addition to the defendant’s imprisonment and fine, the state government was directed to treat the victim as a survivor of rape and grant appropriate compensation. With evidence provided by service providers Reliance Jio and Google, the perpetrator was convicted under Sections 354A, 354C, 354 and 509 of the IPC as well as Sections 66E, 66C, 67 and 67A of the IT Act, in what is likely the first revenge porn conviction in India.

Revenge porn is a form of non-consensual pornography that came to international attention with the 2010 launch (and subsequent 2012 takedown) of the popular website IsAnyoneUp, which allowed users to upload nude photographs. While a number of these images were ostensibly self-submitted, many were revealed to have been submitted by angry ex-lovers, which would amount to ‘revenge porn’. Compounding the issue was the fact that these explicit images deliberately linked to the social media profiles of the person in the image.

According to Halder and Jaishankar, the essential elements of revenge porn are that the perpetrator and the victim shared an intimate relationship, and that the former has deliberately (and without the victim’s consent) released sexually explicit information online in order to cause distress and harm to the victim’s reputation.

While revenge porn is often used interchangeably with the term “non-consensual pornography”, it is distinct from other forms of non-consensual pornography such as rape videos, morphing or voyeurism. For instance, non-consensual pornography includes within its ambit sexually explicit images captured without a person’s knowledge or consent. However, revenge porn often includes such sensitive information that has voluntarily been captured or sent to the perpetrator in good faith in the course of an intimate relationship. Further, unlike in the case of revenge porn, not all perpetrators of non-consensual pornography are motivated by personal feelings such as revenge (as in the case of hackers who released intimate photos of more than 100 female celebrities after gaining access to their private iCloud accounts).

As a result, researchers are moving away from the term “revenge porn” as it can be somewhat misleading. “Revenge” limits the scope of this offence to motivations of personal vengeance, whereas such an act could be motivated by a desire for profit, notoriety, entertainment, or no reason at all. “Porn” implies that all images of nudity are intrinsically pornographic. Sexually explicit images created and shared within a private relationship should not be considered pornographic, unless they are distributed without consent, as this results in a private image being converted into public sexual entertainment. Accordingly, many victim advocates prefer to use the term “non-consensual pornography” or non-consensual sharing of intimate images.

Although the National Crime Records Bureau documents cyber-crimes against women, there are no official statistics available that pertain specifically to revenge porn in India. A 2010 report suggests that “only 35 per cent of the women have reported about their victimization, 46.7 per cent have not reported and 18.3 per cent have been unaware of the fact that they have been victimized … women prefer not to report about their victimization owing to social issues.” Victim-shaming (both by the criminal justice system and the public at large) is common, and the potential social fallout often extends to the victim’s family as well.

The recent surfeit of revenge porn has prompted many countries to enact legislation that criminalises it. These include the UK, many states in the USA, Canada, Australia, Japan and the Philippines.

At present however, there are no legal provisions that directly address revenge porn in India. While certain sections in the Indian Penal Code (IPC) and Information Technology (IT) Act can be invoked by victims, they fail to fully encompass the complexity of such cases and do not specifically target non-consensual pornography published online.

Section 354C of the IPC makes voyeurism punishable, and Explanation 2 to the Section deals with the non-consensual dissemination of consensually-captured images. However, this section limits its scope to female victims and male offenders.

In cases of non-consensual pornography (particularly those that involve morphing), victims can also seek recourse under Section 499 of the IPC for criminal defamation.

Section 66E of the IT Act punishes the transmission of images depicting the private areas of a person. The Explanation to the section limits private area to “… the naked or undergarment clad genitals, pubic area, buttocks or female breast”. This provision is gender-neutral and captures every aspect of revenge porn while not addressing it by name. However, the narrow definition of “private areas” in this case could limit the applicability of the act in cases where the victim is captured in an intimate position without showing those particular areas.

Section 67A of the IT Act punishes publication or transmission of “material containing sexually explicit acts, etc. in electronic form”. While this can effectively punish perpetrators, it also risks including within its ambit, victims who may have voluntarily captured and shared such private content with their partners.

The recent Supreme Court judgment recognising privacy as a fundamental right could have substantial implications on revenge porn and non-consensual pornography in general, in light of arguments recognising the right to bodily integrity. Copyright law could also potentially be used by victims, particularly when the content is a selfie. By claiming a violation of their copyright, a victim could potentially get such material taken down. While Indian copyright law does not presently provide any relief to victims of revenge porn, some victims in the US have successfully enforced their copyright to get such images taken down.

Social media platforms are often used to disseminate such content. Until recently, their role was limited to removing non-consensual pornography and other offensive images. However, there have been calls for them to play a more active role and filter this content before it is uploaded. Facebook has attempted to prevent the re-posting of revenge porn by cataloguing content which had been previously reported as revenge porn on its site.

The gender disparity in victims of non-consensual pornography is a reflection of the hostility still faced by women on the internet today. Involuntary porn today can be considered “the sexual harassment of 20 years ago. It’s an easy way to punish women for behaving in ways that they don’t approve of – for leaving them, for rejecting them, for being happy without them.”

SC Constitution Bench on Aadhaar- Final Hearing (Day XXXV)

In October 2015, a 3-judge bench of the Supreme Court of India referred challenges to the Aadhaar program to a constitution bench. One of the primary concerns of this petition was to decide on the existence of a fundamental right to privacy, which has since been upheld. Other similar petitions, concerned with the legitimacy of Aadhaar had been tagged with this petition. While the existence of the fundamental right to privacy has been upheld, challenges against the Aadhaar programme and linking services to this programme were yet to be adjudicated upon.

An interim order was passed in December of 2017, a summary of the arguments can be found here and here.

The final hearing commenced on January 17, 2017. Summaries of the arguments advanced in the previous hearings can be found here.

Advocate Zoheb Hossain continued his submissions for the State of Maharashtra and the UIDAI. He began with referring to various international charters and covenants, stressing on the importance of harmonizing between the economic and social rights and the civil and political rights.

Justice Chandrachud noted that the Directive Principles, even though they are non justiciable, are necessary for good governance and as a guarantee of reasonableness of the law. This is why they are read into Article 21.

The counsel argued that all rights give rise to corresponding duties, and that Aadhaar was a project to secure the economic and social rights of the people. He then brought the Court’s attention to the Justice Wadhwa Committee Report on the Public Distribution System. He then brought the Court’s attention to various precedents. He referred to the case of DK Trivedi, where the Court had held that ensuring socio economic welfare was a constitutional obligation of the State. Further, it had been held that a statute could not be judged on the presumption that the executive power that it confers would be abused, or used arbitrarily.

The counsel then referred to the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, and resolutions of the UN General Assembly. He reiterated that rights were indivisible and interconnected, and that socio economic rights were equal to the civil and political rights.

The counsel then argued that the proportionality and reasonableness of a restriction must be examined from the point of view of the general public, and not that of a specific party that claims to be affected. He argued that even if Aadhaar is used for different purposes such obtaining a SIM card or opening a bank account, the data remains disaggregated. He stated that as a consequence, there was no possibility of surveillance, even at the level of the Requesting Entities.

The counsel then drew a comparison between Aadhaar and the Social Security Number in the United States. He noted that the SSN was used for a variety of purposes, and that people could be denied benefits for not producing their SSN. He argued that the Courts in the US had upheld the firing of an employee for refusing to provide his SSN. The counsel then argued that the Aadhaar Act had sufficient safeguards in place over the identity and authentication information. He referred to Section 33 of the Act, noting that decisions made under that Section were subject to review by an oversight committee. He concluded that the safeguards in place were greater than what are provided by the Telegraph Act, and the standards laid down by the Supreme Court in the PUCL case.

Post lunch, the counsel resumed his submissions for the Respondents with examining how various search and seizure related provisions under the IT Act and CrPC had passed constitutional muster. He then proceeded to the issue of ‘national security.’ He argued that in times of emergency, a strict adherence to the principles of natural justice is not necessary. He referred to a House of Lords decision that read in a national security exception to a statute even though the text did not provide  for it.

He then addressed the contention with respect to Section 47 of the Aadhaar Act, arguing that it provided for sufficient remedy since a complaint could be filed to the UIDAI. He argued that Aadhaar had many technical aspects, so it would be best if only the Authority has the power to complain. He noted that a similar setup in the Industrial Disputes Act had been previously upheld. In addition, he noted that the UIDAI could authorize a person to make a complaint as well.

The counsel then submitted that the Aadhaar Act had sufficient safeguards for the CIDR, while provisions under the IT Act would cover actors outside the CIDR.

The counsel then framed the purpose of Section 139AA of the Income Tax as a measure to ensure redistributive justice, to ensure substantive equality. He argued that ‘distribute’ in the Directive Principles had been interpreted liberally, and measures to prevent leakages would thus be considered redistributive.

The counsel then moved to the addressing the argument about compelled speech. He argued that not all transactions can be considered to have a speech element, for instance linking the Aadhaar to PAN. He further noted that the Court in Puttaswamy had held that rights could be curbed to prevent tax evasion and money laundering. He added that the Income Tax Act and the Aadhaar Act were standalone Acts, and that after Binoy Viswam, it was settled that they were not in conflict. He responded to the contention that only individual tax payers had been mandated for linkage, stating that a measure need not strike at all evils at once. He argued that the linkage could help cure ills with companies as well, by revealing the people behind them. The linkage can allow the deduplication of DINs. Advocate Zoheb Hossain then concluded his arguments.

The Attorney General then began his arguments, by addressing the Money Bill issue. He argued the Act was, in pith and substance, a Money Bill. ‘Targetted Delivery of Subsidies entails the expenditure of funds. He argued that every act would have ancillary provisions dealing with review, appeal etc., but the primary purpose deal with the Consolidated Fund of India.

Justice Chandrachud questioned the counsel about whether Section 57 of the Act severed that link. The AG responded that the Section merely allowed the existing infrastructure to be used for other purposes, and was just an ancillary provision. The UIDAI had been brought into existence primarily to prevent leakages and losses.

Justice Sikri noted that there was no distribution of benefits or subsidies under Section 57. The AG argued that the Section would be saved by Article 110(1)(g) of the Constitution, and stressing on an interpretation of the word ‘only’ in the Article. Justice Chandrachud suggested that that might amount to rewriting the Constitution.

The Attorney General will resume his arguments on May 3, 2018.

 

SC Constitution Bench on Aadhaar- Final Hearing (Day XXXII)

In October 2015, a 3-judge bench of the Supreme Court of India referred challenges to the Aadhaar program to a constitution bench. One of the primary concerns of this petition was to decide on the existence of a fundamental right to privacy, which has since been upheld. Other similar petitions, concerned with the legitimacy of Aadhaar had been tagged with this petition. While the existence of the fundamental right to privacy has been upheld, challenges against the Aadhaar programme and linking services to this programme were yet to be adjudicated upon.

An interim order was passed in December of 2017, a summary of the arguments can be found here and here.

The final hearing commenced on January 17, 2017. Summaries of the arguments advanced in the previous hearings can be found here.

Senior Counsel Rakesh Dwivedi resumed his arguments for the Respondents. He began with referring to jurisprudence from the United States, the United Kingdom, South Africa and the European Union, to describe how privacy should be constructed in the Indian context. He argued that Indian jurisprudence is more in line with that of the United States, than the European Union. He stated that that former lays greater emphasis on the ‘reasonable expectation to privacy’. He then quoted a Harvard Law Review article, for the proposition that privacy should be tempered by considerations such as national security, efficiency, and entrepreneurship. He argued that that was especially true in the Indian context, where innovation and development should have more emphasis than privacy.

The counsel made reference to Justice Chandrachud’s opinion in Puttaswamy, and argued that social welfare could be a legitimate purpose for processing of data. Coming back to the construction of privacy, he argued that all Aadhaar data was in the public, relational sphere. He submitted that privacy is diluted in these realms, so there is a reduced expectation of privacy over data such as demographic data, and facial photographs. He reiterated that data with the Requesting Entities was dispersed, and therefore didn’t require the same level of protection as the CIDR.

Justice Chandrachud sought a clarification, if the submission was that core biometrics had a higher privacy interest, as opposed to demographic data, such as one’s address. He countered that the implication was not that the privacy interest in such data was gone. He gave the example of a woman and her address. He argued that she might give her address out for various purposes, but still had immense privacy interest in that information. The counsel responded that their argument was simply that privacy varies according to context.

The counsel argued that India had developed the appropriate tests in VG Row, much before any other jurisdiction. He reiterated the three-fold requirement of legality, necessity and proportionality. He noted that Indian jurisprudence generally did not adopt the due process standard. The counsel then addressed some of the cases that had been cited by the Petitioners, and attempted to distinguish them on facts.

Post lunch, the counsel resumed his submissions, with the issue of metadata collection. He attempted to distinguish the present case from Digital Rights Ireland, which had been cited by the Petitioners. The counsel argued that there were different types of metadata, and the data in question in those cases had been much more intrusive than what is collected by the Aadhaar authentication. He reiterated that the test is that of ‘appropriate safeguards’. He cited the case of Sundar Rajan v State of Tamil Nadu, which dealt with the Kundankulan nuclear power plant. He argued that the court had examined whether adequate safeguards had been in place, and had given due weight to economic benefits such as the increase in welfare, poverty alleviation etc. He argued that the Court in Sundar Rajan had held that apprehensions and fears could not be allowed to override the justification of the project. The counsel reiterated that the standard would be of ensuring adequate safeguards, and the risk would never be zero.

The counsel argued that the Aadhaar Act imposes a complete bar on sharing of the data, factors in consent, and the data with Requesting Entities was in any case disbursed and decentralized. He argued that the Petitioners had not suggested any way of improving the system, and only wanted it dismantled.

Justice Chandrachud asked what remedy was present in case of breaches. The counsel responded that the Information Technology Act would be applicable, which had penal provisions. Further, the route of contractual damages could be taken.

The counsel then described the EU Data Protection Directive, arguing that the purpose of the Directive was very different, with the aim being to ensure free flow of data. He argued that in contrast, Aadhaar didn’t allow any sharing of data. He argued that as a result, the absence of a regulation such as the Directive, or the General Data Protection Regulation would have no bearing on the matter at hand. He reiterated that the protections in the Aadhaar Act were sufficient, and even higher than those provided by the EU instruments. The counsel then went over the various provisions of the Directive and Regulation that govern the processing of sensitive information.

The counsel then resumed his submission with respect to metadata, as a response to the surveillance concerns raised by the Petitioners. He argued that the Petitioners had not appreciated the distinction between different types of metadata, such as system metadata, process metadata, business metadata etc. He argued that each had to be examined separately. He submitted that Aadhaar authentication only collected limited technical metadata.

The Chief Justice asked why the data had to be retained, and what sort of data was actually retained. The counsel drew the Court’s attention to an affidavit he had submitted, as well as the relevant circular which prescribes the metadata that is collected. He argued that it was all system related metadata, which allowed the UIDAI to exercise control over the Requesting Entities. He argued that information such as location data, the purpose for authentication, was not collected in the process.

The hearing will continue on April 25, 2018.

 

SC Constitution Bench on Aadhaar- Final Hearing (Day XXX)

In October 2015, a 3-judge bench of the Supreme Court of India referred challenges to the Aadhaar program to a constitution bench. One of the primary concerns of this petition was to decide on the existence of a fundamental right to privacy, which has since been upheld. Other similar petitions, concerned with the legitimacy of Aadhaar had been tagged with this petition. While the existence of the fundamental right to privacy has been upheld, challenges against the Aadhaar programme and linking services to this programme were yet to be adjudicated upon.

An interim order was passed in December of 2017, a summary of the arguments can be found here and here.

The final hearing commenced on January 17, 2017. Summaries of the arguments advanced in the previous hearings can be found here.

Rakesh Dwivedi resumed his arguments for the Respondents. He began with the issue of  Section 7 and exclusion. The counsel responded to the argument about probabilistic systems by submitting that there are alternatives that are allowed by the Act. In the event of an authentication failure, the first alternative is to produce a proof of possession of Aadhaar. The second alternative is to provide enrollment ID, for people who haven’t yet received the Aadhaar. He submitted that the UIDAI had issued directions to this effect. A refusal to comply would be a breach under the Aadhaar Act.

Justice Chandrachud asked if the Section 7 proviso would apply to someone who had not applied for Aadhaar. The counsel replied in the negative. The counsel continued, describing the Regulation. He submitted that for State and Central agencies that require Aadhaar for benefits, they are required to ensure enrollment, including the setting up of coordination centres. Further, in the context of PDS, he argued that Clause 5 of the relevant notification allowed any member of a household to claim the benefit. He concluded that there could be no question of denial, as a result of these measures.

Justice Chandrachud asked if the systems had been tested in remote areas, with limited connectivity, such as Ladakh. Section 7 is silent on alternatives in such cases. The counsel responded that certain exemptions had been notified in the regulations.

The counsel reiterated that the system should not be demolished, but improved so that it could work. He then submitted that even today, we live in a relational world. One cannot pick and choose how one relates to the world; or how one establishes identity. All institutions require some kind of identity, and have some conditions about it.  He argued that this wasn’t a question of dignity, because these are regulatory conditions. He stated that these are permissible, and the only standard is if a fundamental right is being violated.

The Bench noted that the counsel was trivializing the Petitoners’ argument. They noted that the central concern was that of centralization of the database and its misuse.  Justice Chandrachud further argued that the issue was why only one identity had been mandated, and why multiple identities could not be allowed.

The counsel responded that one must go by the rules of the institution they want to participate in. He provided the example of the Proximity Card of the Supreme Court. Justice Chandrachud asked if the form of identity should relate to the purpose of identification. The counsel agreed, stating that there should be a rational nexus. However, he argued that allowing different forms of identity to be submitted would lead to a slippery slope which would destroy the whole purpose of the system.

Justice Bhushan added that many of the other forms of identification don’t have pan-India operation. The counsel agreed, noting that they were also sectoral, without any portability. In comparison, he argued, Aadhaar is universal. Aadhaar is also unique on account of the use of biometrics. If you abandon biometrics, the unique nature is lost. He submitted that even Smart Cards use biometrics.

Justice Chandrachud reiterated the concern about aggregation and analysis of data. The counsel responded that all protections that were socially and legally possible were in place.

He continued, stating that the argument about biometrics providing knowledge about the person was incorrect. He argued that while DNA might contain such information, fingerprints don’t. Further, only one fingerprint would be present with the Requesting Entities. Justice Chandrachud clarified that the issue was not of the biometrics themselves, but their attachment and linking to everything else, which could become a source of information about the individual. The counsel responded that no single Requesting Entity would have access to all of that information. It would be delegated and segregated. Further, any collusion or aggregation would not possible. Any misuse would require corruption at an inconceivable scale. In addition, most of the authentication would be required very rarely – once a year, or once in a lifetime. For PDS, it would be once a month.

At this point Shyam Divan interjected, that Banks had been demanding Aadhaar every time a Fixed Deposit is opened. The counsel responded that for most people, that is also a rare occurrence. Further, that was an issue on the Bank’s side, and not mandated by the Act. He argued that that can be examined separately. If the law were to be changed, to mandate authentication for every transaction, that could be questioned and challenged.

The counsel then moved on to the issue of clashes between fundamental rights. He brought the bench’s attention to the Preamble to the Constitution. He argued that the Preamble states that certain values are to be ‘secured’ by the state, and certain are to be ‘promoted.’ He argued that this imposes an obligation on the state to provide the basic minimum (for instance, minimum wages) to people. He argued that there was therefore a hierarchy, and the right to life should triumph over the right to privacy. He argued that for the people to without the bare minimum, the Constitution would amount to a mere paper Constitution.

Justice Chandrachud noted that dignity was not a peripheral value in the Constitution, but the core foundation of all rights. The Constitution protects dignity in all its forms, and food security and privacy were both aspects of dignity. The counsel responded that when they were in conflict, the first must have primacy over the second. He noted the NALSA judgment, which according to him brought about a paradigm shift in our conception of dignity.

Justice Bhushan questioned if they had to be read in conflict, and could not be recognized together. The counsel responded that they were arguing for a balanced approach, and in this case, in the favour of the right to life.

Justice Chandrachud asked if this would require a proportionality test. He stated that the question was whether the incursion on privacy is so less, to justify the benefits that have been claimed. The counsel responded that in the case of a restriction on a right, the burden lies on the state. However, this was a case of an interplay between rights. Justice Chandrachud countered that the burden was still with the state. The counsel responded that they were only submitting that the parameters for scrutiny would be different. Further, that Article 21 supersedes the rights under Article 19 and 14. Life would come first, and the other rights wouldn’t mean anything without it.

The counsel then resumed arguing for the relevance of biometrics, noting that large parts of the population were illiterate. Their thumbprints were all they had had to use in the conduct of their lives.

The Chief Justice noted that the real problems were of surveillance, aggregation, privacy and exclusion, which have to be addressed. The counsel said that the subsidies were in furtherance of life, liberty and dignity.

Justice Chandrachud asked for a clarification, whether the respondents were arguing for the tests under Puttuswamy to be abandoned. The counsel responded in the negative, and that Section 7 was not examined in Puttuswamy.

He then went on to quote from the Universal Declaration of Human Rights, and excerpts from Kesavanda Bharathi, the NALSA judgment, and German human rights jurisprudence.

The hearing will continue on April 19, 2018.

 

SC Constitution Bench on Aadhaar- Final Hearing (Day XXIX)

In October 2015, a 3-judge bench of the Supreme Court of India referred challenges to the Aadhaar program to a constitution bench. One of the primary concerns of this petition was to decide on the existence of a fundamental right to privacy, which has since been upheld. Other similar petitions, concerned with the legitimacy of Aadhaar had been tagged with this petition. While the existence of the fundamental right to privacy has been upheld, challenges against the Aadhaar programme and linking services to this programme were yet to be adjudicated upon.

An interim order was passed in December of 2017, a summary of the arguments can be found here and here.

The final hearing commenced on January 17, 2017. Summaries of the arguments advanced in the previous hearings can be found here.

Rakesh Dwivedi resumed his arguments for the Respondents. He began with stating that if there were problems with the system, they should be fixed, rather than the system being demolished completely. He argued that under Section 8 of the Act, the sharing and use of information was confined specifically to the authentication process. He further argued that the mandate of Section 29 states that core biometrics cannot be shared.

Justice Chandrachud asked how the UIDAI planned to control the Requesting Entities. The Counsel responded that control could be in terms of technical specifications of the devices, mandating approved software, mandating information systems audits etc.

In response to Justice Chandrachud’s query about the framing of Sections 8 and 29, the Counsel reiterated that the sharing of information would be limited to the process of authentication. Further, only non biometric information could be shared under Section 29.

Next, there was some disagreement between the counsel and Justice Chandrachud on the interpretation of Section 8. The Counsel stated that the Requesting Entity would not know the purpose for the authentication, but only that authentication had been done. Justice Chandrachud stated that that could be true for UIDAI, but it was uncertain if that would be true for Requesting Entities. According to him, the language of the Act didn’t conform to this design. Justice Sikri added that that would also render Section 8(3) redundant. The Counsel responded that the Bench could chose to read the Act in that way.

Justice Chandrachud then gave an example of an individual who goes to the hospital for certain services. The hospital sought authentication for him, 122 days out in 6 months. He noted that that would be potentially extremely valuable information for pharmaceutical companies, insurance providers etc. Until there was a data protection law, this could be a problem.

The counsel responded that no other jurisdiction has the sort of protections that the Aadhaar Act provides. Justice Chandrachud asked if the protection under the Act was all the data protection the citizens of India would ever need. He also gave the example of the European Union’s General Data Protection Regulation as an example of a comprehensive framework for data protection. The Counsel replied that the Aadhaar Act was sufficient, and in many ways superior. According to him, the GDPR has no penal provisions, and the States have to enact their own, which creates a patchwork. The Counsel argued that the Aadhaar framework has technological security, auditing, as well as penal provisions in place. He went on to say that there could never be 100% surety about anything. The standard to be sought was that of reasonable safeguards, and reasonable protection. He noted that none of the Petitioners had pointed out what more could be done.

Justice Chandrachud then noted that according to the Counsel’s reading, Sections 8(3) and 29(3) could be excised from the Act. The Counsel responded that nothing needed to be excised from the Act, only clarified. Further, there was no intent, purpose, or objective in the Act to allow aggregation of data, its analysis or transfer. In addition, any breach of the provisions would be punitive.

Justice Chandrachud observed that it is hard to predict commercial ingenuity, and it wouldn’t be possible to tell what use the Requesting Entities could make of the data with them. Justice Sikri interjected with the earlier hospital example, noting that the hospital would already have the data about medical treatments of the patients, and may not need Aadhaar to get that information. The main apprehension was one of misuse. The counsel agreed, questioning whether Aadhaar was adding to the problem, or making it worse in any way.

Justice Chandrachud noted that they must evaluate what safeguards can be introduced. He noted that data about individuals was now being used to influence electoral outcomes.

The counsel responded that Cambridge Analytica should not be brought into the discussion, because the nature of the data was different. Justice Chandrachud interjected, stating that that incident was symptomatic of the present times. The counsel responded arguing that the algorithms employed were different. There is a difference between matching algorithms (which Aadhaar uses) and sorting algorithms (which these companies use). He argued that there were many different types of algorithms, and the Petitioner’s had confused this distinction.  He concluded that the data could not be analyzed by the Respondents. If at all, they would have to go through proper procedure.

The counsel continued, stating that Smart Cards were entrenched technology and that the Smart Card lobby in the West didn’t want Aadhaar to succeed. He claimed that other countries like Singapore were looking to replicate our model.

Justice Chandrachud noted that the issue was that there is a big world that interacts with Aadhaar. He said that the UIDAI might only be the least of their problems, since it is a government entity subject to a lot of scrutiny. The Counsel reiterated that only matching algorithms are used.

Coming back to the Act, the counsel submitted that Requesting Entities cannot be enrolled unless they establish the need for authentication.  Justice Chandrachud asked what the purpose behind opening Aadhaar to private players was. In response, the Counsel argued that the nature of the public-private divide was changing. Private companies have been entering fields that were historically the domain of the public sector. The companies are funded by money from Banks, where the people have made deposits. So, it was actually the public that is funding these players. He argued that private players that perform public functions should also be subject to constitutional norms, review and scrutiny. Currently, public companies are subject to many restrictions, such as standards of reasonableness, while no similar shackles apply to private companies. He concluded stating that that was a larger debate for another time. For now, all that was necessary to know is that private players are also regulated by the Act.

The counsel then moved on to responding to the Petitioner’s argument that the Aadhaar framework amounted to the numbering of human beings. Counsel argued that we have been numbering humans for a long time. He cited the PNR number for flights as an example. He also noted that the Supreme Court proximity cards were numbered.

Justice Chandrachud responded that Aadhaar was a unified identity, as opposed to multiple identifying numbers. The counsel responded that just because they were assigning numbers for a specific purpose, didn’t mean that they were numbering people. Further, they were not collecting information such as race, caste etc.

Justice Chandrachud then asked how the Aadhaar became a mandate, from a mere entitlement. The Counsel responded that the Aadhaar was an entitlement, and the UIDAI was mandate neutral. It is the government that notifies that certain linkages are mandatory. Each of these could be examined or challenged separately.

The counsel resumed his arguments after lunch by examining the scope of Section 57.  He argued that the objective of the section was not to expand, but to limit power. He submitted that if this limitation did not exist, anyone could become a Requesting Entity. The provision requires that there must be a law, or a prior contract.

Justice Chandrachud asked if once there was a prior contract under Section 57, if the UIDAI would be bound to offer authentication.  The Counsel responded that UIDAI could still refuse, and there was a requirement of necessity. Further, this embargo was applicable to anyone, which is why State Resident Data Hubs are no longer possible.

The Bench noted that nothing in the Act seems to give UIDAI this type of discretion, and questioned whether there were any guidelines for how the UIDAI would come to its decisions. The counsel responded that the power came from Section 57. He gave the example of the CBSE, noting that there had been many cases of fraud. The Board could apply to be a Requesting Entity for the purpose of conducting the exam. However, this would require the presence of a prior contract, and it cannot be an ex post facto exercise. He argued that this contract must also state that authentication must be in accordance with Sec. 8 and Part VI of the Aadhaar Act.

The counsel then went on to examine the Information Technology Act, arguing that all the provisions and safeguards under that Act and its Rules would also be applicable. For instance, the CIDR had been notified as a protected system under the Act.

The counsel then discussed the attributes and benefits of biometric data. He argued that Aadhaar brings service providers face to face with the beneficiaries. He noted that Aadhaar would not be a panacea for all problems, but the issue of fake identity documents would be solved.

He then responded to other arguments raised by the Petitioners. In response to the argument that there was no legal mandate to store information in the CIDR, he brought the Bench’s attention to Section 10 of the Act. On the argument of the use of foreign suppliers and licensors, the Counsel responded that the hardware all belonged to the UIDAI, and even technicians only had access when there was some troubleshooting required. In response to the system being probabilistic, he argued that there were appropriate fall back mechanisms under Section 7.

The hearing will continue on April 18, 2018.

 

Towards a Data Protection Framework (CCG Privacy Law Series)

Smitha and I are writing a series of papers on a data protection law for India, based on our research. We hope that our discussion of the options before us and their relative merits and demerits will help other engage with these difficult questions in a nuanced manner.

The first paper sets out the context for the data protection law. It discusses the
reasons and purpose for regulation and what specifically will be regulated.
It also discusses who will be regulated, since this is important while
considering the regulatory strategies to use while implementing the data
protection principles. It is available here.