For all the restrictions placed by India’s supreme court on Aadhaar’s scope, it’s too early for citizens to celebrate.
The Sept. 26 verdict, stopping businesses and individuals from demanding customers’ biometric-based unique identity (UID) number, may not be a cause for relief on the ground. Hiccups in implementing the new ruling may be caused by loopholes, a lack of clarity in the restrictions imposed, or the use of subtle or indirect coercion.
“We’re still not sure what is permissible and what is not,” Srikanth Lakshmanan, a software engineer behind Cashless Consumer, a consumer awareness initiative about digital payments, told Quartz.
The ruling
In its 1,400-page ruling(pdf) yesterday (Sept. 26), the supreme court deemed “unconstitutional” section 57 of the Aadhaar Act that allows private players to ask for consumers’ personal data. Critics of Aadhaar had alleged that it could potentially open the door to commercial exploitation and even further a surveillance state of sorts, among other things.
The court’s verdict now means banks, cell phone service providers, e-wallet operators, or other private entities, can no longer demand the 12-digit UID number.
This marks a massive departure from a few months ago when, without Aadhaar, banks refused to even open bank accounts and insurance companies denied payouts, while mobile phone operators repeatedly harassed customers to get mobile numbers linked to the platform.
However, some experts worry that the judgment still has too many grey areas.
“If a company, say, was using Aadhaar for KYC (know-your-customer) citing PMLA (Prevention of Money Laundering Act) rules, they can no longer do that,” Lakshmanan said. “But that doesn’t mean the company won’t, for instance, ask for the Aadhaar number saying ‘we want to verify your identity using an Aadhaar-based OTP’ or on any other grounds.”
Others differ.
“Now, companies can’t ask for Aadhaar at all, not for any reason. If they try, they will face resistance again,” Prasanna S, a lawyer for petitioners in the Aadhaar cases before the supreme court, told Quartz.
Besides, private firms aren’t going to accept the court’s decision lying down. Already up in arms, businesses that fear disruptions have said the government must consider a legislation that reinstates their ability to ask for Aadhaar.
Costly court order
By leveraging eKYC norms instead of traditional documents—passport, voter ID, or driver’s licence—companies were saving time and money spent on customer verification.
“…till now, an eKYC verification and on-boarding cost Rs15 per person and soon the same verification will cost Rs100 for a physical KYC,” said Harshil Mathur, CEO and co-founder of payments gateway Razorpay.
The 15-minute eKYC process, for instance, helped telecom giant Reliance Jio acquire close to a million customers a day. Re-verifying all those users will be a Herculean task.
No escape
The judgment has come even as many people were being strong-armed into the system: By the end of last year, 712 million of India’s one billion mobile subscribers had linked their phone numbers to Aadhaar; nearly 870 million bank accounts were linked by this March.
These people have no way out and it is as yet unclear what will happen to their data.
In his dissenting statement labelling the entire Aadhaar Act unconstitutional, justice Dhananjaya Y Chandrachud called upon telecom operators to delete all the Aadhaar data collected from their subscribers. However, his was not part of the majority opinion.
“The majority judgment does not talk about de-linking or deletion of data,” Lakshmanan said. “The data that has already been collected will probably not be entirely deleted but people can always walk in and get a new sim card without Aadhaar-linkage now.”