CAG audit report on the functioning of UIDAI

THE Comptroller and Auditor General of India [CAG] published an audit report titled 'Functioning of Unique Identification Authority of India' on April 6, 2022. The Aadhaar project, established through the Unique Identification Authority of India [UIDAI] in January 2009, has generated more than 129.04 crore Aadhaars till the end of March 2021. Yet, even after ten years of its existence, it has failed to maintain the uniqueness of the identity. As per the CAG report, more than 4.75 lakh Aadhaars with the same biometric data were issued by the UIDAI till November 2019.

Despite Aadhaar being one of the largest biometric based identification systems of the world, there are serious concerns mentioned in the CAG report. In an attempt to address these concerns, The Leaflet posed a set of questions to Dr. Gopal Krishna, law and policy researcher, and a member of the Citizens Forum for Civil Liberties. Dr. Krishna is a fellow of the International Research Group on Authoritarianism & Counter Strategies, Berlin, and has also appeared before the Parliamentary Standing Committee on Finance that examined The National Identification Authority of India Bill, 2010.

Edited excerpts from the interview:

Q: Can you tell us what your concerns are over the CAG report? 

A: The CAG's audit report has established that biometric profiling based on 12-digit unique identification numbers [UID]/Aadhaar, being issued to 'residents' of India, is a flawed method to identify human beings in general and residents of India in particular. It also makes it eminently clear that UIDAI has failed to devise any mechanism to identify and segregate 'residents' of India from non-residents. Prior to Aadhaar, there were at least 15 identity documents which were recognized by the Election Commission of India [ECI]. The ECI has now included Aadhaar too in its list of identity documents.

The CAG's report creates a compelling logic for all agencies to withdraw from their reliance on this identifier. This CAG report is as significant as the report of the London School of Economics [LSE] titled 'The Identity Project: an assessment of the UK Identity Cards Bill and its implications'. The United Kingdom (UK) ID project [Identity Cards Act, 2006], now repealed, was cited by Wipro Ltd. in a document called Does India need a Unique Identity Number? to advocate the Aadhaar project in India. Also, the UIDAI project originated with Wipro's 'Strategic Vision: Unique Identification of Residents' document prepared under the chairmanship of Dr. Arvind Virmani, Principal Advisor, Planning Commission.

In the 42nd Report of the Parliamentary Standing Committee on Finance on Aadhaar Bill, Yashwant Sinha, the head of the Committee, relied on the LSE Report which stated "…identity systems may create a range of new and unforeseen problems…the risk of failure in the current proposals is therefore magnified to the point where the scheme should be regarded as a potential danger to the public interest and to the legal rights of individuals".

The LSE Report further remarked that the UK ID project was shelved for a number of reasons which included the incurrence of excessive cost; untested, unreliable and unsafe technology; the possibility of risking the safety and security of the citizens; and the requirement of high standard security measures which would increase the estimated operational cost, to name a few.

Thus, a joint reading of CAG's report, the 42nd report of the Parliamentary Committee and the LSE's report creates a compelling logic for the union government to shelve the Aadhaar project, and for the states to unsign the Memorandum of Understanding, which they signed with the UIDAI, especially when the concerns raised by 17 eminent citizens, including Justice V.R. Krishna Iyer, former justice of Supreme Court; Justice A.P. Shah, former chairman of the Law Commission of India; Prof. Upendra Baxi, eminent legal philosopher; K.G. Kannabiran (late), co-founder and President of the People's Union of Civil Liberties; Romila Thapar and Uma Chakravarti, historians, in September 2010 have been vindicated.

Also read: Aadhar project and issue of privacy in India and worldwide

Q: As you mentioned above, there are pre-existing identification documents recognised by ECI. So, what about the claims of the Aadhaar promoters that many Indians do not even have any existing identification proof?

A: The Executive Summary of CAG's audit report begins by talking about "Identification of the right individuals" for "welfare schemes". Immediately after that it starts talking about how "citizens were required to furnish multiple documents….to various Government as well as private agencies." It refers to the inconvenience of "those who did not have any of these identity documents." It states that in order to "overcome the challenge, the Union Government decided to introduce a unique identity (UID) for the residents of India" in 2009.

However, contrary to the claims of the promoters of biometric Aadhaar like Nandan Nilekani that "[m]illions of people without any ID, now have an ID", the fact is that of all the Aadhaar numbers issued to Indian residents till date – 99.97 per cent had pre-existing identification (ID) documents. This has been revealed in a reply to an application of Ujjainee Sharma and Trishna Senapaty under Right to Information Act by UIDAI. This proves that "an inability to prove identity" was not a major barrier to access benefits and subsidies.

Q: The CAG report states that Aadhaars have been issued to minors below the age of five years based on the biometrics of their parents. Do you think it is concerning?

A: The CAG's report asserts that, "Issue of Aadhaar numbers to minor children below the age of five, based on the biometrics of their parents, without confirming uniqueness of biometric identity goes against the basic tenet of the Aadhaar Act". UIDAI is acting unmindful of the fact that, "Supreme Court has stated that no benefit will be denied to any child for want of Aadhaar". It brings to light the fact that UIDAI continues to incur avoidable expenditure on the issue of Bal Aadhaars.

Q: We have a huge existence of unpaired biometric data and Aaadhar numbers being paired with mismatched documents. The UIDAI has so far failed to identify the exact extent of mismatch. Does it make the very purpose of the UID vulnerable?

A: The Aadhaar scheme stands exposed like the UK's ID project. It is a tried, tested and failed scheme. The CAG's audit report vindicates the verdict authored by the nine-judge Constitution bench of Hon'ble Supreme Court in Justice K.S. Puttaswamy vs. Union of India (2017).

The dissenting judgment of Justice D.Y. Chandrachud of the 5-judge Constitution bench in 2018's Aadhaar judgment assumes greater significance because it is he who authored the leading opinion of the nine-judge Constitution Bench on right to privacy in this very case which had the concurrence of all the judges. A harmonious construction of the verdict of Justice Chandrachud as part of the nine-judge bench and his dissenting order as part of the five-judge bench reveals several inconsistencies in Justice A.K. Sikri's majority opinion; it becomes evident that latter's opinion is inconsistent with the opinion of the nine-judge Constitution Bench. In fact, the judgment authored by Justice Sikri is inconsistent with his own observations too. It has evaded even those facts, sequence of events and scientific evidence which are on record.

Referring to the Aadhaar database project, Justice Sikri observed: "Its use is spreading like wildfire, which is the result of robust and aggressive campaigning done by the Government, governmental agencies and other such bodies…The Government boasts of multiple benefits of Aadhaar." It may be recalled that the first Chairman of UIDAI, Nandan Nilekani, used to refer to "robust and aggressive campaigning" as marketing, saying success or failure of Aadhaar depends on its marketing or campaigning. The judge in question recognised that this project is a result of marketing. He carefully uses the word "boasts" with regard to the government's claims about its "multiple benefits".

The opening statement of the Justice Sikri authored opinion reads: "It is better to be unique than the best. Because, being the best makes you the number one, but being unique makes you the only one. 'Unique makes you the only one' is the central message of Aadhaar, which is on the altar facing constitutional challenge in these petitions." This opening statement of the opinion is questionable from a scientific point of view. Thus, the CAG's audit report reveals that "multiple benefits" which were "boasted" are just boasts.

Also read: Aadhar-PAN Judgment – Of Judicial Evasion, Unchallenged Assumptions and Non-Engagements

Q: In the Aadhaar judgment, the government argued that seeding of Aadhaar numbers into the Permanent Account Number [PAN] database will only allow a robust way of de-duplication. But even after 10 years of it being introduced, do you think we are any way near to the de-duplication promise?

A: With regard to the requirement of linking Aadhaar, an identification number of a "resident" of India who is "entitled" to have it, with PAN for filing Income Tax Returns, a joint reading of the relevant provisions of Income-tax Act, 1961 and Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 reveals that it is only relevant for a "resident" who has exercised her/his entitlement and has enrolled as "an individual who has resided in India for a period or periods amounting in all to one hundred and eighty-two days or more in the twelve months immediately preceding the date of application for enrolment", under Section 2(v) of the Aadhaar Act.

It is made clearly manifest from Section 3(1) of the Aadhaar Act, which reads, "Every resident shall be entitled to obtain an Aadhaar number by submitting his demographic information and biometric information by undergoing the process of enrolment: Provided that the Central Government may, from time to time, notify such other category of individuals who may be entitled to obtain an Aadhaar number." It is quite clear that the emphasis of the provision is on the word "entitled", making it applicable solely to those residents of India who have undertaken "enrolment" as an entitlement. All entitlements are voluntary.

Further, Section 139AA(1) of the Income-tax Act states, "Every person who is eligible to obtain Aadhaar number shall, on or after the 1st day of July, 2017, quote Aadhaar number—(i) in the application form for allotment of permanent account number; (ii) in the return of income: Provided that where the person does not possess the Aadhaar Number, the Enrolment ID of Aadhaar application form issued to him at the time of enrolment shall be quoted in the application for permanent account number or, as the case may be, in the return of income furnished by him."

In the above provision, the emphasis is on the word "eligible". Being "eligible to obtain an Aadhaar number" does not and cannot imply that an individual is under compulsion to exercise one's eligibility. Nowhere does section 139AA, or any other instrumentality of the State, say that "enrolment" is mandatory; in fact the opposite is emphasised. The fact is that a person who has not enrolled, will not and cannot have any Enrolment ID of Aadhaar application form "issued to him". Section 139AA simply undertakes an exercise in behavioural modification, to nudge an individual to believe that "it means that she/he has to "enrol" because she/he is eligible.

What is being demanded of an individual under section 139AA is "Aadhaar number" in the return of income. But this is only possible in the case of those who have already enrolled voluntarily. This demand is addressed to those who have an Aadhaar number, not to those who do not have it. Those who have not enrolled cannot do the impossible, which is, to provide what they are not bound by law to possess.

In the light of the privacy and Aadhaar judgments, Section 25 of the Aadhaar and Other Laws (Amendment) Act, 2019 and the verdict of the five-judge Constitution bench of Hon'ble Supreme Court in Rojer Mathew versus South India Bank Ltd. & Ors (2019), there is a compelling constitutional and legal logic for the Income Tax Department to put a stay on the execution of the requirement of linking Aadhaar number with PAN for filing Income Tax Returns, and facilitate filing the same by quoting PAN alone.

Also read: Delhi HC notice to Centre, NCT govt over PIL seeking to link Aadhar to property documents 

Q: When we say that Aadhaar is one of the largest databases in the world, one of the most pertinent concerns is its data archiving policy. Data retention is clearly an indispensable aspect of understanding the privacy rights of individuals, especially when we talk about the right to be forgotten. We do not have such a policy right now. In the absence of this, there is no accountability on how and what type of the data is stored, be it personal data or sensitive personal data. What are your thoughts on this, especially on the aspect of informational privacy? 

A: The union government has acknowledged that data privacy and the need to protect personal information is almost never a concern when data is stored in a decentralised manner. Data that is maintained in silos is largely useless outside that silos, and consequently has a low likelihood of causing any damage. However, all this has changed with the implementation of the Aadhaar. One of the inevitable consequences of Aadhaar will be that the UID will unify multiple databases. As more and more agencies of the government sign on to the UID Project, the UID Number will become the common thread that links all those databases together.

Over time, private enterprise could also adopt the Aadhaar as an identifier for the purposes of the delivery of their services or even for enrolment as a customer. It is quite revealing that the Government of India's 2010 Approach Paper for a Legislation on Privacy asserted, "Once this happens, the separation of data that currently exists between multiple databases will vanish."

This poses a threat to the identity of citizens and the idea of residents of the State as private persons will be forever abandoned. The crucial issue of fundamental right to privacy is linked with the issue of denial of constitutionally guaranteed natural rights of citizens in the absence of biometric profiling based Aadhaar. This approach of the government implies that the right to have public services is now dependent on having a biometric Aadhaar number. Since 2010 to 2018, the government has kept promising that it will enact a right to privacy and data protection law, but it is yet to see the light of the day.

Q: Do you think there is a possibility of linking the Aadhaar number with the National Judicial Data Grid?

A: The current chairman of UIDAI, J. Satyanarayana, has been the member of the Task Force for preparation of the Policy Document on Identity and Access Management under National e-Governance Programme, which submitted its report in 2006. Coincidentally, the Processes Committee of the Planning Commission set up in July 2006 assigned the task of preparing the "UIDAI Strategic Vision: Creating a Unique Identity Number for every Resident of India" to Wipro Ltd. during the same period. This report talked about "Citizen Identities" and "Owner of identities".

This April 2007 report revealed that "National UID Project has been initiated, with Voter ID Numbers and BPL households in the first instance." It emerged from the report that long before the arrival of Nilekani, in July 2009, as Chairman of UIDAI, the Aadhaar project was already unfolding. This report also discloses that each registered judicial court has a UID number at Subordinate Courts, High Court and Supreme Court. This effort seems to be part of profiling and surveillance of judicial institutions.

Thus, the path being traversed by National Judicial Data Grid, a database of orders, judgments and case details of 18,735 computerised District and Subordinate Courts that has been created as an online platform under the eCourts Project, has reached the stage of launch of the Interoperable Criminal Justice System, which seeks to integrate and make data interoperable between different institutions, such as police, prisons and courts, involved in the criminal justice system. This seems to be the path of complete end of separation of powers.

Also read: Linking Voter IDs with Aadhar Dangerous, Over 500 Citizens, Organisations Write to EC

Q: You have previously written that the Aadhaar scheme is linked to the electoral databases. Please explain this claim further. 

A: A careful perusal of UIDAI documents reveals that this scheme is linked to the electoral database too. A confidential document of UIDAI titled 'Creating a unique identity number for every resident in India', leaked by Wikileaks on November 13, 2009 reads: "One way to ensure that the UID is used by all government and private agencies is by inserting it into the birth certificate of the infant. Since the birth certificate is the original identity document, it is likely that this number will then persist as the key identifier through the individual's various life events, such as joining school, immunizations, voting etc."

A strange situation has emerged where citizens chose a government that was supposed to represent them but their government is undertaking the task of coercively biometrically authenticating whether or not those it represents are indeed those who they claim to be. It ends up breaking the sacrosanct social contract between the citizen and the State in an unprecedented act of breach of trust. If opposition parties in India fail to promise abandonment of the Aadhaar project in their manifestos like UK's opposition parties even after the CAG's audit report, it will only indicate that electoral bonds have overwhelmed them.

The proponents of the world's biggest citizen identification scheme aim to converge the electoral photo identity card numbers of the electoral database and the Aadhaar number database through the Central Identities Data Repository. UK abandoned it following the recommendations of LSE's report, but India's political opposition seems to feign ignorance.

Will the Supreme Court's yet to be constituted seven-judge bench, to review the Aadhar judgment, take cognisance of both the LSE's report and CAG's report to decide the constitutionality of Aadhaar Act? The attempt to undertake convergence of all the sensitive databases of Indians and the confidence of promoters of UID in the irreversibility of their efforts has thrown yet another unmet open constitutional challenge.