Enact Strong Privacy Protection Law
Privacy goes beyond Aadhaar and its data
The Unique Identification Authority of India, which issues Aadhaar cards, has registered a complaint of someone making use of stored biometric information for Aadhaar authorisation, raising concerns over how securely information collected from citizens to build Aadhaar, the unique identity number, is stored and used. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act says that impersonation or intentional copying of Aadhaar data is a criminal offence. Those found guilty must be punished. Security of personal information goes beyond Aadhaar. India should not delay an unambiguous law to protect citizen’s privacy, given the judicial interpretation that privacy is a derivative of fundamental rights.
It must be modelled on the European Union’s approach to privacy. The EU has common rules to ensure that personal data enjoy a high standard of protection across its member states -- a citizen has the right to complain and obtain redress if her data are misused anywhere within the EU, and organisations that collect and manage personal information are mandated to protect it from misuse. Rightly, Aadhaarseeded bank accounts are now used to transfer benefits directly to the beneficiary. People must share information as it is in their interest to do so, but absence of a separate law on privacy raises the chance of Aadhaar being misused, for example to connect the separate silos in which medical, financial, legal information is stored. Indian residents need a guarantee that their personal data would not fall into the wrong hands.
A telling example is the reported sale of phone numbers of girls at mobile recharge shops in Uttar Pradesh to men who then stalk these girls. Call records or transactions stored on assorted messaging applications also pose a threat to privacy, underscoring the need for a strong law. It should specify the circumstances in which privacy can be breached by the state, and separate silos must be merged only for national security and after following due procedure that includes judicial sanction.