Storing Aadhar is Punishable - Full Details
Asking for linking the Aadhaar number, for it to be quoted on forms, displaying it on certificates and documents, storing it in registers or databases is completely illegal and punishable with a fine and imprisonment under the Aadhaar Act 2016.
The use of the Aadhaar number is governed by The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016. Chapter II of the Act is on Enrolment and defines the creation of the Aadhaar number, its properties and measures for its issuance. Chapter III is on Authentication. It covers the use of the number for purpose of establishing identity.
Chapter V and VI deal with the establishment, powers and funding of the UIDAI. Chapter VI concerns itself with security and confidentiality of the information with UIDAI. Chapter VII deals with penalties for various offences under the Act. The final section, VIII, deals with powers of the central government to supersede the authority and the power of the authority to make regulations.
The UIDAI notified 5 Regulations on 12 September 2016.
1. Unique Identification Authority Of India (Transaction Of Business At Meetings Of The Authority) Regulations, 2016 (No. 1 Of 2016),
2. Aadhaar (Enrolment And Update) Regulations, 2016 (No. 2 Of 2016),
3. Aadhaar (Authentication) Regulations, 2016 (No. 3 Of 2016),
4. Aadhaar (Data Security) Regulations, 2016 (No. 4 Of 2016),
5. Aadhaar (Sharing Of Information) Regulations, 2016 (No. 5 Of 2016)
Permitted Use
Chapter III 8 of the Act, therefore, is the only section defining the use of Aadhaar numbers. It is evident that the only use of the Aadhaar number, according to the Act, is authentication of individuals.
8. (1) The Authority shall perform authentication of the Aadhaar number of an Aadhaar number holder submitted by any requesting entity, in relation to his biometric information or demographic information, subject to such conditions and on payment of such fees and in such manner as may be specified by regulations.
(2) A requesting entity shall—
(a) unless otherwise provided in this Act, obtain the consent of an individual before collecting his identity information for the purposes of authentication in such manner as may be specified by regulations; and
(b) ensure that the identity information of an individual is only used for submission to the Central Identities Data Repository for authentication.
(3) A requesting entity shall inform, in such manner as may be specified by regulations, the individual submitting his identity information for authentication, the following details with respect to authentication, namely:—
(a) the nature of information that may be shared upon authentication;
(b) the uses to which the information received during authentication may be put by the requesting entity; and
(c) alternatives to submission of identity information to the requesting entity.
(4) The Authority shall respond to an authentication query with a positive, negative or any other appropriate response, sharing such identity information excluding any core biometric information.
Authentication is defined thrice. First in Chapter I 2(c) of the Act, then in Enrolment and Update Regulations, Chapter I 2(d) and in Authentication Regulations, Chapter I 2(c).
2(c). “Authentication” means the process by which the Aadhaar number alongwith demographic information or biometric information of an individual is submitted to the Central Identities Data Repository for its verification and such Repository verifies the correctness, or the lack thereof, on the basis of information available with it.
The Authentication Regulations Chapter II 3 defines the types of authentication.
3. Types of Authentication.— There shall be two types of authentication facilities provided by the Authority, namely:
(i) Yes/No authentication facility, which may be carried out using any of the modes specified in regulation 4(2); and
(ii) e-KYC authentication facility, which may be carried out only using OTP and/ or biometric authentication modes as specified in regulation 4(2).
The Authentication Regulations Chapter II 4 defines the modes of authentication.
4. Modes of Authentication
(1) An authentication request shall be entertained by the Authority only upon a request sent by a requesting entity electronically in accordance with these regulations and conforming to the specifications laid down by the Authority.
(2) Authentication may be carried out through the following modes:
(a) Demographic authentication: The Aadhaar number and demographic information of the Aadhaar number holder obtained from the Aadhaar number holder is matched with the demographic information of the Aadhaar number holder in the CIDR.
(b) One-time pin based authentication: A One Time Pin (OTP), with limited time validity, is sent to the mobile number and/ or e-mail address of the Aadhaar number holder registered with the Authority, or generated by other appropriate means. The Aadhaar number holder shall provide this OTP along with his Aadhaar number during authentication and the same shall be matched with the OTP generated by the Authority.
(c) Biometric-based authentication: The Aadhaar number and biometric information submitted by an Aadhaar number holder are matched with the biometric information of the said Aadhaar number holder stored in the CIDR. This may be fingerprints-based or iris-based authentication or other biometric modalities based on biometric information stored in the CIDR.
(d) Multi-factor authentication: A combination of two or more of the above modes may be used for authentication.
(3) A requesting entity may choose suitable mode(s) of authentication from the modes specified in sub-regulation (2) for a particular service or business function as per its requirement, including multiple factor authentication for enhancing security. For the avoidance of doubt, it is clarified that e-KYC authentication shall only be carried out using OTP and/ or biometric authentication.
The Authentication Regulations Chapter II 9 defines the process of sending authentication requests.
9. Process of sending authentication requests
(1) After collecting the Aadhaar number or any other identifier provided by the requesting entity, which is mapped to Aadhaar number and necessary demographic and /or biometric information and/ or OTP from the Aadhaar number holder, the client application shall immediately package and encrypt these input parameters into PID block before any transmission, as per the specifications laid down by the Authority, and shall send it to server of the requesting entity using secure protocols as may be laid down by the Authority for this purpose.
(2) After validation, the server of a requesting entity shall pass the authentication request to the CIDR, through the server of the Authentication Service Agency as per the specifications laid down by the Authority. The authentication request shall be digitally signed by the requesting entity and/or by the Authentication Service Agency, as per the mutual agreement between them.
(3) Based on the mode of authentication request, the CIDR shall validate the input parameters against the data stored therein and return a digitally signed Yes or No authentication response, or a digitally signed e-KYC authentication response with encrypted e-KYC data, as the case may be, along with other technical details related to the authentication transaction.
(4) In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the input parameters specified in sub-regulation (1) above such that authentication is always reduced to a 1:1 match.
(5) A requesting entity shall ensure that encryption of PID Block takes place at the time of capture on the authentication device as per the processes and specifications laid down by the Authority.
While it is evident that without the Aadhaar number a 1:1 match is not possible, we will ignore that consideration for now. Let us look at what the UIDAI’s response should be to an authentication query. It should return only Yes or No authentication response, or a digitally signed e-KYC authentication response.
eKYC
Section 16 (3) of the Authentication Regulations, any KUA can store the eKYC record only and cannot share the eKYC without consent of the Aadhaar holder.
16. Use of e-KYC authentication facility.—
(1) A KUA may use the e-KYC authentication facility provided by the Authority for obtaining the e-KYC data of the Aadhaar number holder for its own purposes.
(2) A KUA may perform e-KYC authentication on behalf of other agencies, and share the e-KYC data with such agency for a specified purpose, upon obtaining consent from the Aadhaar number holder for such purpose.
(3) A KUA may store, with consent of the Aadhaar number holder, e-KYC data of an Aadhaar number holder, received upon e-KYC authentication, in encrypted form and subsequently share the e-KYC data with any other agency, for a specified purpose, upon obtaining separate consent for every such sharing from the Aadhaar number holder for that purpose.
(4) The agency with whom the KUA has shared the e-KYC data of the Aadhaar number holder shall not share it further with any other entity or agency except for completing the transaction for which the Aadhaar number holder has specifically consented to such sharing.
(5) The Aadhaar number holder may, at any time, revoke consent given to a KUA for storing his e-KYC data or for sharing it with third parties, and upon such revocation, the KUA shall delete the e-KYC data and cease any further sharing.
(6) In addition to the restriction on further sharing contained in sub-regulation (4), all other obligations relating to the personal information of the Aadhaar number holder, data security and other relevant responsibilities applicable to requesting entities, shall also apply to the agency or entity with whom e-KYC data has been shared in accordance with this regulation 16.
(7) Upon request, a KUA shall provide a digitally signed electronic copy of the e-KYC data to the Aadhaar number holder, and the Aadhaar number holder may subsequently share the said copy with any agency: Provided that the agency that is requesting e-KYC data from the Aadhaar number holder shall inform the purpose of doing so and take the consent of the Aadhaar number; Provided further that the agency with whom the Aadhaar number holder has shared the e-KYC data shall not share it further with any other entity/agency except for completing the transaction for which the Aadhaar number holder specifically consented to such sharing.
(8) The KUA shall maintain auditable logs of all such transactions where e-KYC data has been shared with other agencies, for a period specified by the Authority.
A KYC User Agency (KUA) is defined in Chapter I 2(l) of the Authentication Regulations.
(l) “e-KYC User Agency” or “KUA” shall mean a requesting entity which, in addition to being an AUA, uses e-KYC authentication facility provided by the Authority;
eKYC data is defined under 2(k) of the Authentication Regulations, 2016 and does not include the Aadhaar number.
(k) “e-KYC data” means demographic information and photograph of an Aadhaar number holder;
Reading 8 and16(3) with 2(k) means Aadhaar number can only be used for authentication and only the eKYC data can be stored by the KUA on consent of the Aadhaar holder. The Aadhaar number cannot be stored.
Strangely the UIDAI’s own API is in violation of the Act by returning the Aadhaar number in an eKYC record. The API seems to have been developed by a group of IT professionals, including former UIDAI employees, calling themselves as “volunteers” to a group called iSprit as a part of the India Stack.
Storage and Retention of Aadhaar Numbers
Chapter IV 29 of the Aadhaar Act places clear restrictions on sharing information to that specified in the Act in the manner specified by the regulations. It prohibits publishing, displaying or posting publicly any Aadhaar number. Thus no other sharing of the Aadhaar number and the e-KYC data is possible.
29. (1) No core biometric information, collected or created under this Act, shall be—
(a) shared with anyone for any reason whatsoever; or
(b) used for any purpose other than generation of Aadhaar numbers and authentication under this Act.
(2) The identity information, other than core biometric information, collected or created under this Act may be shared only in accordance with the provisions of this Act and in such manner as may be specified by regulations.
(3) No identity information available with a requesting entity shall be—
(a) used for any purpose, other than that specified to the individual at the time of submitting any identity information for authentication; or
(b) disclosed further, except with the prior consent of the individual to whom such information relates.
(4) No Aadhaar number or core biometric information collected or created under this Act in respect of an Aadhaar number holder shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations.
All storage of Aadhaar numbers is therefore illegal and a violation of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016.
Any retention of the Aadhaar number by any organization or database would not be in accordance with The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016. Asking for linking the Aadhaar number, for it to be quoted on forms, displaying it on certificates and documents, storing it in registers or databases is completely illegal and a violation of the provisions of the Aadhaar Act.
Offences and Penalties
Organisations that continue to ask for Aadhaar numbers in their forms, displaying or storing it on their documents, certificates, registers and databases would be committing offences under Chapter VII 38, 39, 40, 41, 42 and various sections of the IPC.
38. Whoever, not being authorised by the Authority, intentionally,—
(a) accesses or secures access to the Central Identities Data Repository;
(b) downloads, copies or extracts any data from the Central Identities Data Repository or stored in any removable storage medium;
(c) introduces or causes to be introduced any virus or other computer contaminant in the Central Identities Data Repository;
(d) damages or causes to be damaged the data in the Central Identities Data Repository;
(e) disrupts or causes disruption of the access to the Central Identities Data Repository;
(f) denies or causes a denial of access to any person who is authorised to access the Central Identities Data Repository;
(g) reveals any information in contravention of sub-section (5) of section 28, or shares, uses or displays information in contravention of section 29 or assists any person in any of the aforementioned acts;
(h) destroys, deletes or alters any information stored in any removable storage media or in the Central Identities Data Repository or diminishes its value or utility or affects it injuriously by any means; or
(i) steals, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used by the Authority with an intention to cause damage, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which shall not be less than ten lakh rupees.
Explanation.—For the purposes of this section, the expressions “computer contaminant”, “computer virus” and “damage” shall have the meanings respectively assigned to them in the Explanation to section 43 of the Information Technology Act, 2000, and the expression “computer source code” shall have the meaning assigned to it in the Explanation to section 65 of the said Act.
39. Whoever, not being authorised by the Authority, uses or tampers with the data in the Central Identities Data Repository or in any removable storage medium with the intent of modifying information relating to Aadhaar number holder or discovering any information thereof, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which may extend to ten thousand rupees.
40. Whoever, being a requesting entity, uses the identity information of an individual in contravention of sub-section (3) of section 8, shall be punishable with imprisonment which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.
41. Whoever, being an enrolling agency or a requesting entity, fails to comply with the requirements of sub-section (2) of section 3 or sub-section (3) of section 8, shall be punishable with imprisonment which may extend to one year or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.
42. Whoever commits an offence under this Act or any rules or regulations made thereunder for which no specific penalty is provided elsewhere than this section, shall be punishable with imprisonment for a term which may extend to one year or with a fine which may extend to twenty-five thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees, or with both.
The only valid use of the Aadhaar number under the Act is to obtain a yes/no answer or obtain the demographic information (an e-KYC record) associated with an Aadhaar number submitted with the consent of its holder. The increasing demand for recording the Aadhaar number in various forms, documents, registers, certificates, and databases is illegal. The increasing number of leaks of Aadhaar numbers and associated peronal information indicate the widespread misunderstanding of the Aadhaar number, its use and the Aadhaar Act. You are within your rights to write to the UIDAI with your complaint. Here is a draft.
Dr AB Pandey
Chief Executive Officer (CEO),
Unique Identification Authority of India -UIDAI
3rd Floor, Tower II, Jeevan Bharati Building,
Connaught Circus,
New Delhi - 110001
Subject: Complaint of violations under The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016
We bring to your attention that the following person/organization
Insert Name and Address of violater:
are indulging in (please tick all that apply)
• Storage or retention of Aadhaar number in their registers or databases
• Linking the Aadhaar number to their databases
• Requesting for the Aadhaar number to be quoted on forms
• Displaying Aadhaar number on certificates and documents,
• Publishing Aadhaar numbers publicly
in violation of
• The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016
• Unique Identification Authority Of India (Transaction Of Business At Meetings Of The Authority) Regulations, 2016 (No. 1 Of 2016),
• Aadhaar (Enrolment And Update) Regualtions, 2016 (No. 2 Of 2016),
• Aadhaar (Authentication) Regulations, 2016 (No. 3 Of 2016),
• Aadhaar (Data Security) Regulations, 2016 (No. 4 Of 2016),
• Aadhaar (Sharing Of Information) Regulations, 2016 (No. 5 Of 2016)
They have, therefore, committed offences under Chapter VII 38, 39, 40, 41, 42 of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 and various sections of the IPC.
We require that you:
1. Immediately file an FIR for maximum penalty under relevant sections of relevant laws.
2. Provide a copy of the the FIR in 7 days, failing which explain the reasons for delay in discharge of duty and officers responsible for the delay.
3. Issue notifications and wide publicity in the electronic and print media including radio and television networks to make it clear that storage, linking, obtaining on forms, displaying on certificates and documents, and publishing of Aadhaar numbers is a crime punishable with fine and imprisonment.
We trust you will do all within Chapter VI of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 to protect our information and not cause us to seek other remedies and relief.
Sincerely yours,
Encl:
Evidence of offence
CC:
1. Shri Nripendra Mishra, Principal Secretary to Prime Minister, 152, South Block, Raisina Hill, New Delhi-110011
2. Chief Justice of India, ℅ Chief Justice's Conference Secretariat, Supreme Court of India, Tilak Marg, New Delhi-110 201
3. You can tweet it to the CEO of UIDAI @ceo_uidai and @uidai
4. You can send emails to UIDAI's DG : dg@uidai.gov.in and alok.shukla@uidai.gov.in more
The use of the Aadhaar number is governed by The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016. Chapter II of the Act is on Enrolment and defines the creation of the Aadhaar number, its properties and measures for its issuance. Chapter III is on Authentication. It covers the use of the number for purpose of establishing identity.
Chapter V and VI deal with the establishment, powers and funding of the UIDAI. Chapter VI concerns itself with security and confidentiality of the information with UIDAI. Chapter VII deals with penalties for various offences under the Act. The final section, VIII, deals with powers of the central government to supersede the authority and the power of the authority to make regulations.
The UIDAI notified 5 Regulations on 12 September 2016.
1. Unique Identification Authority Of India (Transaction Of Business At Meetings Of The Authority) Regulations, 2016 (No. 1 Of 2016),
2. Aadhaar (Enrolment And Update) Regulations, 2016 (No. 2 Of 2016),
3. Aadhaar (Authentication) Regulations, 2016 (No. 3 Of 2016),
4. Aadhaar (Data Security) Regulations, 2016 (No. 4 Of 2016),
5. Aadhaar (Sharing Of Information) Regulations, 2016 (No. 5 Of 2016)
Permitted Use
Chapter III 8 of the Act, therefore, is the only section defining the use of Aadhaar numbers. It is evident that the only use of the Aadhaar number, according to the Act, is authentication of individuals.
8. (1) The Authority shall perform authentication of the Aadhaar number of an Aadhaar number holder submitted by any requesting entity, in relation to his biometric information or demographic information, subject to such conditions and on payment of such fees and in such manner as may be specified by regulations.
(2) A requesting entity shall—
(a) unless otherwise provided in this Act, obtain the consent of an individual before collecting his identity information for the purposes of authentication in such manner as may be specified by regulations; and
(b) ensure that the identity information of an individual is only used for submission to the Central Identities Data Repository for authentication.
(3) A requesting entity shall inform, in such manner as may be specified by regulations, the individual submitting his identity information for authentication, the following details with respect to authentication, namely:—
(a) the nature of information that may be shared upon authentication;
(b) the uses to which the information received during authentication may be put by the requesting entity; and
(c) alternatives to submission of identity information to the requesting entity.
(4) The Authority shall respond to an authentication query with a positive, negative or any other appropriate response, sharing such identity information excluding any core biometric information.
Authentication is defined thrice. First in Chapter I 2(c) of the Act, then in Enrolment and Update Regulations, Chapter I 2(d) and in Authentication Regulations, Chapter I 2(c).
2(c). “Authentication” means the process by which the Aadhaar number alongwith demographic information or biometric information of an individual is submitted to the Central Identities Data Repository for its verification and such Repository verifies the correctness, or the lack thereof, on the basis of information available with it.
The Authentication Regulations Chapter II 3 defines the types of authentication.
3. Types of Authentication.— There shall be two types of authentication facilities provided by the Authority, namely:
(i) Yes/No authentication facility, which may be carried out using any of the modes specified in regulation 4(2); and
(ii) e-KYC authentication facility, which may be carried out only using OTP and/ or biometric authentication modes as specified in regulation 4(2).
The Authentication Regulations Chapter II 4 defines the modes of authentication.
4. Modes of Authentication
(1) An authentication request shall be entertained by the Authority only upon a request sent by a requesting entity electronically in accordance with these regulations and conforming to the specifications laid down by the Authority.
(2) Authentication may be carried out through the following modes:
(a) Demographic authentication: The Aadhaar number and demographic information of the Aadhaar number holder obtained from the Aadhaar number holder is matched with the demographic information of the Aadhaar number holder in the CIDR.
(b) One-time pin based authentication: A One Time Pin (OTP), with limited time validity, is sent to the mobile number and/ or e-mail address of the Aadhaar number holder registered with the Authority, or generated by other appropriate means. The Aadhaar number holder shall provide this OTP along with his Aadhaar number during authentication and the same shall be matched with the OTP generated by the Authority.
(c) Biometric-based authentication: The Aadhaar number and biometric information submitted by an Aadhaar number holder are matched with the biometric information of the said Aadhaar number holder stored in the CIDR. This may be fingerprints-based or iris-based authentication or other biometric modalities based on biometric information stored in the CIDR.
(d) Multi-factor authentication: A combination of two or more of the above modes may be used for authentication.
(3) A requesting entity may choose suitable mode(s) of authentication from the modes specified in sub-regulation (2) for a particular service or business function as per its requirement, including multiple factor authentication for enhancing security. For the avoidance of doubt, it is clarified that e-KYC authentication shall only be carried out using OTP and/ or biometric authentication.
The Authentication Regulations Chapter II 9 defines the process of sending authentication requests.
9. Process of sending authentication requests
(1) After collecting the Aadhaar number or any other identifier provided by the requesting entity, which is mapped to Aadhaar number and necessary demographic and /or biometric information and/ or OTP from the Aadhaar number holder, the client application shall immediately package and encrypt these input parameters into PID block before any transmission, as per the specifications laid down by the Authority, and shall send it to server of the requesting entity using secure protocols as may be laid down by the Authority for this purpose.
(2) After validation, the server of a requesting entity shall pass the authentication request to the CIDR, through the server of the Authentication Service Agency as per the specifications laid down by the Authority. The authentication request shall be digitally signed by the requesting entity and/or by the Authentication Service Agency, as per the mutual agreement between them.
(3) Based on the mode of authentication request, the CIDR shall validate the input parameters against the data stored therein and return a digitally signed Yes or No authentication response, or a digitally signed e-KYC authentication response with encrypted e-KYC data, as the case may be, along with other technical details related to the authentication transaction.
(4) In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the input parameters specified in sub-regulation (1) above such that authentication is always reduced to a 1:1 match.
(5) A requesting entity shall ensure that encryption of PID Block takes place at the time of capture on the authentication device as per the processes and specifications laid down by the Authority.
While it is evident that without the Aadhaar number a 1:1 match is not possible, we will ignore that consideration for now. Let us look at what the UIDAI’s response should be to an authentication query. It should return only Yes or No authentication response, or a digitally signed e-KYC authentication response.
eKYC
Section 16 (3) of the Authentication Regulations, any KUA can store the eKYC record only and cannot share the eKYC without consent of the Aadhaar holder.
16. Use of e-KYC authentication facility.—
(1) A KUA may use the e-KYC authentication facility provided by the Authority for obtaining the e-KYC data of the Aadhaar number holder for its own purposes.
(2) A KUA may perform e-KYC authentication on behalf of other agencies, and share the e-KYC data with such agency for a specified purpose, upon obtaining consent from the Aadhaar number holder for such purpose.
(3) A KUA may store, with consent of the Aadhaar number holder, e-KYC data of an Aadhaar number holder, received upon e-KYC authentication, in encrypted form and subsequently share the e-KYC data with any other agency, for a specified purpose, upon obtaining separate consent for every such sharing from the Aadhaar number holder for that purpose.
(4) The agency with whom the KUA has shared the e-KYC data of the Aadhaar number holder shall not share it further with any other entity or agency except for completing the transaction for which the Aadhaar number holder has specifically consented to such sharing.
(5) The Aadhaar number holder may, at any time, revoke consent given to a KUA for storing his e-KYC data or for sharing it with third parties, and upon such revocation, the KUA shall delete the e-KYC data and cease any further sharing.
(6) In addition to the restriction on further sharing contained in sub-regulation (4), all other obligations relating to the personal information of the Aadhaar number holder, data security and other relevant responsibilities applicable to requesting entities, shall also apply to the agency or entity with whom e-KYC data has been shared in accordance with this regulation 16.
(7) Upon request, a KUA shall provide a digitally signed electronic copy of the e-KYC data to the Aadhaar number holder, and the Aadhaar number holder may subsequently share the said copy with any agency: Provided that the agency that is requesting e-KYC data from the Aadhaar number holder shall inform the purpose of doing so and take the consent of the Aadhaar number; Provided further that the agency with whom the Aadhaar number holder has shared the e-KYC data shall not share it further with any other entity/agency except for completing the transaction for which the Aadhaar number holder specifically consented to such sharing.
(8) The KUA shall maintain auditable logs of all such transactions where e-KYC data has been shared with other agencies, for a period specified by the Authority.
A KYC User Agency (KUA) is defined in Chapter I 2(l) of the Authentication Regulations.
(l) “e-KYC User Agency” or “KUA” shall mean a requesting entity which, in addition to being an AUA, uses e-KYC authentication facility provided by the Authority;
eKYC data is defined under 2(k) of the Authentication Regulations, 2016 and does not include the Aadhaar number.
(k) “e-KYC data” means demographic information and photograph of an Aadhaar number holder;
Reading 8 and16(3) with 2(k) means Aadhaar number can only be used for authentication and only the eKYC data can be stored by the KUA on consent of the Aadhaar holder. The Aadhaar number cannot be stored.
Strangely the UIDAI’s own API is in violation of the Act by returning the Aadhaar number in an eKYC record. The API seems to have been developed by a group of IT professionals, including former UIDAI employees, calling themselves as “volunteers” to a group called iSprit as a part of the India Stack.
Storage and Retention of Aadhaar Numbers
Chapter IV 29 of the Aadhaar Act places clear restrictions on sharing information to that specified in the Act in the manner specified by the regulations. It prohibits publishing, displaying or posting publicly any Aadhaar number. Thus no other sharing of the Aadhaar number and the e-KYC data is possible.
29. (1) No core biometric information, collected or created under this Act, shall be—
(a) shared with anyone for any reason whatsoever; or
(b) used for any purpose other than generation of Aadhaar numbers and authentication under this Act.
(2) The identity information, other than core biometric information, collected or created under this Act may be shared only in accordance with the provisions of this Act and in such manner as may be specified by regulations.
(3) No identity information available with a requesting entity shall be—
(a) used for any purpose, other than that specified to the individual at the time of submitting any identity information for authentication; or
(b) disclosed further, except with the prior consent of the individual to whom such information relates.
(4) No Aadhaar number or core biometric information collected or created under this Act in respect of an Aadhaar number holder shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations.
All storage of Aadhaar numbers is therefore illegal and a violation of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016.
Any retention of the Aadhaar number by any organization or database would not be in accordance with The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016. Asking for linking the Aadhaar number, for it to be quoted on forms, displaying it on certificates and documents, storing it in registers or databases is completely illegal and a violation of the provisions of the Aadhaar Act.
Offences and Penalties
Organisations that continue to ask for Aadhaar numbers in their forms, displaying or storing it on their documents, certificates, registers and databases would be committing offences under Chapter VII 38, 39, 40, 41, 42 and various sections of the IPC.
38. Whoever, not being authorised by the Authority, intentionally,—
(a) accesses or secures access to the Central Identities Data Repository;
(b) downloads, copies or extracts any data from the Central Identities Data Repository or stored in any removable storage medium;
(c) introduces or causes to be introduced any virus or other computer contaminant in the Central Identities Data Repository;
(d) damages or causes to be damaged the data in the Central Identities Data Repository;
(e) disrupts or causes disruption of the access to the Central Identities Data Repository;
(f) denies or causes a denial of access to any person who is authorised to access the Central Identities Data Repository;
(g) reveals any information in contravention of sub-section (5) of section 28, or shares, uses or displays information in contravention of section 29 or assists any person in any of the aforementioned acts;
(h) destroys, deletes or alters any information stored in any removable storage media or in the Central Identities Data Repository or diminishes its value or utility or affects it injuriously by any means; or
(i) steals, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used by the Authority with an intention to cause damage, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which shall not be less than ten lakh rupees.
Explanation.—For the purposes of this section, the expressions “computer contaminant”, “computer virus” and “damage” shall have the meanings respectively assigned to them in the Explanation to section 43 of the Information Technology Act, 2000, and the expression “computer source code” shall have the meaning assigned to it in the Explanation to section 65 of the said Act.
39. Whoever, not being authorised by the Authority, uses or tampers with the data in the Central Identities Data Repository or in any removable storage medium with the intent of modifying information relating to Aadhaar number holder or discovering any information thereof, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which may extend to ten thousand rupees.
40. Whoever, being a requesting entity, uses the identity information of an individual in contravention of sub-section (3) of section 8, shall be punishable with imprisonment which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.
41. Whoever, being an enrolling agency or a requesting entity, fails to comply with the requirements of sub-section (2) of section 3 or sub-section (3) of section 8, shall be punishable with imprisonment which may extend to one year or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.
42. Whoever commits an offence under this Act or any rules or regulations made thereunder for which no specific penalty is provided elsewhere than this section, shall be punishable with imprisonment for a term which may extend to one year or with a fine which may extend to twenty-five thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees, or with both.
The only valid use of the Aadhaar number under the Act is to obtain a yes/no answer or obtain the demographic information (an e-KYC record) associated with an Aadhaar number submitted with the consent of its holder. The increasing demand for recording the Aadhaar number in various forms, documents, registers, certificates, and databases is illegal. The increasing number of leaks of Aadhaar numbers and associated peronal information indicate the widespread misunderstanding of the Aadhaar number, its use and the Aadhaar Act. You are within your rights to write to the UIDAI with your complaint. Here is a draft.
Dr AB Pandey
Chief Executive Officer (CEO),
Unique Identification Authority of India -UIDAI
3rd Floor, Tower II, Jeevan Bharati Building,
Connaught Circus,
New Delhi - 110001
Subject: Complaint of violations under The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016
We bring to your attention that the following person/organization
Insert Name and Address of violater:
are indulging in (please tick all that apply)
• Storage or retention of Aadhaar number in their registers or databases
• Linking the Aadhaar number to their databases
• Requesting for the Aadhaar number to be quoted on forms
• Displaying Aadhaar number on certificates and documents,
• Publishing Aadhaar numbers publicly
in violation of
• The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016
• Unique Identification Authority Of India (Transaction Of Business At Meetings Of The Authority) Regulations, 2016 (No. 1 Of 2016),
• Aadhaar (Enrolment And Update) Regualtions, 2016 (No. 2 Of 2016),
• Aadhaar (Authentication) Regulations, 2016 (No. 3 Of 2016),
• Aadhaar (Data Security) Regulations, 2016 (No. 4 Of 2016),
• Aadhaar (Sharing Of Information) Regulations, 2016 (No. 5 Of 2016)
They have, therefore, committed offences under Chapter VII 38, 39, 40, 41, 42 of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 and various sections of the IPC.
We require that you:
1. Immediately file an FIR for maximum penalty under relevant sections of relevant laws.
2. Provide a copy of the the FIR in 7 days, failing which explain the reasons for delay in discharge of duty and officers responsible for the delay.
3. Issue notifications and wide publicity in the electronic and print media including radio and television networks to make it clear that storage, linking, obtaining on forms, displaying on certificates and documents, and publishing of Aadhaar numbers is a crime punishable with fine and imprisonment.
We trust you will do all within Chapter VI of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 to protect our information and not cause us to seek other remedies and relief.
Sincerely yours,
Encl:
Evidence of offence
CC:
1. Shri Nripendra Mishra, Principal Secretary to Prime Minister, 152, South Block, Raisina Hill, New Delhi-110011
2. Chief Justice of India, ℅ Chief Justice's Conference Secretariat, Supreme Court of India, Tilak Marg, New Delhi-110 201
3. You can tweet it to the CEO of UIDAI @ceo_uidai and @uidai
4. You can send emails to UIDAI's DG : dg@uidai.gov.in and alok.shukla@uidai.gov.in more
Viewed by 6003
View all 20 comments Below 20 comments
[ ]( # ) [ ]( # )  [ ]( http://r.sigma-institute.website/mk/cl/f/ftfthlnMj0SlGvnCxRgSpWv4Be030pi7vQRFek9JkX0Ti2KfD1bOjmTi-MUEplFunA9Xf8gY0rO08WtFTrtHAxhB3_5T3fzx8n4gNhm_EIwn1lkAPenUql2cOMOhdyq_UPQaHfChpb1UZh2BU24UWxbBVYpL4e_pKoFv7dgx3c5_AwYLRB8vMkfZJeCAbBsgvFexCkkx-qAEwUWm-n9_s-gJDwi4HIYemTb9bzj3vUEjAJfexluykN7iNeKmRJwPItTKo1vpUFRnk9tsR2XN5o73avikmWIUnAKxZqoh-FRYWFNNx7YuSYTJbn0apnqjVutz1Sq4bLCeE5JW3OrBjMf3D96PWap4sttvXK4ipULFyMwlOw )  [ ]( # ) COMPUTER FOR ONLINE CLASSES [ ]( # ) [ ]( http://r.sigma-institute.website/mk/cl/f/7Wj4Wb0xPr0GRVzqQpGMmcmPNTn_5zTGGnmHXbKuIbhE6CUg0kyzFumUXNfCbT8iq5uUBaSaCRw6AJOkvF6WaOXUD-2KgCX0DL8-NwCVVZ7a0Vr2t9P-LO2UEkqobxxy-Dn95AS0lALr-WwpD8Rek-EjddWBB8lODMnIPSGpLSYDXeP-QqXh4mwZGfMQDdzwo-czoS1erEqxJjBSdEYWvhYDeCgm-463FyANtoEAdaFvFBqhcuCyy44gBHLHWy8ODonJRtaAPCNuOWJmtfO2-SRS-BdEY12h2bvYcDKIQcx5-mqVubuoGbPuQFbHscQoa4-rGWyRNTq_pXa0zfR3iGd8P8v_t9xhTER57JJJ5fDaFG7NIw ) [ ]( # )  For online classes we are providing a complete set of computer with UPS in following specifications: Monitor 15"; Camera & headphone CPU: 160 GB HDD, 2 GB RAM, Core 2 duo Keyboard, mouse UPS ( Electronic voltage stabilizer ) This complete set we offer pan India for Rs. 21000/- ( All inclusive ) One extra 160 GB Hard disk will be supplied free of cost within 5 years, if present becomes in sufficient. All carry "M.I.'s" 1 year warranty.    [ ]( # ) [ ]( http://r.sigma-institute.website/mk/cl/f/cd0-u2ctWejt7DUt-wFaSqHgYygAP3agrvqBIRRLk260S3Qvx526NY4UVL6KogA7Crzd5cpkbdzmxRRrLzzvZ1VwrTJjzrs8dZAVe3zv84HLr3cSd--rd06gqMs4vA1uit8m152o5WAqhix6-yNsS4vrG0dz1LV1i2-JTXP__szGePYYDxGw-8OBvm1ujbP4_I44_aarETcj9O1lwo55XBWnfjgvRtjE2_sd7_Vgpbh0ZlLFC7M_s4NW6sm1MM3McwlGe-IF-ZV980bXllksUxSnx9UmVU5ja_bYfy6eNvHByxzjE5lsT_3ToUOcOhVJE6w14np863-LD3VRQkP_Sr2TFcl9NkCRJGez_eChlVbc95OcUw ) We understand the hardships...  Hardships of the parents, hardships of teachers, hardships of every such individual who is now compelled to work from home; be it student or the the professional now computer set is must. we decided to help all such people by providing the complete set including UPS to save your machine for longer life. In comparison to laptops desktop is robust & long lasting and also cheap & best ! For getting this deal, please click the button below:  [ Button ]( http://r.sigma-institute.website/mk/cl/f/Aj3tTSnj8h6sFNWhfXs6Dywj2pV_b5exufjj0b1Of6vBvVvgqnR0pbPt6R_ZkhTnCyYgFL9eO5H1ngE491eZ1qUzHnv68qqEPCqgbyztQV_ugsHOEVWOycQOZ5jXcEbZFqYhPiCp8R7DwbUzcloxe_cJqm1rvS2KLLytJSZDNpwG4izmgADe6wa0x-05InJEpw4pwD1vbBchkKsuURxL7ZYe0WMbhtiUXLdsco1POo7MzXbsIhutitUgcAY6BiyWkDsYnp14VPLbJha7MqZ7zpe-UPtDClyZM20SFCDuybRNrZl-aYNqaiikookKh2WVAHf8GcMe0kuMZCBaNQuS0-Gl3s5Pi-quB7d_jUhwDeoqvcZyYA ) [ ]( # ) [ ]( # )  SIGMA INSTITUTE Delhi Cell: 9899075161 [ ]( http://r.sigma-institute.website/mk/cl/f/QT10bXS30DDN-T_BzPWfIpOXqMZHo7GkIJqsGwbhc55qVVipqtkK9Q3uiLmbqwDLZyX5W5VweBMfJZNGLc30G3szfzTPWPsj-Auch0pAkE6DHVrmUHWNmW5IPV7axbp0G7D60vQ_kLz7_75zd6lAF2HoN0IUSUeGJzFI8uJ02hiDxaMiKokWo3WYc0e-kNI9kg08qFrW0t2orATOVLdG06OueoSZ8Si2pMN4AdhSyeJlKBPwJm_zEw-VF0uAVmkzCRkJLKJvND2gefF3CgQLiideKVhG4CCrmEvbEDnV27oZyIM872HIQM7lfmJegNIvzQQnRh2fsmDruDS3NeOtx_YLP7grCw ) [ ]( http://r.sigma-institute.website/mk/cl/f/21B2uUq1eSVOwRUV56q-Eny1z4vm-6YRzZLlV_R28R7V9YS_rtZPGdg8dso8NhA1eRr-07afhg9PWu1grjpLNmzrV4pEo8C6WPgEWWBS0oZs8NOH80FOMHxeWIqXWgVw6D6p62MBEo1tv-ZAWNme6Ky-gv4QOoPBDBQvW0xi4EQD5ugltER6BEz3TIXxb3v6FeNL_ayqcrcHb0W4IpGGWN40tzKb8ofCoQiqxqXSe3U509hDLo407oMzwKsy8j23_MDsMTATrVOrLItavQ1wFK5KrdUYXcvSQ1shOSpMA_HI0PSRzhlSNFk9vQ5i_gDLm3bIryLpNvcANHbLan8aFih4kw ) [ ]( http://r.sigma-institute.website/mk/cl/f/PdVek9_ZRG9RgES55lD-Mze455jh3E79hmy0cV_nFzdOqKbQCFuQmMW0PmC-HahEbuofUtUKrMPNjEoL5DuMa7rmpYC0jHyk1unmCuBcz0en79wU-UkFtkA6DYpa23jiw44jT0Oy_M2ux26q9-FAqf7uQxQUeO7TZHGSWllLC-6s2qJU_ebHLHd0pklH2vbJxPE9xOFiuIQUbXOer1yUSF2ocXcK5aCTeK67MZ9wAjPQht0cwraNArs0cjfEnUJhOrJz1O4BiPH3lytqCc-5_BAU8-XInVW3lGZwcccxaIaA7kWgmKxJ5fjrK9C9K1GRvbBvQntoS4wySLRnnBPUvNM ) [ ]( http://r.sigma-institute.website/mk/cl/f/ufDMFVs5VAeTj32NeZQeVVIg-SP2VUP53SiI_yLl6qmp-uiot5OXTbVgKH_dWbdfue_4F79_hNVRkrAKbWJBAbPBYbvyD_5SCx_r0QSqHib_XrnLe8n99UyE5NNpWZpOwXXRDzznKClN6Lass6nS2ML7pkdUYv38CHF8Nsqj6iCpC8ZByRP8TXNq_FB2Z-u-UEqfSkc4XmOtvePXY-WYX_4XkDfTW6Idk-me1IniqwmucvdeAMUfY7zn-4q-QcgMueqHArpsFw9ZAI_vN0IpP_U3Q4Zp9JjmD9ryJkypLvCP1KpSsbOC7UshJ0Onil76ZAJuw-sKOkoZ-fll_DZ7yB_r_-uM3i3LrLPdzPg ) [ ]( http://r.sigma-institute.website/mk/cl/f/QVOEsm5KWZHc_owf7-0fM3HtSklQ2I075gYsLs6gXI9Fp4TfyQmx_0oVfOiQbeNt5FYTt8ofT0xrv9bX3fh0nt4fbtRfy0ns5qIHjDINkIBW32DW2r9jepTCVvUczlWCCNY2B1TvBvyKJVqGsE4cFCzQOkdIPX2a2H1NYgJxon81ikX94TiSpGoeqr_yaMt1AmHd1p1QLQlwtZ2HQE1ZLrlpa5eSgQlsl3AYQk3zTak5TCKvhqjrNx8HfQmPVpCiqroDuTOInHpi4MK50xdOY0suMVBJ9h4FEC21fe1Oyr3v9qEbx-zlkGoQhMJ7FcUMuc_T5bGW3fmL39pAXoBiEUznkdjFCA ) [ ]( http://r.sigma-institute.website/mk/cl/f/c4wJVTvtsW8gp-MENLlf-2z6v6Jcp-OTYkTdzEU4c3WkFkw4UyHSESNjkgs3ceRru2Fg_0pVh2N3ZVEfyLwTbp-Gh5ld7noijgvwcuimuNVUEZm_8xm9Vaz7bAa511_DYxrLS_36FL5vTr6bItSrgrpieNgbi94UoIrIK2QaOp6nZoFBlOn9tO1WD6rex2OkASQ9DQjxBdZCFEgLFLVvEj7PB3yYQBPq8aIAw9l4stnz_UZ_mOTVDSup4cRmUpSni_VgmlntChXVR4z8oB4GOIoD_7KmVSXlvKReuunEPhV6Yqil8xPNl5wccV2heX6GNwjBTmERNrVFyWGR73jF7yoPkFdT0JkOR6k_OAcym0GGq9Vsprw9RMIQFgPkjC95_MInU5h1BF5uWStEX9w ) [ ]( http://r.sigma-institute.website/mk/cl/f/EyeM8-emq-dO0o4a4zko8FbQcKz4q-Xn4gVgRiJcSQ0JJ3BSQkdYoEg27MTRECRpanMpDJ9Sm9FdkZxVeu8pvRBChToJfEVXOQ1nleTq4V-6DecW0hMHCBQKVYkwZ4614QW0hBRkyxoFwnZo_81YL8D6k5ctrOY1HBVYdVQZG2ibsSN8IkL4dxwcc3jhLkb6pxT6MrWKqNVHf9In1U0HH1Rusli4xwL_d_WxlWKcBpYxG7dM1y1jE_6TImNPsBWHcTHfBReHkJh_QM-TXM1uSeT4uK1bmzEbjVl7GL-mlhz-l0YUzOeLt3KR1VXV_3B-dAWzn7EPaR_xIyWgtDAonaiAevTn5teKDGv3q-1N ) [ ]( http://r.sigma-institute.website/mk/cl/f/NhdA_SYyeH2nDFYyoJfa8i9SF-70CrzJQy9ukMqLzWAez7HoRTU-MqZNCOZomkUyA4jKjaVctljGOwD4CmHckjfx9TvSeLefW4GrBx5QmjQObNq4fvMIZHxkKdnK-mVz-OhM8iFVNS_Pkkxus-0b4GXEoY0CM5nYJORzK4V4QS2qiHSs7AXnNBxzIaG7Rnto5TQhfQGsSf5SR5mJ99xdZA1tPAh5tDysywjs27dQW6H7G3tvvFwdixoGATLmKmMv1dUn9zt1PDGXeQE0tEx-dsIxiZj8LSmhGi1RMOr8mVNALrQ7O1KMVBBiLEU0rabBo2Y2gD49j0R7HmJL0lZ9WU26KDUTqSfR0cP6 )  [ ]( # )  You received this email because you are registered with Sigma Institute  [ Unsubscribe here ]( http://r.sigma-institute.website/mk/un/5QSCyAxwEmkLdtIkDdzIOXfo0Vn1W7Nq08BGAgCB5zVY0SDYPCU5H50sDTNQAx0jaL3KFjfXrbfBwuzYsHUmH4OEfNc3QQMjDMGrr6OJzyPvgABekumJo65MfscJj6_X73dROXf8fHscUTpvkl5JKfGAmwwPLU9JWmG97UJDys7LIfustKvXLpk2qfAOLSFtRBKeXHY7n8GeLmnZ_fQ4USxMzl8 )  [ ]( # )  © 2020 Sigma Institute  more
Oct 31
In its present form the AAdhar system is useless and waste of money. The card should be issued with a chip and picture. It should be possible to authenticate the person holding the card by checking the biometrics online from a central data base. more
May 03
Rules and Regulations in India are "perfect and complete" on paper. Sad part is that the "worker" who handles Aadhaar has not been trained "equally completely" on how to interpret and use these Rules. One finds this situation in several other fields, like e.g. sales. That is the button which needs to be pressed. TRAIN THE STAFF UNTIL PERFECT. more
May 03
Good to see the detailed information about Aadhaar. I had recent experience when I found that I need to link my mobile number and email ID that was not captured at the time of making it. In order to do this I had to visit an agency authorised as Customer Centre. The centre wanted me to pay for its services a fee of Rs.300 instead of prescribed fee of Rs.25 and I could feel that how the corrupt practices are being managed even for such work that is primary responsibility of Government. more
May 03
Great write up: But as difficult as Aadhaar itself to understand! I was asked to submit a copy of my Aadhaar by canara bank, padmanabha nagar, adyar, Chennai but till date it is not updated. More than 20 days over And when I ask a question, they get angry and start searching for my document for hours! If they locate it, out of MY LUCK, then next day when I visit, the same story continues! And out of N number of complaints lodged with Aadhaar central depart, an usual mail comes asking for the same details again and again, even after I have provided it! Do they read any mails, or simply reply to all mails the same reply by "cut and paste methods"? Is that depart runs under the ministry supervision or a third party, OR A THIRD COUNTRY? more
May 03
