Case Summary and Outcome

A five-judge bench of the Supreme Court of India upheld the constitutional validity of the Targeted Delivery of Financial and Other Subsidies, Benefits, and Services Act, 2016 (“Aadhaar Act”) while striking down certain provisions of the Act. Aadhaar, a 12-digit identification number issued by the Unique Identification Authority of India (“UIDAI”) to the residents of India, enables a more efficient process of delivering several welfare schemes to the residents of India. The scheme was challenged primarily on the grounds of invasion of the fundamental rights under Article 14, 19 and 21 of the Indian Constitution. The Court held that use of Aadhaar for the purpose of welfare schemes was constitutional as the Aadhaar Act withstood the constitutional tests of legitimate state aim, necessity and proportionality. It also held that since the aim of the Act was to create a unique identification so that deserving beneficiaries were able to access subsidies or services (the expenditure of which is drawn from the Consolidated Fund of India), the Aadhaar Act was validly passed as a Money Bill. The Court also upheld the mandatory linking of Aadhaar with PAN cards, while declaring mandatory linking of Aadhaar to bank accounts as unconstitutional and disproportionate. Most importantly, the Court held that that the private companies could not require citizens to provide their Aadhaar numbers for the provision of services.

---

Facts

In 2012, Justice KS Puttaswamy filed a writ petition challenging the constitutional validity of the Aadhaar project, which aimed to build a database of personal identity and biometric information of every Indian. Aadhaar is a 12-digit identification number issued by the Unique Identification Authority of India (“UIDAI”) to the residents of India and is linked with several welfare schemes, enabling a more efficient process of delivering services and avoiding false beneficiaries (“Aadhaar scheme”). The scheme aimed to build a database of personal identity and biometric information of every Indian and had enrolled more than 1.1 billion people in India by 2018.

Conceptualized in 2006 for a preliminary project to identify families below poverty line, the Aadhaar scheme went through multiple iterations before being launched nationwide by way of an administrative action in the year 2009. On March 25, 2016, the Aadhaar scheme received legal sanction with the enactment of the Targeted Delivery of Financial and Other Subsidies, Benefits, and Services Act, 2016 (“Aadhaar Act”). Under the Act, UIDAI was established as a statutory body to develop the policy, procedure and systems for issuing Aadhaar numbers to individuals and also to perform authentication in accordance with the provisions of the Act. All residents of India were required to submit demographic (name, date of birth and address) and biometric information (photograph, fingerprint and iris scan) at the time of enrollment to an enrollment agency (“enrollment process”). Notably, the enrollment agency is a private entity. The data is stored in Central Identities Data Repository (“CIDR”) which are centralized databases containing all Aadhaar numbers, demographic details and biographic information of such individuals.

While the scheme is intended to assist in receipt of subsidies, benefits and services upon furnishing proof of possession of an Aadhaar number, an added requirement for individuals claiming such a benefit is to undergo authentication each time, by submitting not only an Aadhaar number but also providing biometric information to the agency. On receiving the information, the agency (referred to under the Act as “Requesting Entity”) is required to send the request to UIDAI, which subsequently performs the act of confirming the identity of the person (“authentication process”). Upon successful completion of the process, the individual is entitled to receive the benefit.

Given the command and sweep of the Act to impact privacy of the residents, the scheme attracted serious public scrutiny, eventually leading to a number of cases filed against it. The first of these cases was filed in 2012 by Justice KS Puttaswamy (a retired High Court Judge of the Indian state of Karnataka) and Pravesh Khanna (an advocate), who filed a writ petition challenging the constitutional validity of the Aadhaar project primarily on the ground of infringement of the right to privacy under Part III of the Constitution of India.

In response to the government’s proposal to make the Aadhaar scheme mandatory for access to government services and benefits, several other petitions were filed as well, challenging distinct aspects of the scheme. The challenge was initially made before a three-judge bench of the Supreme Court. In its order dated August 11, 2015, the bench noted that the norms for and compilation of demographic biometric data by government was questioned primarily on the ground that it violates the right to privacy. However, the Attorney General argued on behalf of the Union of India that the Indian Constitution does not grant specific protection for the right to privacy. He based this on observations made in the case of M.P. Sharma v. Satish Chandra (an eight-judge bench) and Kharak Singh v. Uttar Pradesh (a five-judge bench). However, the petitioners contested that both of these judgments were founded on principles laid down in 1950 in A.K. Gopalan v State of Madras (“Gopalan”), which was overruled by an eleven judge bench in Rustom Cavasji Cooper v Union of India (“Cooper”) in 1970. In Cooper, the bench found that fundamental rights were not to be construed as distinct, unrelated rights, thereby upholding the dissenting view in Kharak Singh. This also formed the basis of later decisions by smaller benches of the Supreme Court which expressly recognized the right to privacy.

Faced with a predicament and given the importance of the question, a reference to a larger bench was deemed fit to decide on whether there existed a “constitutionally protected fundamental right” to privacy. It was in this context that a five-judge Bench was set up by an order dated August 11, 2015. On July 18, 2017, a Constitution Bench considered it appropriate that the issue be resolved by a larger bench of nine judges to decide whether the position recorded by the Supreme Court in M.P Sharma and Kharak Singh (i.e. that there is no fundamental right to privacy under Indian Constitution) was the correct constitutional position. The nine judge bench in Puttaswamy v. Union of India (“Puttaswamy I”) gave a unanimous answer and determined that right to privacy is a part of fundamental rights which can be traced to Articles 14, 19 and 21 of the Constitution of India. Following the judgment in Puttaswamy I, the Supreme Court posted the matter for final hearing before the five judge bench in this case.

---

Decision Overview

The five-judge bench of the Supreme Court of India delivered the judgment. The principle issue before the Court was to evaluate whether the provisions of the Aadhaar Act violated fundamental right to privacy under Article 14, 19 and 21 of the Constitution of India.

Under the Constitution of India, Article 14 guarantees right to equality, Article 19 guarantees the right to freedom of speech, expression, and assembly, and Article 21 guarantees all persons right to life and personal liberty. The judgment in Puttaswamy I guaranteed the right to privacy as an intrinsic part of the right to life and personal liberty under Article 21 of the Indian Constitution. Under the Aadhaar Act, 2016, chapter II deals with enrollment, requiring every resident to obtain the Aadhaar number by submitting his demographic information and biometric information (section 3). Chapter III deals with “authentication,” wherein section 7 mandates that proof of an Aadhaar number would be necessary for receipt of certain subsidies, benefits and services etc. Other crucial sections of the Act include chapter IV dealing with establishment of UIDAI, chapter VI delineating security of information and authentication records of individuals and restriction on sharing of biometric information. Notably, the information collected and stored is treated as an “electronic record” and “sensitive personal data or information” by virtue of Section 30 of the Act. Section 33 of the Act also puts an embargo upon the UIDAI to collect, keep or maintain any information about the “purpose of authentication” except (a) in circumstances where an order of a court not inferior to that of a District Judge to disclose such information has been made (subsection 1) and (b) where it becomes necessary to disclose the information in the interest of national security (subsection 2). Section 57 of the Act provides that the Aadhaar Act would not prevent the use of an Aadhaar number for establishing the identity of an individual for any purpose.

Various regulations were also framed under the Act, including (a) Aadhaar (Enrollment and Update) Regulations, 2016 to collect demographic information from all individuals; (b) Aadhaar (Authentication) Regulations, 2016 to provide for authentication facilities and capture, store and maintain biometric information; (c) The Aadhaar (Data Security) Regulations, 2016 to ensure information security; and (d) The Aadhaar (Sharing of Information) Regulations, 2016 to regulate sharing of demographic information collected by UIDAI.

By virtue of a unanimous majority in Puttaswamy I, the Supreme Court of India had declared right to privacy as a fundamental right. Based on this premise, it was argued by the petitioners before the Court that the Aadhaar scheme is intrusive and “forced” a person intending to enroll to divulge their core biometric information and provide it to a private entity tasked with collection of such data. This presented a serious risk of misuse of vital private information, particularly during the authentication process when an individual not only divulged their biometric information to a Requesting Entity but also disclosed the purpose and nature of the transaction supposed to be undertaken by the person at that time to that entity. Given the information about the individual and their transactions were connected to a central database, this posed a risk of state surveillance by enabling the State to profile citizens, track their movements, assess their habits and influence their behaviour. Besides, there was no assurance of data protection at any level. The scheme had the propensity to cause “civil death” of an individual by switching off their Aadhaar. Considered this way, the scheme upset the balance and skewed the relationship between the citizen and the State, enabling the State to totally dominate the individual.

Broadly speaking, the challenges were made on the following grounds:

Surveillance: that the project created an architecture for pervasive mass surveillance, enabling the State to track down the location of the person seeking authentication and allowing it to build complete profiles of individuals through the convergence of data [relying on Kharak Singh v State of UP  (1964) 1 SCR 332, U.S. v. Jones 132 S.Ct. 945 (2012) (US), Zakharov v. Russia (2015) Application No. 47143/2006 (ECtHR), Digital Rights Ireland Ltd. v. Minister for Communication, Marine and Natural Resources [2014] All ER (D) 66 (Apr) and S and Marper v. United Kingdom (2008) ECHR 1581].

Breach of Right to Privacy under Article 19: that the project violated fundamental right to privacy with respect to the personal demographic and biometric information collected, stored and shared; breached individual autonomy and dignity; and violated the right to informational privacy by requiring individuals to undergo compulsory authentication through Aadhaar platform without an option to use an alternate mode of identification. Specifically, the petitioners also claimed that the Act enabled data collection indiscriminately regarding all aspects of a person (biometrics, demographic details, authentication records, meta-data related to transaction) even though such data has no nexus to the purported object of subsidies, thus violating the principle of data minimization.

Violation of Limited Government Authority principle: that the project disrupted the principle of sovereignty of the people with limited Government authority which is the fundamental feature of the Constitution, by allowing a totalitarian state. By making Aadhaar compulsory for varied public services, the scheme had a chilling effect on the autonomy of the people.

Colourable Legislation: the petitioners claimed that the Act did not follow the constitutional procedure and was disguised as a “Money Bill” (a bill that is concerned only with national taxation, public money or loans), rendering the Act void by virtue of being colourable legislation. Besides, the objective of the project as an “identification exercise” was illegal and ultra vires.

Violation of Article 14 and Article 21: that the procedure adopted by the respondents to enact the Aadhaar Act violated the right to equality under Article 14 and right to life and personal liberty under Article 21 since (a) there was no informed consent at the time of enrollment and the model was intrusive, excessive and disproportionate, (b) data collected and uploaded in to the CIDR was not verified by any Government official designated by the UIDAI, (c) the procedure enabled the enrolling agency as well as the Requesting Entity to capture, store and misuse/use the biometric as well as demographic information without the UIDAI having any control over such use and (d) the architecture of Aadhaar, by its very nature, being probabilistic resulted in exclusion of genuine cases. The Act also violates the right to protection from self-incrimination [declared as a component of personal liberty in Selvi & Ors. v. State of Karnataka (2010) 7 SCC 263].

In response to the claim, the respondents primarily argued on three grounds. First, only minimal biometric data is stored in CIDR and there is no collection of “other” data in respect of an individual’s religion caste, tribe, language records of entitlement, income or medical history. Second, since the biometric information in the enrollment ecosystem is transmitted in an encrypted form, both the enrollment and authentication process were foolproof, with UIDAI merely matching the biometrics and not storing or receiving any other information with respect to the location, purpose or nature of the transaction. Finally, the information is collected in silos and remains archived offline, with the data sent to automatic biometric identification systems (“ABIS”) at enrollment centres completely anonymised to ensure security and privacy of data.

The majority judgment was delivered by Sikri J., with whom Chief Justice of India Misra J. and Khanwilkar J. concurred. Ashok Bhushan J. delivered a separate but concurring opinion. Chandrachud J. delivered the dissenting opinion. These opinions are summarized below:

Majority opinion by Sikri J., Chief Justice of India Misra J. and Khanwilkar J. concurring:

The majority opinion began by analysing the jurisprudence on various facets of privacy, affirming three aspects of the fundamental right to privacy: (i) intrusion with an individual’s physical body; (ii) informational privacy; and (iii) privacy of choice. Subsequently, the Court sought to categorize various approaches in formulating privacy, classifying privacy on the basis of harm (i.e. privacy being a family resemblance concept), interests (i.e. privacy of repose, privacy of sanctuary and privacy of intimate decision) and as aggregation of rights (i.e. not limited to one fundamental right but associated with several others) [p. 168]. The Court then went on to ask: what is the scope of the right to privacy and in what circumstances such a right can be limited?

Declaring that any action of the State has to be tested on the touchstone of Article 14, 19 and 21 of the Indian Constitution, the Court noted that a restriction on any right must also satisfy the test of judicial review under (a) the grounds specified under Article 19(2) of the Constitution (primarily in the interest of sovereignty and security of the State, public order, decency, morality etc.) and (b) the restriction should be reasonable. On the latter, the Court sought to apply various standards, including application of the test of legitimate aim and the doctrine of proportionality. Notably, the Court also analysed if it should apply “strict scrutiny” standard or the “just, fair and reasonableness” standard to determine the legality of the Act. These aspects are analysed in detail below:

Doctrine of Proportionality:

Under the principle of proportionality, an action of the State allegedly violating the right to privacy is required to be tested on three parameters: (a) the action must be sanctioned by law; (b) the proposed action must be necessary in a democratic society for a legitimate aim; and (c) the extent of such interference must be proportionate to the need for such interference. Subsequent to an exposition of the understanding of proportionality in various jurisdictions, the Court settled that four sub components of proportionality need to be satisfied, these include:

(a) a measure restricting a right must have a legitimate goal (legitimate goal stage);

(b) it must be a suitable means of furthering this goal (suitability or rationale connection stage);

(c) there must not be any less restrictive but equally effective alternative (necessity stage); and

(d) the measure must not have a disproportionate impact on the right holder (balancing stage). [p. 125]

In determining the application of the proportionality principle with respect to the necessity stage (component ‘c’), the Court, relying on the judgment in Puttaswamy I, adopted David Bilchitz’s analysis to declare that the following can be adopted to preserve a meaningful but not unduly strict role for the necessity stage. First, a range of possible alternatives to the measure employed by the Government must be identified. Second, the effectiveness of these measures must be determined individually; the test here is not whether each respective measure realises the governmental objective to the same extent, but rather whether it realises it in a “real and substantial manner.” Third, the impact of the respective measures on the right at stake must be determined. Finally, an overall judgment must be made as to whether in light of the findings of the previous steps, there exists an alternative which is preferable. In doing so, the Court also emphasized the importance of having a legitimate goal that is of sufficient importance to warrant overriding a constitutionally protected right.

In applying the test of proportionality – the Court held that (a) since Aadhaar Act serves a legitimate State aim (legitimate goal stage), restriction on the right to privacy is justified, (b) since there is no alternative “less restrictive” measure which can achieve the same purpose, the Aadhaar Act also passed the muster of necessity (necessity stage), (c) there was a rational nexus between the provisions of the Act and the goals which it sought to attain (rationale connection stage), and (d) the Aadhaar Act struck a fair balance between competing fundamental rights (i.e.) (balancing stage).

Insofar as balancing was concerned, the majority examined the matter at two levels: (i) whether, “legitimate state interest” ensured “reasonable tailoring”; and (ii) whether balancing of two competing fundamental rights, right to privacy on the one hand and right to food, shelter and employment on the other hand was done. On the first, it declared that there is a minimal intrusion into the privacy and the law is narrowly framed to achieve the objective. On the second, the Court analysed the relationship between the right of privacy of the individual with right to life of the same individual as a beneficiary, though the Court’s arguments are unclear on this front as it shifted between clash of the two individual rights above and rights between the individual and “in the larger public interest” often. The Court found that as the information collected at the time of enrollment as well as authentication is minimal, balancing at the first level was met. At the second level, namely, when balancing of two competing fundamental rights is concerned [ie. dignity in the form of autonomy (informational privacy) and dignity in the form of assuring better living standards of the same individual], the Court held that enrollment in Aadhaar of the unprivileged and marginalised section of the society enabled such individuals to avail the fruits of welfare schemes of the Government, and thus, the scheme ensured dignity to such individuals.

State Surveillance:

On the issue whether the Aadhaar Project created or had tendency to create surveillance state, the Court sought to answer two questions: (a) whether the architecture of the Aadhaar project enables the Sate to create a regime of surveillance; and (b) whether there were adequate provisions for data protection to safeguard against it [p. 235]. On question (a), the Court responded in negative, noting that the enrollment and authentication process was strongly regulated to an extent it was secure and thus rendered it very difficult to create a profile of a person simply on the basis of biometric and demographic information stored in CIDR. The Court also recapitulated the security mechanisms to note that there were adequate safeguards embedded into the design of the scheme [p. 153].

On question (b), after examining the jurisprudence in US, EU and India on the issue – the Court arrived on a similar response as answer to question (a), holding that the Aadhaar programme was largely compatible with principles of data protection. Specifically on the argument of data minimisation, the Court concluded that the principle of data minimisation was followed since section 2(k) of the Aadhaar Act prohibited collection of sensitive information such as race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Besides, section 32(3) of the Act r/w Regulation 26 of Authentication Regulations also prohibited UIDAI from collecting, storing or maintaining, either directly or indirectly any information about the purpose of authentication.

Notably, the majority also found that in specific instances, the provisions of the Act were not compatible with principles of data protection. This included:

(a) Regulation 26 and 27 of the Aadhaar (Authentication) Regulations, 2016 (mandating storing of metadata for a period of seven years): the Court agreed with the petitioners that the data was allowed to be retained for an unreasonably long period of time. There was also no purpose limitation as it was possible that the identity information collected for one purpose under the Act can be used for any other (new) purpose. In the interest of the right of the citizen to erasure of data and the right to be forgotten, the Court therefore read down to retain only “process metadata” (i.e. limited to the time of authentication, the requesting entity, and the yes/no answer to authentication requests) for a limited period of six months.

(b) Section 33 of the Aadhaar Act, 2016 (allowing disclosure of information, including identity and authentication records, if ordered by a court, as well as disclosure in the interest of national security): section 33(1) of the Act was read down as well, by clarifying that an individual, whose information is sought to be released, shall be afforded an opportunity of hearing. The Court struck down section 33(2), which allows for sharing of information on national security grounds, as unconstitutional.

(c) Section 57 of the Aadhaar Act, 2016 (allowing private parties to mandate Aadhaar): under section 57 of the Act, the State, a body corporate or any person were entitled to avail authentication facility and access information under CIDR. The Court held that this defeated the principle of informed consent at the time of enrollment and thus, held it as unconstitutional.

Right to Privacy under Indian Constitution:

On the question whether the Aadhaar Act violated the right to privacy, it was argued by the petitioners that there was no compelling state interest to know details of the location and time during the process of authentication. Further, while the Act was framed as a voluntary entitlement to establish identity, actions of the executive and private entities (in requiring Aadhaar as a condition precedent for availing services, subsidies and benefits) had made possession of Aadhaar de facto mandatory – this form of exclusion for marginalized sections was violative of the fundamental right to equality under Article 14 and 21 of the Constitution. The invasion of privacy was also not justified under the principle of proportionality.

Respondents argued, on the other hand, that was no reasonable expectation of privacy with respect to identity information collected under the Aadhaar Act for the purposes of authentication and therefore Article 21 was not attracted [p. 318]. Based on the above, the least intrusive and strict scrutiny tests of proportionality were not applicable. The respondents also argued that the legitimate state interest that the Aadhaar Act fulfills are prevention of leakages and dissipation of subsidies and social welfare benefits that are covered under Section 7 of the Aadhaar Act, and on this basis, it satisfied the proportionality test.

The Court observed, relying on Puttuswamy I, that Article 21 protects only those matters over which there is a reasonable expectation of privacy. The majority tested this on two prongs: first, the individual or individuals claiming a right to privacy must establish that their claim involves a concern about some harm likely to be inflicted upon them on account of the alleged act; second, the concern should not be unreasonable [p. 330]. It also held that the triple test laid down in order to adjudge the reasonableness of the invasion to privacy was made, as  (a) the Aadhaar scheme was backed by the statute, i.e. the Aadhaar Act, (b) it served legitimate State aim as one of ensuring targeted delivery of subsidies to beneficiaries, through accurate identification and (c) it was proportionate.

Notably, in considering human dignity as a facet of privacy, the Court remarked:

“It is the balancing of two facets of dignity of the same individual. Whereas, on the one hand, right of personal autonomy is a part of dignity (and right to privacy), another part of dignity of the same individual is to lead a dignified life as well (which is again a facet of Article 21 of the Constitution). Therefore, in a scenario where the State is coming out with welfare schemes, which strive at giving dignified life in harmony with human dignity and in the process some aspect of autonomy is sacrificed, the balancing of the two becomes an important task which is to be achieved by the Court. For, there cannot be undue intrusion into the autonomy on the pretext of conferment of economic benefits.” [p. 540]

It is important to note that the majority identified the whole architecture of the scheme to be “unique” and eliminating any chance of duplication. It held that “once the biometric information is stored and on that basis Aadhaar card is issued, it remains in the system with the Authority. Wherever there would be a second attempt for enrolling for Aadhaar and for this purpose same person gives his biometric information, it would immediately get matched with the same biometric information already in the system and the second request would stand rejected.” [p. 529]

Money Bill and colourable legislation:

It is worthwhile to recall from earlier that Aadhaar Act was passed as a “money bill” rendering it vulnerable to legal validity on account of the doctrine of colourable legislation. Under Article 110(3) of the Constitution of India, the decision of the Speaker of the Lok Sabha is considered final in cases where a dispute arises over whether a bill is a money bill or not. Relying on this provision, the respondents had argued that the decision of the Speaker was not subject to judicial review. Furthermore, given that the expenditure for “targeted delivery of subsidies, benefits and services” is incurred from the Consolidated Fund of India, the legislative intent and the object of the Act was valid as the “heart and soul of the Act” under section 7 concerned identifying and reaching the beneficiaries for such subsidies, benefits and services. The petitioners’ argued instead that certain provisions of the Act did not fall within the ambit of Article 110 and given the absence of a severability clause, the entire Act was bound to be declared void. With regard to the justiciability of the speaker, the petitioners’ also claimed that the Court was empowered to decide as to whether decision of the Speaker was constitutionally correct.

On this issue,  the majority first considered whether the bill met the requirements of Article 110(1). It held that section 7 was the core provision of the Aadhaar Act, and since Aadhaar-based authentication mandated by section 7 of the Act for the receipt of a subsidy, benefit or service and since such subsidies, benefits and services accrued out of the Consolidated Fund of India, the provision satisfied the conditions of Article 110 of the Constitution [p. 483-484]. Furthermore, other provisions of the Act [i.e. sections 23(2)(h), 54(2)(m) and 57 of the Aadhaar Act] enabled the Authority to specify the manner of use of Aadhaar with specific purpose in mind, namely, for providing or availing of various subsidies, benefits and services. Consequently, the Court deemed fit for the Aadhaar Bill to be introduced as a Money Bill. It did not deal with other contentions of the petitioners after deciding on the preliminary issue, namely, whether certification by the Speaker about the Bill being Money Bill is subject to judicial review or not and whether a provision which does not relate to Money Bill is severable or not.

Exclusion, Limited Governance and other ancillary issues:

On the aspect of exclusion specifically, the Court also noted the petitioner’s argument that the authentication process was probabilistic in nature – often leading to failure of authentication in genuine cases. However, it rejected this line of reasoning, holding instead that section 7 of the Act was an enabling provision, and in cases of failure, such an individual would be permitted to establish their identity by alternate means. The Court also took on record the statement of the Attorney General of India that no deserving person would be denied the benefit of a scheme on the failure of authentication.

On this issue of limited governance, the petitioners’ had claimed that the Aadhaar project is destructive of limited government, constitutionalism and constitutional trust. These submissions were premised on the architecture of the Aadhaar being constitutionally intrusive which threatened the autonomy of individuals and had a tendency of creating a surveillance state. However, the Court viewed these claims as sweeping – combined with reading down of contentious provisions of the Act, it felt that the statutory regime would overall govern the citizenry and rejected the arguments on that basis.

The Court also warned – in response to petitioners’ argument that the expression “benefits” was open-ended and allowed respondents to bring within its sweep any and every kind of governmental activity in the name of welfare of communities – that “benefits” should be such which are in the nature of welfare schemes for which resources are to be drawn from the Consolidated Fund of India.

Remarkably, the majority also analysed the impact of the scheme on children and held that while it would be essential for children to have consent of their parent/guardian to enroll in the scheme, on attaining the age of majority, such children who are enrolled under Aadhaar with the consent of their parents shall be given the right to exit from Aadhaar [p. 401]. Insofar as the school admission of children is concerned, requirement of Aadhaar would not be compulsory as it is neither a service nor subsidy.

Besides, the majority judgment also analysed constitutionality of various specific provisions of the Aadhaar Act, holding majority of those provisions to be valid [p. 402-442]. As indicated before, it however struck down section 57 insofar as it allows private parties to make Aadhaar mandatory on residents.

With respect to other laws, notably section 139AA of the Income Tax Act 1961 (which requires linking Aadhaar number with other forms of identity such as Personal Account Number (PAN)), the Court held that the law passed the applicable tests, namely existence of law, legitimate state interests and proportionality. With respect to Rule 9 of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (linking Aadhaar number with bank account) however, the Court held that the provision did not meet the test of proportionality and, therefore, violated the right to privacy of a person which extends to banking details. The majority also deemed unconstitutional circular passed dated March 23, 2017 mandating linking of mobile number with Aadhaar.

Dissenting opinion by Chandrachud, J.:

Justice Chandrachud disagreed with the foundational assumption of the majority on the uniqueness of the Aadhaar scheme, declaring that the uniqueness of the biometric data was relative and remained an assumption “without watertight proof” [p. 779]. He noted that there were significant privacy concerns with the Act, notably:

(a) absence of consent during enrollment and authentication, since prior to the enactment of the Aadhaar Act, no mandatory obligation was imposed upon the Registrars or the enrolling agencies to (i) obtain informed consent from residents before recording their biometric data, (ii) inform them how the biometric data would be stored and used and (iii) about the existence of adequate safeguards to secure the data,

(b) expansive extent of information disclosed during authentication & sharing of core biometric information,

(c) regarding expansive scope of biometric information and

(d) questionable efficacy of the biometric model (including identity theft).

Specifically, Justice Chandrachud accorded high regard to self-determination as an essential facet of Article 21 as well as emphasized the incoherence between the biometrics model deployed by Aadhaar and the right to anonymity of the citizens. On the latter, given that anonymity was central to a person’s sense of freedom and autonomy, widespread use of biometrics undermined the right to remain anonymous. Taken together, Justice Chandrachud held that Aadhaar framework violated essential norms pertaining to informational privacy, self-determination and data protection.

With respect to proportionality, while accepting the majority ruling that section 7 of the Aadhaar Act fulfilled legitimate state purpose, Justice Chandrachud disagreed that the scheme withstood the test of proportionality. Given the lack of accountability, absence of adequate exception handling purposes, absence of clear rules and open ended nature of section 7 (as apparent from the definition of “benefit” in Section 2(f) and of “service” in Section 2(w)), the scheme was considered to be excessively disproportionate. The minority opinion observed that the Aadhaar Act and regulations therein were bereft of the procedure through which an individual can access information related to his or her authentication record. The architecture of Aadhaar ought to have, but has failed to embody within the law the establishment of an independent monitoring authority. It is also important to note para 255 of the judgment where he mentions:

There is no antinomy between the right to privacy and the legitimate goals of the State. An invasion of privacy has to be proportional to and carefully tailored for achieving a legitimate aim. While the right to food is an important right and its promotion is a constitutional obligation of the State, yet the right to privacy cannot simply and automatically yield to it. No legitimate goal of the State can be allowed at the cost of infringement of a fundamental right without passing the test of constitutionality. [p. 919]

Cumulatively, Justice Chandrachud held that the Aadhaar scheme was capable of destroying different constitutional identities, was inadequate to protect the integrity of personal data, the right of informational self-determination and the rights attributable to the privacy-dignity-autonomy trilogy. Since biometric technology which is the core of the Aadhaar programme is probabilistic in nature, leading to authentication failures – the authentication failures led to the denial of rights and legal entitlements. The scheme also caused unwarranted intrusion into fundamental freedoms guaranteed under the Indian Constitution, while the financial exclusion caused due to errors in Aadhaar based authentication also violated the individual’s right to dignity.

On the issue of surveillance, he observed that the scheme allowed for different databases (managed by State or private entities) to link together – in this manner, the “Aadhaar number [became] the central unifying feature that connect[ed] the cell phone with geo-location data, one’s presence and movement with a bank account and income tax returns, food and lifestyle consumption with medical records” [p. 903]. Consequently, he held that linking Aadhaar with different databases carries the potential of being profiled into a system, which could be used for commercial purposes. It also carried the capability of influencing the behavioural patterns of individuals, by affecting their privacy and liberty. Profiling individuals could then be used to create co-relations between human lives, which are generally unconnected. Since Aadhaar becomes a bridge across discreet data silos – which allowed anyone with access to this information to re-construct a profile of an individual’s life – while section 2(k) of the Act excluded storage of information related to race, religion, caste, tribe, ethnicity, language, income or medical history into CIDR – the mandatory linking of Aadhaar with various schemes allowed the same result in effect [p. 907].

Justice Chandrachud also analysed the issue of exclusion caused as a consequence of biometric devices having a disproportionate impact on the lives of the marginalized and poor. Holding that “the fate of individuals cannot be left to the vulnerabilities of technological algorithms or devices” [p. 930], he also noted that arbitrary exclusion from entitled benefits or subsidies was a violation of dignity. According to him, such denial of subsidies and benefits due to the infirmities of biometric technology was a threat to good governance and social parity [p. 932]. In para 263, he remarks:

The issue of exclusion needs to be considered at three different levels: (i) before the implementation of the Aadhaar Act, when biometrics were being used since 2009; (ii) under the provisions of the Act; and (iii) at the practical level during the implementation of the Aadhaar programme… No failure rate in the provision of social welfare benefits can be regarded as acceptable. Basic entitlements in matters such as foodgrain, can brook no error. To deny food is to lead a family to destitution, malnutrition and even death.

On the issue of money bill and the challenge of colourable legislation, the minority opinion noted that the language used in Article 110(3) did not exclude judicial review of the speaker’s decision, if the decision of the speaker suffers from illegality or from a violation of constitutional provisions. Furthermore, he underscored that to be certified a Money Bill, a Bill must contain “only provisions” dealing with every or any one of the matters set out in sub-clauses (a) to (g) of Article 110(1). Consequently, a Bill such as Aadhaar where certain provisions which fall beyond the scope of sub-clauses (a) to (g) of Article 110(1) and which cannot be severed, does not qualify as Money Bill. Given that the Aadhaar Act creates a statutory framework for obtaining a unique identity number which is capable of being used for “any” purpose, among which availing benefits, subsidies and services, for which expenses are incurred from the Consolidated Fund of India, is just one purpose provided under Section 7, it fails to meet the requirement under Article 110(1). Alternatively, Justice Chandrachud also highlighted that even if it is held that section 7 bore a nexus to the expenditure incurred from the Consolidated Fund of India, the other provisions of the Act failed to fall within the domain of Article 110(1).

On other fronts, the minority opinion also declared that amendments to Prevention of Money Laundering (Maintenance of Records) Rules, 2005 failed to meet the test of proportionality, while Section 139AA of the Income Tax Act 1962 was invalid because its validity depended upon the legality of Aadhaar Act, which was itself unconstitutional. The decision to link Aadhaar numbers with mobile SIM cards was equally declared to be unconstitutional.

Separate but concurring opinion by Ashok Bhushan, J.: 

According to the dissenting opinion by Justice Bhushan, the requirement under Aadhaar Act to give one’s demographic and biometric information did not violate fundamental right to privacy. Besides, the provisions of Aadhaar Act requiring demographic and biometric information from a resident for Aadhaar Number passed threefold test as laid down in Puttaswamy I, and was therefore not unconstitutional. Remarkably, Justice Bhushan also noted that the collection of data, its storage and use did not violate right to privacy.

The minority opinion agreed with the Court that the scheme did not create an architecture for pervasive surveillance, but instead provided protection and safety of the data received from individuals. Furthermore, he also held section 7, 29, 33 and 47 of the Aadhaar as constitutional, while section 57 was held as unconstitutional to the extent which permitted use of Aadhaar by the State or any body corporate or person, in pursuant to any contract to this effect. He also declared section 139AA of the Income Tax Act, 1961 and rule 9 as amended by PMLA (Second Amendment) Rules, 2017 as constitutional.

Besides, while not immune from judicial review, Judge Bhushan held that Aadhaar Act was rightly passed as a Money Bill. With regard to children, he held that parental consent for providing biometric information under regulation 3 & demographic information under regulation 4 of Aadhaar (Enrollment and Update) Regulations, 2016 had to be read for enrollment of children between 5 to 18 years to uphold the constitutionality of those provisions.

---