A Billion Indian Identities and More at Stake in Privacy Case

India’s top court is considering whether privacy is a fundamental right of every citizen in a case that could have implications for the country’s biometric identity program and a slew of global technology companies.

Activists, lawyers and politicians have challenged the government over the legal basis of the program known as Aadhaar, with the Supreme Court in New Delhi to decide if the system should be thrown out or modified.

Conceived as a way to curb the siphoning off of welfare meant for the poor, Prime Minister Narendra Modi has pushed the system’s adoption into uses spanning buying a phone, getting utilities connected or conducting financial transactions online. Any changes could impact companies from Microsoft Corp. to Samsung Electronics Co., which have integrated Aadhaar into their products, while a new interpretation of privacy can affect Google and Facebook Inc..

Some critics want to limit Aadhaar to specific purposes so that personal data and information collected by the government doesn’t go into a central database that can then be leaked or used elsewhere.

“My surrender of a fingerprint to unlock my iPhone is not for anything else except opening my iPhone," said lawyer Sajan Poovayya, who represents lawmaker and entrepreneur Rajeev Chandrasekhar, one of the petitioners.

Fingerprints, Iris Scans

Under Aadhaar, which means foundation in Hindi, the unique ID authority has spent seven years collecting fingerprints and iris and facial scans, as well as addresses, phone numbers and personal details of more than 1.1 billion citizens. The data of each person is tagged to a unique 12-digit identification number.

In India, anything considered a “fundamental right” has constitutional protection and can’t be taken away except under a few rare exceptions such as national security. The government has maintained that privacy is not a fundamental right and an individual’s right to their body isn’t absolute.

During three days of arguments, some judges have questioned how privacy could be enforced as a fundamental right when Google and Facebook extensively collect user data.

“When one can share personal data with private players like Apple, why not share it with the government? What’s the difference?" Justice D.Y. Chandrachud of the nine-judge panel asked during the hearing. “The moment you want to travel from Mumbai to Delhi, you will get 100 suggestions. Your private and personal data is in private hands, so is there anything qualitatively different when the state has it?”

Poovayya responded that just because a private company has access to an individual’s data, or it is in the public domain, it isn’t an argument against a right to privacy.

The hearings will continue this week, when the government will present its side of the case, with a ruling expected in subsequent weeks.

Surrendering Data

Private companies have enthusiastically adopted Aadhaar, using it to authenticate job seekers, blood donors and loan applicants. Samsung offers devices with Aadhaar-compliant iris scanners embedded while Microsoft integrated the biometrics into its Skype video-chatting service so users can authenticate themselves using the government database.

Some of the arguments against Aadhaar have focused on the government’s decision to make enrollment compulsory to receive welfare benefits. Another concern raised is that data could be used to track a person’s movements and transactions. Petitioners cited several instances of numbers and personal details being leaked or sold online.

While legal recourse is typically available when a private company mishandles personal data, it’s more complicated when it involves the government.

“My informed surrender of data to a private player in this digital age is not my surrender of my personal data to all,” said lawyer Poovayya. “But if I give it to the state, where are the corresponding restrictions and deterrents?”