Dear telcos and banks, please delete our Aadhaar data that you extorted
For the last two odd years, India's telecom companies, e-wallet operators and banks have bombarded their users seeking Aadhaar details, almost on a daily basis. Again and again they informed us — and disingenuously so — that Aadhaar details were mandatory to avail their services. Companies like Airtel, Jio, Vodafone, Idea, ICICI Bank, HDFC Bank, Paytm, etc. virtually forced millions of people to share their Aadhaar details or undergo the e-KYC, which in turn, potentially exposed a lot of private demographic details.
Today the Supreme Court called this — hoarding Aadhaar data — unconstitutional.
With immediate effect, banks and telecom companies have to stop asking people for their Aadhaar numbers or conduct e-KYC based on Aadhaar. Not only did the court strike down the Finance Ministry’s rules that made linking of bank accounts with Aadhaar number mandatory, it also took down the Department of Telecom (DoT) directive that sought the re-verification of mobile phone numbers with Aadhaar.
It has said that no private company in India can use Aadhaar data or e-KYC. It has called the Section 57 of Aadhaar, which allowed private organisations to use Aadhaar infrastructure, illegal.
The Supreme Court judgment, however, comes months after this whole "link-Aadhaar-everywhere" chorus started. There are millions and millions of Indians, who have already given their Aadhaar details — mostly because they were virtually coerced in doing so — to private companies.
Now, that the Supreme Court has said what it needed to say on Aadhaar, it's time for telecom companies and banks to delete Aadhaar details they collected from Indians.
In fact, Justice DY Chandrachud of the five-judge bench that delivered the Aadhaar verdict — the only judge to have dissenting opinion that differs greatly from those of the other judges — makes it clear that this data needs to be deleted. In his verdict, he wrote: "All TSPs shall be directed by the Union government and by TRAI to forthwith delete the biometric data and Aadhaar details of all subscribers within two weeks. The above data and Aadhaar details shall not be used or purveyed by any TSP or any other person or agency on their behalf for any purpose whatsoever."
Justice Chandrachud is in minority in this verdict. But on this point, his position is pretty close the majority. The Supreme Court has struck down the government rules that sought linking of Aadhaar number with bank accounts and phone numbers. "We hold that the provision in the present form [related to bank account linking] does not meet the test of proportionality and, therefore, violates the right to privacy of a person which extends to banking details," the Court noted.
On the linking of phone numbers with Aadhaar number, the judgment noted, "Circular dated March 23, 2017 mandating linking of mobile number with Aadhaar is held to be illegal and unconstitutional as it is not backed by any law and is hereby quashed."
But it stopped short of categorically calling on private companies to delete the Aadhaar data that has already been collected.
This is where the private companies need to the right thing. They should not only stop linking mobile phone numbers and bank accounts with Aadhaar immediately — something that the Supreme Court categorically demands — but they should also go a step further and delete the data, to follow what Justice Chandrachud says.
It is necessary for private companies to delete the Aadhaar data they have collected so far, because they have been barred from using Aadhaar information now that the Section 57 of the Aadhaar Act has been struck down. Doing so will be an exercise in good faith.
The way people have been harassed and spammed for Aadhaar numbers in the last one year can be undone, only if these companies now show compassion for their users. And showing this compassion will mean deleting the Aadhaar details they have, and creating a process that allows people to delink their Aadhaar details from phone numbers and bank accounts.
Two years of virtually forcing people to link their Aadhaar details with various services, must be followed by, at least, a month or so of educating people on how to delink these details.