The creation of the Unique Identity Authority of India (UIDAI) and the appointment of Mr. Nandan Nilekani (former CEO of Infosys) as its Chairperson, have generated a great deal of excitement around the Unique Identity Numbers (UIN) project. The Authority’s commitment to produce the first batch of UINs within a period of two years has prompted a celebratory round of applause in the media. It would certainly be a significant technological and logistical feat to meet this self imposed target. However, the UIDAI runs the risk of meeting the target but failing to create a UIN which will serve as a platform for a revolution in public service delivery or the radical overhaul of internal security. In order to achieve these substantive outcomes, the UIDAI must identify the key constitutional, legal, and institutional policy challenges and then resolve them in a democratic and participatory fashion, as the economic and political costs of correcting or redesigning the key parameters of the project may be so high that a mid-course correction may well be ruled out. Hence, the UIDAI has a critical window of opportunity to engage and resolve these interconnected policy questions at the outset. Three such issues demand serious attention: institutional design, privacy, and citizenship. A UIN project that fails to respond to these issues substantively will inevitably fail to bring revolutionary change to governmental process.
I begin with a consideration of the institutional location of the UIN project. The UIDAI is an executive authority created by Executive Orders which functions as an independent agency under the auspices of the Planning Commission of India. It is noteworthy that the Planning Commission is itself constituted by a Cabinet Resolution and does not have a constitutional or statutory status. However, it is inadvisable to vest arguably the most important database of Indian residents in a body that does not have a determinate legal status. UIDAI will be responsible for the creation and maintenance, and possibly the utilization of the database, and hence it is critical that its legal rights and obligations be spelled out in careful details. The guardian of the UIN database cannot exist in a legal grey zone.
A preliminary issue that all national ID systems have to contend with is whether the ID card or number is mandatory or voluntary. The Chairperson of UIDAI has announced that the Indian system will be voluntary. By allowing residents to elect to have such an ID number or not, the UIDAI substantially respects a central tenet of privacy law: that information should be accessed with the consent of the information giver. However, for this consent to be meaningful, the information subject should have full information about the uses for which the information is being given. In other words, the functions and potential users of the UIN must be determined in advance and be available to information subjects before they give up information. While ensuring that control over access to personal data is a useful tool to protect citizen autonomy, we must go further to allow the information subject control over the use of the information: when, where, and how it is used. Hence, at each point of use, the information subject should be requested to furnish consent and some key information without which the UIN cannot be accessed by any person or agency. Without these protections the voluntary character of the UIN is illusory. When one considers that the UIDAI hopes to ensure that the UIN is indispensable to access basic services, then voluntary subscription alone does not adequately protect information subject autonomy.
A related issue that impinges on the privacy of information subjects is the quantum and quality of data that UIDAI will collect and organize as well the identifier chosen as the UIN. The data collected in order to grant a UIN may be linked to the purpose of the identity verification or linked intrinsically to the person. The UIDAI has indicated that they will utilize data intrinsic to the person, including biometric data. Further, personal data including the name, date of birth, place of residence, and community identity, among others may potentially be linked to the biometric data to create unique identity. This range of data may be thought necessary for the number of functions that the UIN has been proposed to serve.
However, the choice of the quantum or nature of information sought to be collected and the institutional guardianship of this data is critical to evaluate the potential impact on the privacy of the information subjects. Any proposal to collect this range of personal information and to integrate it into a single database and allow a single institution to utilize this data raises the serious prospect of a surveillance state. As a general rule, it may be proposed that as little correlated data as possible must be made available to a single institution or agency. In the event that it is thought expedient to collect all this personal information, then it is essential that this be vested in different databases, maintained by different institutions with rigorous institutional protocols of access of sharing that follows legal due process. Barring these institutional and process protections the UIN database will violate the rights of privacy which are integral to the right to life in Article 21 of the constitution. The absence of statutory protection for a privacy right does not give sanction to the UIN project. It only elevates the nature of the legal challenge to such a database from the realms of administrative law to one of a constitutional character.
The choice of identifier to be used as a UIN is critical to maintain the anonymity and privacy of the citizen subjects. As the UIDAI has indicated that it will use a random rather than systematic identifier, this will avoid the worst excesses that may result from easy traceability. The Rwandan genocide and the Gujarat riots used ID cards and voter lists respectively as the bureaucratic aids through which collective violence was organized. As any student of politics and constitutional law learns, it is insufficient to rely on the good intentions of those in power to ensure that the UIN is not put to such use. The UIN database and its custodian must be ring fenced from ever being able to put to such heinous purposes.
For the UIN to be the governmental process reform enabler that it is designed to be, there needs to be an active interface between the UIN and other legal markers of status and identity. The primary legal marker that the UIN will need to integrate is that of citizenship. However, there is confusion about whether the UIN will be available only to citizens or to all residents. The early announcements by the UIDAI suggest that it will not address the difficult problems that relate to the determination of citizenship. The earlier efforts of the Home Ministry through the pilot projects of the Multi Purpose National Identity Cards project led to the introduction of the Citizenship (Registration of Citizens and Issue of National Identity Cards) Rules, 2003 under Section 18 of the Citizenship Act, 1955. These rules seek to bring clarity to the process of issuing ID cards on the basis of citizenship.
The reluctance of the UIDAI to trespass into the territory of the Home Ministry to resolve the messy state of the law relating to citizenship is understandable. The history of the disputes relating to citizenship and domicile status is evidence of the difficult legal and political problems that need to be resolved in this sphere of public policy. However, the delivery of public services to the poor is inevitably tied up with the determination of the particular legal status of the claimant to the entitlement or benefit. This legal status may be citizenship, residence, income levels, caste or religious background. Further, the social unit which is entitled under each scheme may be the individual, family, household or community. Any improvement in delivery of public services is conditional on the official determination that the legal entitlement or benefit is properly claimed. Hence, the UIDAI will need to resolve difficult problems, not avoid them in order to be bring reform to public service delivery. If not, the UIN will play no significant role in public service delivery reform.
In the next twenty-four months, the UIDAI may well succeed in issuing the first UINs. However, unless the UINs are statutory legal entitlements of all eligible residents or citizens, it may well become burdensome to acquire, and therefore another opportunity for rent seeking government or government authorized operators. Moreover, for the UIN to be an enabler of social reform through improved service delivery and through intelligent law enforcement, it will need to critically analyze and overhaul the dysfunctional legal framework in the fields of privacy and the legal status of claimant. We can have a UIN that does not tackle any of these policy muddles, but that will not be the game-changing initiative it promises to be.
Sudhir Krishnaswamy is Professor of Law at the National University of Juridical Sciences, Kolkata, and the author of Democracy and Constitutionalism in India: A Study of the Basic Structure Doctrine (Oxford University Press 2009).He can be reached at krishnaswamysudhir@gmail.com
India in Transition (IiT) is published by the Center for the Advanced Study of India (CASI) of the University of Pennsylvania. All viewpoints, positions, and conclusions expressed in IiT are solely those of the author(s) and not specifically those of CASI.
© 2010 Center for the Advanced Study of India and the Trustees of the University of Pennsylvania. All rights reserved.