Behind Aadhaar flip flop: Plaints, confusion

“After UIDAI’s Bengaluru office received some complaints of Aadhaar details being altered using photoshop, they were alarmed by the possibility of its misuse. So they issued a statement urging people to not share photocopies of Aadhaar with unauthorised entities. But the advisory was causing a lot of confusion and could have been misinterpreted,” an official in the know said.

The initial advisory, issued last Friday, said citizens should share their Aadhaar details only with entities that have a “user licence” from UIDAI. It did not specify how to verify this user licence. It added: “Do not share photocopy of your Aadhaar with any organisations because it can be misused. Alternatively, please use a masked Aadhaar which displays only the last 4 digits of your Aadhaar number.”

While withdrawing the advisory, MeitY said, “Aadhaar identity authentication ecosystem has provided adequate features for protecting and safeguarding the identity and privacy of the Aadhaar holder”. It added that people should exercise “normal prudence” while sharing their Aadhaar details, without elaborating on what “normal prudence” constitutes. Queries sent to the UIDAI did not elicit a response until publication.

Friday’s advisory caught people by surprise who took to social media to complain that they regularly share photocopies of Aadhaar for a range of services from getting SIM cards, opening bank accounts, and checking into hotels, among other things. The advisory also appeared to be in stark contrast with a contention made by UIDAI’s former chief and then TRAI chairman RS Sharma, who in 2018 had shared his Aadhaar number on Twitter, challenging a user to show a “concrete example” of how the number could be used to “harm” him.

While critics have routinely flagged privacy-related risks of Aadhaar, a report by the Comptroller and Auditor General of India (CAG), released in April, noted that UIDAI had not ensured that the applications or devices used by agencies or private firms for Aadhaar authentication were “capable of storing personal information… which put the privacy of residents at risk”.

Buy Now | Our best subscription plan now has a special price

In 2018, the Supreme Court had struck down Section 57 of the Aadhaar Act, which essentially allowed private entities to collect citizens’ Aadhaar details. While reading down the provision, the top court had called it “unconstitutional”. Soon after the judgment, however, the UIDAI had clarified to banks that Aadhaar know-your-customer (eKYC) can be used to authenticate beneficiaries of government subsidies and welfare schemes, paving the way for private banks to use the document to identify beneficiaries of government welfare schemes.

A few months later, the Centre issued the Aadhaar and Other Laws (Amendment) Ordinance, 2019, which allowed banks and telecom operators to collect Aadhaar details as a proof of identity. After the Centre launched the Covid vaccination programme, a plea was filed in the Supreme Court in 2021, claiming that the Aadhaar card was being mandatorily insisted upon for administering vaccines. The government then informed the top court that Aadhaar was not mandatory for registration on CoWin.