It must be stated first and foremost that in a landmark judgment with far reaching consequences directly affecting the common person, the Apex Court in Justice KS Puttaswamy (Retd) and another v Union of India and others in Writ Petition (Civil) No. 494 of 2012 and connected matters has upheld the validity of Aadhaar for availing government subsidies and benefits and for filing income tax returns! The lone dissenting Judge in this landmark case is Justice Dr DY Chandrachud. He differed entirely from the majority and struck down Section 139AA.

Before proceeding ahead, let us discuss the entire chronological events that led to this landmark and laudable judgment by the Apex Court. They are as follows: -

January 2009: Planning Commission notification on UIDAI.

2010-2011: National Identification Authority of India Bill, 2010 introduced.

November 2012: Retired Justice KS Puttaswamy and others file PILs in Supreme Court challenging validity of Aadhaar.

November 2013: Supreme Court orders all states and Union Territories be impleaded as respondents.

March 3, 2016: Aadhaar Bill, 2016 introduced in the Lok Sabha; later passed as money bill.

May 2017: Former Union Minister and Congress leader Jairam Ramesh moves Apex Court challenging the Centre's decision to treat Aadhaar Bill as a money bill.

August 24, 2017: Supreme Court nine-Judge Bench rules that right to privacy is a fundamental right.

December 15, 2017: Supreme Court extends deadline for mandatory linking of Aadhaar with various services and welfare schemes till March 31, 2018.

January 17, 2018: Supreme Court five-Judge Bench begins hearing Aadhaar case.

January 25, 2018: Apex Court asks Chhattisgarh High Court to modify in 10 days its order directing all trial courts in the state to mandatorily accept copies of Aadhaar card for releasing an accused on bail.

February 19, 2018: Delhi BJP leader Ashwini Kumar Upadhyay seeks direction to Election Commission to take appropriate steps to implement an 'Aadhaar based election voting system'.

February 21, 2018: Supreme Court says the alleged defect that citizens biometric details under the Aadhaar scheme were being collected without any law, could be cured by subsequently bringing a statute.

March 7, 2018: Supreme Court says Aadhaar number not mandatory for enrolment of students in all India exams.

March 13, 2018: Supreme Court extends March 31 deadline of Aadhaar linking till it gives its order.

March 22, 2018: UIDAI CEO says breaking the Aadhaar encryption may take "more than the age of the universe for the fastest computer on earth".

March 28, 2018: Social activist Reshma Prasad seeks direction to the Centre to create a separate third gender category option on PAN cards for transgenders.

April 3, 2018: Centre tells Apex Court that Aadhaar law is just, fair and reasonable.

April 17, 2018: Apex Court raises concerns that there is a threat of Aadhaar data misuse.

April 25, 2018: Supreme Court questions Centre on mandatory seeding of Aadhaar with mobile.

May 10, 2018: Supreme Court reserves verdict.

September 26: Supreme Court upholds constitutional validity of Aadhaar. It also strikes down provisions including its linking with bank accounts, mobile phones and admissions.

To be sure, Justice AK Sikri while authoring the majority judgment for himself, CJI Dipak Misra and Justice AM Khanwilkar set the ball rolling by opening the judgment with the famous time-tested adage which says that, "It is better to be unique than the best. Because, being the best makes you the number one but being unique makes you the only one." Para 2 then adds that, " 'Unique makes you the only one' is the central message of Aadhaar, which is on the altar facing constitutional challenge in these petitions. 'Aadhaar' which means, in English, 'foundation' or 'base', has become the most talked about expression in recent years, not only in India but in many other countries and international bodies. A word from Hindi dictionary has assumed secondary significance. Today, mention of the word 'Aadhaar' would not lead a listener to the dictionary meaning of this word. Instead, every person on the very mentioning of this word 'Aadhaar' would associate it with the card that is issued to a person from where he/she can be identified. It is described as an "Unique Identity' and the authority which enrolls a person and at whose behest the Aadhaar Card is issued is known as Unique Identification Authority of India (hereinafter referred to as 'UIDAI' or 'Authority'). It is described as unique for various reasons. UIDAI claims that not only it is a foolproof method of identifying a person, it is also an instrument whereby a person can enter into any transaction without needing any other document in support. It has become a symbol of digital economy and has enabled multiple avenues for a common man. Aadhaar scheme, which was conceptualised in the year 2006 and launched in the year 2009 with the creation of UIDAI, has secured the enrolment of almost 1.1 billion people in this country. Its use is spreading like wildfire, which is the result of robust and aggressive campaigning done by the Government, governmental agencies and other such bodies. In this way it has virtually become a household symbol. The Government boasts of multiple benefits of Aadhaar."

Going forward, para 3 then goes on to say that, "At the same time, the very scheme of Aadhaar and the architecture built thereupon has received scathing criticism from a section of the society. According to them, Aadhaar is a serious invasion into the right to privacy of persons and it has the tendency to lead to a surveillance state where each individual can be kept under surveillance by creating his/her life profile and movement as well on his/her use of Aadhaar. There has been no other subject matter in recent past which has evoked the kind of intensive and heated debate wherein both sides, for and against, argue so passionately in support of their respective conviction. The petitioners in these petitions belonging to the latter category who apprehend the totalitarian state if Aadhaar project is allowed to continue. They are demanding scrapping and demolition of the entire Aadhaar structure which, according to them, is anathema to the democratic principles and rule of law, which is the bedrock of the Indian Constitution. The petitioners have challenged the Aadhaar project which took off by way of administrative action in the year 2009. Even after Aadhaar got a shield of statutory cover, challenge persists as the very enactment known as Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (hereinafter referred to as the 'Aadhaar Act') is challenged as constitutionally impermissible. The wide range of issues involved in this case is evident from the fact that it took almost four months for the parties to finish their arguments in these cases, and the Court witnessed highly skilled, suave, brilliant and intellectual advocacy, with the traces of passions as well."

As things stand, para 4 then points out that, "The issue has generated heated public debate as well. Even outside the Court, there are groups advocating in favour of the Aadhaar scheme and those who are stoutly opposing the same. Interestingly, it is not only the commoners who belong to either of the two groups but intelligentsia is also equally divided. There have been number of articles, interviews for discourses in favour of or against Aadhaar. Those in favour see Aadhaar project as ushering the nation into a regime of good governance, advancing socio-economic rights, economic prosperity etc. and in the process they claim that it may make the nation a world leader. Mr. K.K. Venugopal, learned Attorney General for India, referred in the commendations by certain international bodies, including the World Bank. We clarify that we have not been influenced by such views expressed either in favour of or against. Those opposing Aadhaar are apprehensive that it may excessively intrude into the privacy of citizenry and has the tendency to create a totalitarian state, which would impinge upon the democratic and constitutional values. Some such opinions of various persons/bodies were referred to during the arguments. Notwithstanding the passions, emotions, annoyance, despair, ecstasy, euphoria, coupled with rhetoric, exhibited by both sides in equal measure during the arguments, this Court while giving its judgment on the issues involved is required to have a posture of calmness coupled with objective examination of the issues on the touchstone of the constitutional provisions."

More importantly, it is then revealed in para 5 that, "Initiative in spearheading the attack on the Aadhaar structure was taken by the petitioners, namely, Justice K.S. Puttaswamy (Retd.) and Mr. Pravesh Khanna, by filing Writ Petition (Civil) No. 494 of 2012. At that time, Aadhaar scheme was not under legislative umbrella. In the writ petition the scheme has primarily been challenged on the ground that it violates fundamental rights of the innumerable citizens of India, namely, right to privacy falling under Article 21 of the Constitution of India. Few others joined the race by filing connected petitions. Series of orders were passed in this petition from time to time, some of which would be referred to by us at the appropriate stage. In 2016, with the passing of the Aadhaar Act, these very petitioners filed another writ petition challenging the vires of the Act. Here again, some more writ petitions have been filed with the same objective. All these writ petitions were clubbed together. There are number of interventions as well by various individuals, groups, NGOs, etc., some opposing the petitions and some supporting the Aadhaar scheme."

Summary and Conclusions
Now it is time to dwell on summary and conclusions. This has been enunciated in para 446, 447 and 448. First of all, let us see what para 446 stipulates. It states that –

"446 (a) The architecture and structure of the Aadhaar Act reveals that the UIDAI is established as a statutory body which is given the task of developing the policy, procedure and system for issuing Aadhaar numbers to individuals and also to perform authentication thereof as per the provisions of the Act. For the purpose of enrolment and assigning Aadhaar numbers, enrolling agencies are recruited by the Authority. All the residents in India are eligible to obtain an Aadhaar number. To enable a resident to get Aadhaar number, he is required to submit demographic as well as biometric information i.e. apart from giving information relating to name, date of birth and address, biometric information in the form of photograph, fingerprint, iris scan is also to be provided. Aadhaar number given to a particular person is treated as unique number as it cannot be reassigned to any other individual.

(b) Insofar as subsidies, benefits or services to be given by the Central Government or the State Government, as the case may be, is concerned, these Governments can mandate that receipt of these subsidies, benefits and services would be given only on furnishing proof of possession of Aadhaar number (or proof of making an application for enrolment, where Aadhaar number is not assigned). An added requirement is that such individual would undergo authentication at the time of receiving such benefits etc. A particular institution/body from which the aforesaid subsidy, benefit or service is to be claimed by such an individual, the intended recipient would submit his Aadhaar number and is also required to give her biometric information to that agency. On receiving this information and for the purpose of its authentication, the said agency, known as Requesting Entity (RE), would send the request to the Authority which shall perform the job of authentication of Aadhaar number. On confirming the identity of a person, the individual is entitled to receive subsidy, benefit or service. Aadhaar number is permitted to be used by the holder for other purposes as well.

(c) In this whole process, any resident seeking to obtain an Aadhaar number is, in the first instance, required to submit her demographic information and biometric information at the time of enrolment. She, thus, parts with her photograph, fingerprint and iris scan at that stage by giving the same to the enrolling agency, which may be a private body/person. Likewise, every time when such Aadhaar holder intends to receive a subsidy, benefit or service and goes to specific/designated agency or person for that purpose, she would be giving her biometric information to that RE, which, in turn, shall get the same authenticated from the Authority before providing a subsidy, benefit or service.

(d) Attack of the petitioners to the Aadhaar programme and its formation/structure under the Aadhaar Act is founded on the arguments that it is a grave risk to the rights and liberties of the citizens of this country which are secured by the Constitution of India. It militates against the constitutional abiding values and its foundational morality and has the potential to enable an intrusive state to become a surveillance state on the basis of information that is collected in respect of each individual by creation of a joint electronic mesh. In this manner, the Act strikes at the very privacy of each individual thereby offending the right to privacy which is elevated and given the status of fundamental right by tracing it to Articles 14, 19 and 21 of the Constitution of India by a nine Judge Bench judgment of this Court in K.S. Puttaswamy.

(e) The respondents, on the other hand, have attempted to shake the very foundation of the aforesaid structure of the petitioners' case. They argue that in the first instance, minimal biometric information of the applicant, who intends to have Aadhaar number, is obtained which is also stored in CIDR for the purpose of authentication. Secondly, no other information is stored. It is emphasised that there is no data collection in respect of religion, caste, tribe, language records of entitlement, income or medical history of the applicant at the time of Aadhaar enrolment. Thirdly, the Authority also claimed that the entire Aadhaar enrolment is foolproof inasmuch as within few seconds of the biometrics having been collected by the enrolling agency, the said information gets transmitted from the Authorities/CIDR, that too in an encrypted form, and goes out of the reach of the enrolling agency. Same is the situation at the time of authentication as biometric information does not remain with the requesting agency. Fourthly, while undertaking the authentication process, the Authority simply matches the biometrics and no other information is received or stored in respect of purpose, location or nature or transaction etc. Therefore, the question of profiling does not arise at all.

(f) In the aforesaid scenario, it is necessary, in the first instance, to find out the extent of core information, biometric as well as demographic, that is collected and stored by the Authority at the time of enrolment as well as at the time of authentication. This exercise becomes necessary in order to consider the argument of the petitioners about the profiling of the Aadhaar holders. On going through this aspect, on the basis of the powerpoint presentation given by Dr. Ajay Bhushan Pandey, CEO of UIDAI, and the arguments of both the sides, including the questions which were put by the petitioners to Dr. Pandey and the answers thereupon, the Court has come to the conclusion that minimal possible data, demographic and biometric, is obtained from the Aadhaar holders.

(g) The Court also noticed that the whole architecture of Aadhaar is devised to give unique identity to the citizens of this country. No doubt, a person can have various documents on the basis of which that individual can establish her identity. It may be in the form of a passport, PAN card, ration card and so on. For the purpose of enrolment itself number of documents are prescribed which an individual can produce on the basis of which Aadhaar card can be issued. Thus, such documents, in a way, are also proof of identity. However, there is a fundamental difference between the Aadhaar card as a mean of identity and other documents through which identity can be established. Enrolment for Aadhaar card also requires giving of demographic information as well as biometric information which is in the form of iris and fingerprints. This process eliminates any chance of duplication. It is emphasised that an individual can manipulate the system by having more than one or even number of PAN cards, passports, ration cards etc. When it comes to obtaining Aadhaar card, there is no possibility of obtaining duplicate card. Once the biometric information is stored and on that basis Aadhaar card is issued, it remains in the system with the Authority. Wherever there would be a second attempt for enrolling for Aadhaar and for this purpose same person gives his biometric information, it would be immediately get matched with the same biometric information already in the system and the second request would stand rejected. It is for this reason the Aadhaar card is known as Unique Identification (UID). Such an identity is unparalleled.

(h) There is, then, another purpose for having such a system of issuing unique identification cards in the form of Aadhaar card. A glimpse thereof is captured under the heading 'Introduction' above, while mentioning how and under what circumstances the whole project was conceptualised. To put it tersely, in addition to enabling any resident to obtain such unique identification proof, it is also to empower marginalised section of the society, particulary those who are illiterate and living in abject poverty or without any shelter etc. It gives identity to such persons also. Moreover, with the aid of Aadhaar card, they can claim various privileges and benefits etc. which are actually meant for these people.

(i) Identity of a person has a significance for every individual in his/her life. In a civilised society every individual, on taking birth is given a name. Her place of birth and parentage also becomes important as she is known in the society and these demographic particulars also become important attribute of her personality. Throughout their lives, individuals are supposed to provide such information: be it admission in a school or college or at the time of taking job or engaging in any profession or business activity, etc. When all this information is available in one place, in the form of Aadhaar card, it not only becomes unique, it would also qualify as a document of empowerment. Added with this feature, when an individual knows that no other person can clone her, it assumes greater significance.

(j) Thus, the scheme by itself can be treated as laudable when it comes to enabling an individual to seek Aadhaar number, more so, when it is voluntary in nature. Howsoever benevolent the scheme may be, it has to pass the muster of constitutionality. According to the petitioners, the very architecture of Aadhaar is unconstitutional on various grounds.

(k) The Court has taken note of the heads of challenge of the Act, Scheme and certain Rules etc. and clarified that the matter is examined with objective examination of the issues on the touchstone of the constitutional provisions, keeping in mind the ethos of constitutional democracy, rule of law, human rights and other basic features of the Constitution.

Discussing the scope of judicial review, the Court has accepted that apart from two grounds noticed in Binoy Viswam, on which legislative Act can be invalidated [(a) the Legislature does not have competence to make the law; and b) law made is in violation of fundamental rights or any other constitutional provision], another ground, namely, manifest arbitrariness, can also be the basis on which an Act can be invalidated. The issues are examined having regard to the aforesaid scope of judicial review.

(l) From the arguments raised by the petitioners and the grounds of challenge, it becomes clear that the main plank of challenge is that the Aadhaar project and the Aadhaar Act infringes right to privacy. Inbuilt in this right to privacy is the right to live with dignity, which is a postuate of right to privacy. In the process, discussion leads to the issue of proportionality, viz. whether measures taken under the Aadhaar Act satisfy the doctrine of proportionality.

(m) In view of the above, the Court discussed the contours of right to privacy, as laid down in K.S. Puttaswamy, principle of human dignity and doctrine of proportionality. After taking note of the discussion contained in different opinions of six Hon'ble Judges, it stands established, without any pale of doubt, that privacy has now been treated as part of fundamental right. The Court has held in no uncertain terms that privacy has always been a natural right which gives an individual freedom to exercise control over his or her personality. The judgment further affirms three aspects of the fundamental right to privacy, namely:

(i) intrusion with an individual's physical body,
(ii) informational privacy and
(iii) privacy of choice.

(n) As succinctly put by Nariman, J., first aspect involves the person himself/herself and guards a person's rights relatable to his physical body thereby controlling the uncalled invasion by the State. Insofar as second aspect, namely, informational privacy is concerned, it does not deal with a person's body but deals with a person's mind. In this manner, it protects a person by giving her control over the dissemination of material that is personal to her and disallowing unauthorised use of such information by the State. Third aspect of privacy relates to individual's autonomy by protecting her fundamental personal choices. These aspects have functional connection and relationship with dignity. In this sense, privacy is a postulate of human dignity itself. Human dignity has a constitutional value and its significance is acknowledged by the Preamble. Further, by catena of judgments, human dignity is treated as fundamental right as a facet not only of Article 21, but that of right to equality (Article 14) and also part of bouquet of freedoms stipulated in Article 19. Therefore, privacy as a right is intrinsic of freedom, liberty and dignity. Viewed in this manner, one can trace positive and negative contents of privacy. The negative content restricts the State from committing an intrusion upon the life and personal liberty of a citizen. Its positive content imposes an obligation on the State to take all necessary measures to protect the privacy of the individual.

(o) In developing the aforesaid concepts, the Court has been receptive to the principles in international law and international instruments. It is a recognition of the fact that certain human rights cannot be confined within the bounds of geographical location of a nation but have universal application. In the process, the Court accepts the concept of universalisation of human rights, including the right to privacy as a human right and the good practices in developing and understanding such rights in other countries have been welcomed. In this hue, it can also be remarked that comparative law has played a very significant role in shaping the aforesaid judgment on privacy in Indian context, notwithstanding the fact that such comparative law has only persuasive value. The whole process of reasoning contained in different opinions of the Hon'ble Judges would, thus, reflect that the argument that it is difficult to precisely define the common denominator of privacy, was rejected. While doing so, the Court referred to various approaches to formulating privacy.

(p) We have also remarked above, the taxonomy of privacy, namely, on the basis of 'harms', 'interest' and 'aggregation of rights'. We have also discussed the scope of right to privacy with reference to the cases at hand and the circumstances in which such a right can be limited. In the process, we have also taken note of the passage from the judgment rendered by Nariman, J. in K.S. Puttaswamy stating the manner in which law has to be tested when it is challenged on the ground that it violates the fundamental right to privacy.

(q) One important comment which needs to be made at this stage relates to the standard of judicial review while examining the validity of a particular law that allegedly infringes right to privacy. The question is as to whether the Court, is to apply 'strict scrutiny' standard or the 'just, fair and reasonableness' standard. In the privacy judgment, different observations are made by the different Hon'ble Judges and the aforesaid aspect is not determined authoritatively , may be for the reason that the Bench was deciding the reference on the issue as to whether right to privacy is a fundamental right or not and, in the process, it was called upon to decide the specific questions referred to it. This Court preferred to adopt a 'just, fair and reasonableness' standard which is in tune with the view expressed by majority of Judges in their opinion. Even otherwise, this is in consonance with the judicial approach adopted by this Court while construing 'reasonable restrictions' that the State can impose in public interest, as provided in Article 19 of the Constitution. Insofar as principles of human dignity are concerned, the Court, after taking note of various judgments where this principle is adopted and elaborated, summed up the essential ingredients of dignity jurisprudence by noticing that the basic principle of dignity and freedom of the individual is an attribute of natural law which becomes the right of all individuals in a constitutional democracy. Dignity has a central normative role as well as constitutional value. This normative role is performed in three ways:

First, it becomes basis for constitutional rights;

Second, it serves as an interpretative principle for determining the scope of constitutional rights; and,

Third, it determines the proportionality of a statute limiting a constitutional right. Thus, if an enactment puts limitation on a constitutional right and such limitation is disproportionate, such a statute can be held to be unconstitutional by applying the doctrine of proportionality.

(r) As per Dworkin, there are two principles about the concept of human dignity. First principle regards an 'intrinsic value' of every person, namely, every person has a special objective value which value is not only important to that person alone but success or failure of the lives of every person is important to all of us. It can also be described as self respect which represents the free will of the person, her capacity to think for herself and to control her own life. The second principle is that of 'personal responsibility', which means every person has the responsibility for success in her own life and, therefore, she must use her discretion regarding the way of life that will be successful from her point of view.

(s) Sum total of this exposition can be defined by explaining that as per the aforesaid view dignity is to be treated as 'empowerment' which makes a triple demand in the name of 'respect' for human dignity, namely:

(i) respect for one's capacity as an agent to make one's own free choices;

(ii) respect for the choices so made; and

(iii) respect for one's need to have a context and conditions in which one can operate as a source of free and informed choice.

(t) In the entire formulation of dignity right, 'respect' for an individual is the fulcrum, which is based on the principle of freedom and capacity to make choices and a good or just social order is one which respects dignity via assuring 'contexts' and 'conditions' as the 'source of free and informed choice'. The aforesaid discourse on the concept of human dignity is from an individual point of view. That is the emphasis of the petitioners as well. That would be one side of the coin. A very important feature which the present case has brought into focus is another dimension of human dignity, namely, in the form of 'common good' or 'public good'. Thus, our endeavour here is to give richer and more nuanced understanding to the concept of human dignity.

(u) We, therefore, have to keep in mind humanistic concept of Human Dignity which is to be accorded to a particular segment of the society and, in fact, a large segment. Their human dignity is based on the socio-economic rights that are read in to the Fundamental Rights as already discussed above.

When we read socio-economic rights into human dignity, the community approach also assumes importance along with individualistic approach to human dignity. It has now been well recognised that at its core, human dignity contains three elements namely, Intrinsic Value, Autonomy and Community Value. These are known as core values of human dignity. These three elements can assist in structuring legal reasoning and justifying judicial choices in 'hard cases'.

(v) When it comes to dignity as a community value, it emphasises the role of the community in establishing collective goals and restrictions on individual freedoms and rights on behalf of a certain idea of good life. The relevant question here is in what circumstances and to what degree should these actions be regarded as legitimate in a constitutional democracy? The liberal predicament that the State must be neutral with regard to different conceptions of the good in a plural society is not incompatible, of course, with limitation resulting from the necessary coexistence of different views and potentially conflicting rights. Such interferences, however, must be justified on grounds of a legitimate idea of justice, an "overlapping consensus" ("Overlapping consensus" is a term coined by John Rawls that identifies basic ideas of justice that can be shared by supporters of different religious, political and moral comprehensive doctrines) that can be shared by most individuals and groups. Whenever such tension arises, the task of balancing is to be achieved by the Courts.

We would like to highlight one more significant feature which the issues involved in the present case bring about. It is the balancing of two facets of dignity of the same individual. Whereas, on the one hand, right of personal autonomy is a part of dignity (and right to privacy), another part of dignity of the same individual is to lead a dignified life as well (which is again a facet of Article 21 of the Constitution). Therefore, in a scenario where the State is coming out with welfare schemes, which strive at giving dignified life in harmony with human dignity and in the process some aspect of autonomy is sacrificed, the balancing of the two becomes an important task which is to be achieved by the Courts. For, there cannot be undue intrusion into the autonomy on the pretext of conferment of economic benefits.

(w) In this way, the concept of human dignity has been widened to deal with the issues at hand. As far as doctrine of proportionality is concerned, after discussing the approaches that are adopted by the German Supreme Court and the Canadian Supreme Court, which are somewhat different from each other, this Court has applied the tests as laid down in Modern Dental College & Research Centre, which are approved in K.S. Puttaswamy as well. However, at the same time, a modification is done by focusing on the parameters set down of Bilchitz which are aimed at achieving a more ideal approach.

To put things in perspective, para 447 then states explicitly that, "After stating the aforesaid manner in which different issues that arose are specified and discussed, these questions and conclusions thereupon are summarised below:

 

(1) Whether the Aadhaar Project creates or has tendency to create surveillance state and is, thus, unconstitutional on this ground?

Incidental Issues:(a) What is the magnitude of protection that need to be accorded to collection, storage and usage of biometric data?

(b) Whether the Aadhaar Act and Rules provide such protection, including in respect of data minimisation, purpose limitation, time period for data retention and data protection and security?

Answer: (a) The architecture of Aadhaar as well as the provisions of the Aadhaar Act do not tend to create a surveillance state. This is ensured by the manner in which the Aadhaar project operates.

(b) We have recorded in detail the powerpoint presentation that was given by Dr. Ajay Bhushan Pandey, CEO of the Authority, which brings out the following salient features:

(i) During the enrolment process, minimal biometric data in the form of iris and fingerprints is collected. The Authority does not collect purpose, location or details of transaction. Thus, it is purpose blind. The information collected, as aforesaid, remains in silos. Merging of silos is prohibited. The requesting agency is provided answer only in 'Yes' or 'No' about the authentication of the person concerned. The authentication process is not exposed to the internet world. Security measures, as per the provisions of Section 29(3) read with Section 38(g) as well as Regulation 17(1)(d) of the Authentication Regulations, are strictly followed and adhered to.

(ii) There are sufficient authentication security measures taken as well, as demonstrated in Slides 14, 28 and 29 of the presentation.

(iii) The Authority has sufficient defence mechanism, as explained in Slide 30. It has even taken appropriate protection measures as demonstrated in Slide 31.

(iv) There is an oversight by Technology and Architecture Review Board (TARB) and Security Review Committee.

(v) During authentication no information about the nature of transaction etc is obtained.

(vi) The Authority has mandated use of Registered Devices (RD) for all authentication requests. With these, biometric data is signed within the device/RD service using the provider key to ensure it is indeed captured live. The device provider RD service encrypts the PID block before returning to the host application. This RD service encapsulates the biometric capture, signing and encryption of biometrics all within it. Therefore, introduction of RD in Aadhaar authentication system rules out any possibility of use of stored biometric and replay of biometrics captured from other source. Requesting entities are not legally allowed to store biometrics captured for Aadhaar authentication under Regulation 17(1)(a) of the Authentication Regulations.

(vii) The Authority gets the AUA code, ASA code, unique device code, registered device code used for authentication. It does not get any information related to the IP address or the GPS location from where authentication is performed as these parameters are not part of authentication (v2.0) and e-KYC (v2.1) API. The Authority would only know from which device the authentication has happened, through which AUA/ASA etc. It does not receive any information about at what location the authentication device is deployed, its IP address and its operator and the purpose of authentication. Further, the authority or any entity under its control is statutorily barred from collecting, keeping or maintaining any information about the purpose of authentication under Section 32(3) of the Aadhaar Act.

(c) After going through the Aadhaar structure, as demonstrated by the respondents in the powerpoint presentation from the provisions of the Aadhaar Act and the machinery which the Authority has created for data protection, we are of the view that it is very difficult to create profile of a person simply on the basis of biometric and demographic information stored in CIDR. Insofar as authentication is concerned, the respondents rightly pointed out that there are sufficient safeguard mechanisms. To recapitulate, it was specifically submitted that there was security technologies in place (slide 28 of Dr Pandey's presentation), 24/7 security monitoring, data leak prevention, vulnerability management programme and independent audits (slide 29) as well as the Authority's defence mechanism (slide 30). It was further pointed out that the Authority has taken appropriate pro-active protection measures, which included disaster recovery plan, data backup and availability and media response plan (slide 31). The respondents also pointed out that all security principles are followed inasmuch as: (a) there is PK1-2048 encryption from the time of capture, meaning thereby, as soon as data is given at the time of enrolment, there is an end to end encryption thereof and it is transmitted to the Authority in encrypted form. The said encryption is almost foolproof and it is virtually impossible to decipher the same; (b) adoption of best-in-class security standards and practices; and (c) strong audit and traceability as well as fraud detection. Above all, there is an oversight of Technology and Architecture Review Board (TARB) and Security Review Committee. This Board and Committee consists of very high profiled officers. Therefore, the Act has endeavoured to provide safeguards.

(d) Insofar as use and protection of data is concerned, having regard to the principles enshrined in various cases, Indian and foreign, the matter is examined from the stand point of data minimization, purpose limitation, time period for data retention, data protection and security (qua CIDR, requisite entities, enrolment agencies and Registrars, authentication service agency, hacking, biometric solution providers, substantive procedural or judicial safeguards). After discussing the aforesaid aspect with reference to certain provisions of the Aadhaar Act, we are of the view that apprehensions of the petitioners stand assuaged with the striking down or reading down or clarification of some of the provisions, namely:

(i) Authentication records are not to be kept beyond a period of six months, as stipulated in Regulation 27(1) of the Authentication Regulations. This provision which permits records to be archived for a period of five years is held to be bad in law.

(ii) Metabase relating to transaction, as provided in Regulation 26 of the aforesaid Regulations in the present form, is held to be impermissible, which needs suitable amendment.

(iii) Section 33(1) of the Aadhaar Act is read down by clarifying that an individual, whose information is sought to be released, shall be afforded an opportunity of hearing.

(iv) Insofar as Section 33(2) of the Act in the present form is concerned, the same is struck down.

(v) That portion of Section 57 of the Aadhaar Act which enables body corporate and individual to seek authentication is held to be unconstitutional.

(vi) We have also impressed upon the respondents, to bring out a robust data protection regime in the form of an enactment on the basis of Justice B.N. Srikrishna (Retd.) Committee Report with necessary modification thereto as may be deemed appropriate.
 

(2) Whether the Aadhaar Act violates right to privacy and is unconstitutional on this ground?

Answer: (a) After detailed discussion, it is held that all matters pertaining to an individual do not qualify as being an inherent part of right to privacy. Only those matters over which there would be a reasonable expectation of privacy are protected by Article 21. This can be discerned from the reading of Paras 297 to 307 of the judgment.

(b) The Court is also of the opinion that the triple test laid down in order to adjudge the reasonableness of the invasion to privacy has been made. The Aadhaar scheme is backed by the statute, i.e. the Aadhaar Act. It also serves legitimate State aim, which can be discerned from the introduction to the Act as well as the Statement of Object and Reasons which reflect that the aim in passing the Act was to ensure that social benefit to ensure that social benefit schemes reach the deserving community. The Court noted that the failure to establish identity of an individual has proved to be a major hindrance for successful implementation of those programmes as it was becoming difficult to ensure that subsidies, benefits and services reach the unintended beneficiaries in the absence of a credible system to authenticate identity of beneficiaries. The Statement of Objects and Reasons also discloses that over a period of time, the use of Aadhaar number has been increased manifold and, therefore, it is also necessary to take measures relating to ensuring security of the information provided by the individuals while enrolling for Aadhaar card.

(c) It may be highlighted that the petitioners are making their claim on the basis of dignity as a facet of right to privacy. On the other hand, Section 7 of the Aadhaar Act is aimed at offering subsidies, benefits or services to the marginalised section of the society for whom such welfare schemes have been formulated from time to time. That also becomes an aspect of social justice, which is the obligation of the State stipulated in para IV of the Constitution. The rationale behind Section 7 lies in ensuring targeted delivery of services, benefits and subsidies which are funded from the Consolidated Fund of India. In discharge of its solemn Constitutional obligation to enliven the Fundamental Rights of life and personal liberty (Article 21) to ensure Justice, Social, Political and Economic and to eliminate inequality (Article 14) with a view to ameliorate the lot of the poor and the Dalits, the Central Government has launched several welfare schemes. Some such schemes are PDS, scholarships, mid day meals, LPG subsidies, etc. These schemes involve 3% percentage of the GDP and involve a huge amount of public money. Right to receive these benefits, from the point of view of those who deserve the same, has now attained the status of fundamental right based on the same concept of human dignity, which the petitioners seek to bank upon. The Constitution does not exist for a few or minority of the people of India, but "We the people". The goals set out in the Preamble of the Constitution do not contemplate statism do not seek to preserve justice, liberty, equality and fraternity for those who have the means and opportunity to ensure the exercise of inalienable rights for themselves. These goals are predominantly or at least equally geared to "secure to all its citizens", especially, to the downtrodden, poor and exploited, justice, liberty, equality and "to promote" fraternity assuring dignity. Interestingly, the State has come forward in recognising the rights of deprived section of the society to receive such benefits on the premise that it is their fundamental right to claim such benefits. It is acknowledged by the respondents that there is a paradigm shift in addressing the problem of security and eradicating extreme poverty and hunger. The shift is from the welfare approach to a right based approach. As a consequence, right of everyone to adequate food no more remains based on Directive Principles of State Policy (Art 47), though the said principles remain a source of inspiration . This entitlement has turned into a Constitutional fundamental right. This Constitutional obligation is reinforced by obligations under International Convention.

(d) Even the petitioners did not seriously question the purpose and bona fides of the Legislature enacting the law.

(e) The Court also finds that the Aadhaar Act meets the test of proportionality as the following components of proportionality stand satisfied:

(i) A measure restricting a right must have a legitimate goal (legitimate goal stage).

(ii) It must be a suitable means of furthering this goal (suitability or rationale connection stage)

(iii) There must not be any less restrictive but equally effective alternative (necessary stage).

(iv) The measure must not have a disproportionate impact on the right holder (balancing stage).

(f) In the process, the Court has taken note of serious judgments pronounced by this Court pertaining to right to food, issuance of BPL Cards, LPG connections and LPG cylinders at minimal cost, old age and other kind of pensions to deserving persons, scholarships and implementation of MGNREGA scheme.

(g) The purpose behind these orders was to ensure that the deserving beneficiaries of the scheme are correctly identified and are able to receive the benefits under the said scheme, which is their entitlement. The orders also aimed at ensuring 'good governance' by bringing accountability and transparency in the distribution system with the pious aim in mind, namely, benefits actually reached those who are rural, poor and starving.

(h) All this satisfies the necessity stage test, particularly in the absence of any less restrictive but equally effective alternative.

(i) Insofar as balancing is concerned, the matter is examined at two levels:

i) Whether 'legitimate state interest' ensures 'reasonable tailoring'? There is a minimal intrusion into the privacy and the law is narrowly framed to achieve the objective. Here the Act is to be tested on the ground that whether it is found on a balancing test that the social or public interest and the reasonableness of the restrictions outweigh the particular aspect of privacy, as claimed by the petitioners. This is the test we have applied in the instant case.

ii) There needs to be balancing of two competing fundamental rights, right to privacy on the one hand and right to food, shelter and employment on the other hand. Axiomatically both the rights are founded on human dignity. At the same time, in the given context, two facets are in conflict with each other. The question here would be, when a person seeks to get the benefits of welfare schemes to which she is entitled to as a part of right to live life with dignity, whether her sacrifice to the right to privacy, is so invasive that it creates imbalance?

(j) In the process, sanctity of privacy in its functional relationship with dignity is kept in mind where it says that legitimate expectation of privacy may vary from intimate zone to the private zone and from the private to public arena. Reasonable expectation of privacy is also taken into consideration. The Court finds that as the information collected at the time of enrolment as well as authentication is minimal, balancing at the first level is met. Insofar as second level, namely, balancing of two competing fundamental rights is concerned, namely, dignity in the form of autonomy (informational privacy) and dignity in the form of assuring better living standards of the same individual, the Court has arrived at the conclusion that balancing at the second level is also met. The detailed discussion in this behalf amply demonstrates that enrolment in Aadhaar of the unprivileged and marginalised section of the society, in order to avail the fruits of welfare schemes of the Government, actually amounts to empowering these persons. On the one hand, it gives such individuals their unique identity and, on the other hand, it also enables such individuals to avail the fruits of welfare schemes of the Government which are floated as socio-economic welfare measures to uplift such classes. In that sense, the scheme ensures dignity to such individuals. This facet of dignity cannot be lost sight of and needs to be acknowledged. We are, by no means, accepting that when dignity in the form of economic welfare is given, the State is entitled to rob that person of his liberty. That can never be allowed. We are concerned with the balancing of the two facets of dignity. Here we find that the inroads into the privacy rights where these individuals are made to part with their biometric information, is minimal. It is coupled with the fact that there is no data collection on the movements of such individuals, when they avail benefits under Section 7 of the Act thereby ruling out the possibility of creating their profiles. In fact, this technology becomes a vital tool of ensuring good governance in a social welfare state. We, therefore, are of the opinion that the Aadhaar Act meets the test of balancing as well.

(k) Insofar as the argument based on probabilistic system of Aadhaar leading to 'exclusion' is concerned, the Authority has claimed that biometric accuracy is 99.76% and the petitioners have also proceeded on that basis. In this scenario, if the Aadhaar project is shelved, 99.76% beneficiaries are going to suffer. Would it not lead to their exclusion? It will amount to throwing the baby out of hot water along with the water. In the name of 0.232% failure (which can in any case be remedied) should be revert to the pre-Aadhaar stage with a system of leakages, pilferages and corruption in the implementation of welfare schemes meant for marginalised section of the society, the full fruits thereof were not reaching to such people?

(l) The entire aim behind launching this programme is the 'inclusion' of the deserving persons who need to get such benefits. When it is serving much larger purpose by reaching hundreds of millions of deserving persons, it cannot be crucified on the unproven plea of exclusion of some. It is clarified that the Court is not trivialising the problem of exclusion if it is there. However, what we are emphasising is that remedy is to plug the loopholes rather than axe a project, aimed for the welfare of large section of the society. Obviously, in order to address the failures of authentication, the remedy is to adopt alternate methods for identifying such persons, after finding the causes of failure in their cases. We have chosen this path which leads to better equilibrium and have given necessary directions also in this behalf, viz:

i) We have taken on record the statement of the learned Attorney General that no deserving person would be denied the benefit of a scheme on the failure of authentication.

ii) We are also conscious of the situation where the formation of fingerprints may undergo change for various reasons. It may happen in the case of a child after she grows up; it may happen in the case of an individual who gets old; it may also happen because of damage to the fingers as a result of accident or some disease etc. or because of suffering of some kind of disability for whatever reason. Even iris test can fail due to certain reasons including blindness of a person. We again emphasise that no person rightfully entitled to the benefits shall be denied the same on such grounds. It would be appropriate if a suitable provision be made in the concerned regulations for establishing an identity by alternate means in such situations.

(m) As far as subsidies, services and benefits are concerned, their scope is not to be unduly expanded thereby widening the net of Aadhaar, where it is not permitted otherwise. In this respect, it is held as under:

i) 'Benefits' and 'services' as mentioned in Section 7 should be those which have the colour of some kind of subsidies etc., namely welfare schemes of the Government whereby Government is doling out such benefits which are targeted at a particular deprived class.

ii) It would cover only those 'benefits' etc. the expenditure thereof has to be drawn from the Consolidated Fund of India.

iii) On that basis, CBSE, NEET, JEE, UGC etc. cannot make the requirement of Aadhaar mandatory as they are outside the purview of Section 7 and are not backed by any law.
 

(3) Whether children can be brought within the sweep of Sections 7 and 8 of the Aadhaar Act?

Answer: a) For the enrolment of children under the Aadhaar Act, it would be essential to have the consent of their parents/guardian.

b) On attaining the age of majority, such children who are enrolled under Aadhaar with the consent of their parents, shall be given the option to exit from the Aadhaar project if they so choose in case they do not intend to avail the benefits of the scheme.

c) Insofar as the school admission of children is concerned, requirement of Aadhaar would not be compulsory as it is neither a service nor subsidy. Further, having regard to the fact that a child between the age of 6 to 14 years has the fundamental right to education under Article 21A of the Constitution, school admission cannot be treated as 'benefit' as well.

d) Benefits to children between 6 to 14 years under Sarv Shiksha Abhiyan, likewise, shall not require mandatory Aadhaar enrolment.

e) For availing the benefits of other welfare schemes which are covered by Section 7 of the Aadhaar Act, though enrolment number can be insisted, it would be subject to the consent of the parents, as mentioned in (a) above.

f) We also clarify that no child shall be denied benefit of any of these schemes if, for some reasons, she is not able to produce the Aadhaar number and the benefit shall be given by verifying the identity on the basis of any other documents. This we say having regard to the statement which was made by Mr. K.K. Venugopal, learned Attorney General for India, at the Bar.

(4) Whether the following provisions of the Aadhaar Act and Regulations suffer from the vice of unconstitutionality:
(i) Sections 2(c) and 2(d) read with Section 32
(ii) Section 2(h) read with Section 10 of CIDR
(iii) Section 2(l) read with Regulation 23
(iv) Section 2(v)
(v) Section 3
(vi) Section 5
(vii) Section 6
(viii) Section 8
(ix) Section 9
(x) Sections 11 to 23
(xi) Sections 23 and 54
(xii) Section 23(2)(g) read with Chapter VI & VII – Regulations 27 to 32
(xiii) Section 29
(xiv) Section 33
(xv) Section 47
(xvi) Section 48
(xvii) Section 57
(xviii) Section 59

Answer: (a) Section 2(d) which pertains to authentication records, such records would not include metadata as mentioned in Regulation 26(c) of the Aadhaar (Authentication) Regulations, 2016. Therefore, this provision in the present form is struck down. Liberty, however, is given to reframe the regulation, keeping in view the parameters stated by the Court.

(b) Insofar as Section 2(b) is concerned, which defines 'resident', the apprehension expressed by the petitioners was that it should not lead to giving Aadhaar card to illegal immigrants. We direct the respondent to take suitable measures to ensure that illegal immigrants are not able to take such benefits.

(c) Retention of data beyond the period of six months is impermissible. Therefore, Regulation 27 of Aadhaar (Authentication) Regulations, 2016 which provides archiving data for a period of five years is struck down.

(d) Section 29 in fact imposes a restriction on sharing information and is, therefore, valid as it protects the interests of Aadhaar number holders. However, apprehension of the petitioners is that this provision entitles Government to share the information 'for the purposes of, as may be specified by regulations'. The Aadhaar (Sharing of Information) Regulations, 2016, as of now, do not contain any such provision. If a provision is made in the regulations which impinges upon the privacy rights of the Aadhaar card holders that can always be challenged.

(e) Section 33(1) of the Act prohibits disclosure of information, including identity information or authentication records, except when it is by an order of a court not inferior to that of a District Judge. We have held that this provision is to be read down with the clarification that an individual, whose information is sought to be released, shall be afforded an opportunity of hearing. If such an order is passed, in that eventuality, he shall also have right to challenge such an order passed by approaching the higher court. During the hearing before the concerned court, the said individual can always object to the disclosure of information on accepted grounds in law, including Article 20(3) of the Constitution or the privacy rights etc.

(f) Insofar as Section 33(2) is concerned, it is held that disclosure of information in the interest of national security cannot be faulted with. However, for determination of such an eventuality, an officer higher than the rank of a Joint Secretary should be given such a power. Further, in order to avoid any possible misuse, a Judicial Officer (preferably a sitting High Court Judge) should also be associated with. We may point out that such provisions of application of judicial mind for arriving at the conclusion that disclosure of information is in the interest of national security, are prevalent in some jurisdictions. In view thereof, Section 33(2) of the Act in the present form is struck down with liberty to enact a suitable provision on the lines suggested above.

(g) Insofar as Section 47 of the Act which provides for the cognizance of offence only on a complaint made by the Authority or any officer or person authorised by it is concerned, it needs a suitable amendment to include the provision for filing of such a complaint by any individual/victim as well whose right is violated.

(h) Insofar as Section 57 in the present form is concerned, it is susceptible to misuse inasmuch as: (a) It can be used for establishing the identity of n individual 'for any purpose'. We read down this provision to mean that such a purpose has to be backed by law. Further, whenever any such "law" is made, it would be subject to judicial scrutiny. (b) Such purpose is not limited pursuant to any law alone but can be done pursuant to 'any contract to this effect' as well. This is clearly impermissible as a contractual provision is not backed by a law and, therefore, first requirement of proportionality is not met. (c) Apart from authorising the State, even 'any body corporate or person' is authorised to avail authentication services which can be on the basis of purported agreement between an individual and such body corporate or person. Even if we presume that legislature did not intend so, the impact of the aforesaid features would be to enable commercial exploitation of an individual biometric and demographic information by the private entities. Thus, this part of the provision which enables body corporate and individuals also to seek authentication, that too on the basis of a contract between the individual and such body corporate or person, would impinge upon the right to privacy of such individuals. This part of the section, thus, is declared unconstitutional.

(i) Other provisions of Aadhaar Act are held to be valid, including Section 59 of the Act which, according to us, saves the pre-enactment period of Aadhaar project, i.e. from 2009-2016.
 

(5) Whether the Aadhaar Act defies the concept of Limited Government, Good Governance and Constitutional Trust?

Answer: Aadhaar Act meets the concept of Limited Government, Good Governance and Constitutional Trust.
 

(6) Whether the Aadhaar Act could be passed as 'Money Bill' within the meaning of Article 110 of the Constitution?

Answer: (a) We do recognise the importance of Rajya Sabha (Upper House) in a bicameral system of the Parliament. The significance and relevance of the Upper House has been succinctly exemplified by this Court in Kuldip Nayar's case. The Rajya Sabha, therefore, becomes an important institution signifying constitutional federalism. It is precisely for this reason that to enact any statute, the Bill has to be passed by both the Houses, namely, Lok Sabha as well as Rajya Sabha. It is the constitutional mandate. The only exception to the aforesaid Parliamentary norm is Article 110 of the Constitution of India. Having regard to this overall scheme of bicameralism enshrined in our Constitution, strict interpretation has to be accorded to Article 110. Keeping in view these principles, we have considered the arguments advanced by both the sides.

(b) The petitioners accept that Section 7 of the Aadhaar Act has the elements of 'Money Bill'. The attack is on the premise that some other provisions, namely, clause 23(2)(h), 54(2)(m) and 57 of the Bill (which corresponds to Sections 23(2)(h), 54(2)(m) and 57 of the Aadhaar Act) do not fall under any of the clauses of Article 110 of the Constitution and, therefore, Bill was not limited to only those subjects mentioned in Article 110. Insofar as Section 7 is concerned, it makes receipt of subsidy, benefit or service subject to establishing identity by the process of authentication under Aadhaar or furnish proof of Aadhaar etc. It is also very clearly declared in this provision that the expenditure incurred in respect of such a subsidy, benefit or service would be from the Consolidated Fund of India. It is also accepted by the petitioners that Section 7 is the main provision of the Act. In fact, introduction to the Act as well as Statement of Objects and Reasons very categorically record that the main purpose of Aadhaar Act is to ensure that such subsidies, benefits and services reach those categories of persons, for whom they are actually meant.

(c) As all these three kinds of welfare measures are sought to be extended to the marginalised section of society, a collective reading thereof would show that the purpose is to expand the coverage of all kinds of aid, support, grant, advantage, relief provisions, facility, utility or assistance which may be extended with the support of the Consolidated Fund of India with the objective of targeted delivery. It is also clear that various schemes which can be contemplated by the aforesaid provisions, relate to vulnerable and weaker section of the society. Whether the social justice scheme would involve a subsidy or a benefit or a service is merely a matter of the nature and extent of assistance and would depend upon the economic capacity of the State. Even where the state subsidizes in part, whether in cash or kind, the objective of emancipation of the poor remains the goal.

(d) The respondents are right in their submission that the expression subsidy, benefit or service ought to be understood in the context of targeted delivery to poorer and weaker sections of society. Its connotation ought not to be determined in the abstract. For as an abstraction one can visualize a subsidy being extended by Parliament to the King; by Government to the Corporations or Banks; etc. The nature of subsidy or benefit would not be the same when extended to the poor and downtrodden for producing those conditions without which they cannot live a life with dignity. That is the main function behind the Aadhaar Act and for this purpose, enrolment for Aadhaar number is prescribed in Chapter II which covers Sections 3 to 6. Residents are, thus, held entitled to obtain Aadhaar number. We may record here that such an enrolment is of voluntary nature. However, it becomes compulsory for those who seeks to receive any subsidy, benefit or service under the welfare scheme of the Government expenditure whereof is to be met from the Consolidated Fund of India. It follows that authentication under Section 7 would be required as a condition for receipt of a subsidy, benefit or service only when such a subsidy, benefit or service is taken care of by Consolidated Fund of India. Therefore, Section 7 is the core provision of the Aadhaar Act and this provision satisfies the conditions of Article 110 of the Constitution. Upto this stage, there is no quarrel between the parties.

(e) On examining of the other provisions pointed out by the petitioners in an attempt to take it out of the purview of Money Bill, we are of the view that those provisions are incidental in nature which have been made in the proper working of the Act. In any case, a part of Section 57 has already been declared unconstitutional. We, thus, hold that the Aadhaar Act is validly passed as a 'Money Bill'.
 

(7) Whether Section 139AA of the Income Tax, 1961 is violative of right to privacy and is, therefore, unconstitutional?

Answer: Validi