Aadhaar and Digital Identity — Revision Notes

⚡ 30-Second Revision

Aadhaar: 12-digit unique ID for Indian residents.
Issued by: UIDAI (Unique Identification Authority of India).
Legal Basis: Aadhaar Act, 2016.
Data: Demographic + Biometric (10 fingerprints, 2 iris, photo).
Storage: Central Identities Data Repository (CIDR).
SC Judgment (Puttaswamy 2018): Upheld Act, but struck down Section 57 (private use).
Mandatory Use: Only for welfare schemes from Consolidated Fund of India (Section 7).
Voluntary Use: For private services (post-2019 amendment).
Privacy: Right to Privacy (Article 21) affirmed.
Key Features: De-duplication, eKYC, AePS, Virtual ID (VID), offline verification.

2-Minute Revision

Aadhaar is India's foundational digital identity, a 12-digit unique number issued by the statutory body UIDAI under the Aadhaar Act, 2016. It relies on both demographic and biometric data, stored securely in the Central Identities Data Repository (CIDR), to ensure 'one person, one identity'.

The Supreme Court's Justice K.S. Puttaswamy judgment (2018) was a watershed moment, upholding the Act's constitutional validity but significantly restricting its mandatory application to welfare schemes funded by the Consolidated Fund of India (Section 7).

It struck down Section 57, prohibiting private entities from mandating Aadhaar, thereby reinforcing the fundamental right to privacy. Subsequent amendments (2019) introduced voluntary Aadhaar use for private services and privacy-enhancing features like Aadhaar Virtual ID (VID) and offline verification.

Aadhaar has been instrumental in 'financial inclusion through technology' (e.g., Jan Dhan, AePS) and efficient welfare delivery via Direct Benefit Transfer (DBT), reducing leakages. However, concerns persist regarding privacy, data security, and potential exclusion, necessitating a continuous balance between digital convenience and individual rights.

5-Minute Revision

Aadhaar, a cornerstone of India's 'Digital India Mission overview' , is a 12-digit unique identification number issued to residents by the Unique Identification Authority of India (UIDAI), established under the Aadhaar Act, 2016.

Its core architecture involves collecting demographic and biometric data (10 fingerprints, 2 iris scans, facial photograph) which is then securely stored in the Central Identities Data Repository (CIDR).

The CIDR employs advanced encryption and de-duplication processes to ensure uniqueness and prevent identity fraud. Aadhaar facilitates various authentication methods, including biometric (fingerprint, iris), One-Time Password (OTP), and newer privacy-centric options like Aadhaar Virtual ID (VID) and offline QR-based verification.

The legal landscape of Aadhaar was profoundly shaped by the Supreme Court's Justice K.S. Puttaswamy (2018) judgment. This landmark ruling upheld the constitutional validity of the Aadhaar Act but, crucially, affirmed the fundamental 'right to privacy analysis' under Article 21.

The Court applied a 'proportionality test', allowing mandatory Aadhaar linking only for welfare schemes drawing funds from the Consolidated Fund of India (Section 7) to ensure targeted delivery and reduce leakages.

Conversely, it struck down Section 57, prohibiting private entities from mandating Aadhaar for services like banking or telecom. The Aadhaar and Other Laws (Amendment) Act, 2019, subsequently codified these changes, allowing voluntary use of Aadhaar for private services with consent and strengthening privacy safeguards.

Aadhaar's practical applications are vast, driving 'financial inclusion through technology' through initiatives like Jan Dhan-Aadhaar-Mobile (JAM) trinity, Aadhaar-enabled Payment System (AePS), and eKYC.

It has significantly improved the efficiency of welfare delivery via Direct Benefit Transfer (DBT), reducing corruption and ensuring benefits reach genuine beneficiaries. However, the system faces criticism regarding privacy concerns (centralized data, potential for surveillance), data security vulnerabilities (especially at endpoints), and issues of exclusion for individuals facing biometric failures or lacking digital literacy.

The ongoing evolution of data protection laws, such as the Digital Personal Data Protection Act, 2023, aims to address these challenges, ensuring a robust framework for 'cybersecurity in digital governance' and balancing state efficiency with individual rights.

Prelims Revision Notes

1
Aadhaar Basics: — 12-digit unique ID, issued by UIDAI (statutory body under MeitY). Not proof of citizenship, only residency. Randomly generated, no intelligence.
2
Aadhaar Act, 2016: — Legal framework. Passed as a Money Bill.

* Section 3: Entitlement for residents. * Section 7: Mandatory for welfare benefits from Consolidated Fund of India (UPHELD by SC). * Section 8: Authentication process. * Section 29: Core biometrics not shared. * Section 57: Private entities mandating Aadhaar (STRUCK DOWN by SC).

1
Justice K.S. Puttaswamy (2018) Judgment:

* Upheld Aadhaar Act's constitutional validity with modifications. * Affirmed Right to Privacy (Article 21) as fundamental. * Applied Proportionality Test. * Mandatory linking only for Section 7 services. * No child denied benefits for lack of Aadhaar.

1
Aadhaar and Other Laws (Amendment) Act, 2019:

* Allowed VOLUNTARY use for private entities (banks, telecom) with consent. * Introduced Aadhaar Virtual ID (VID) and offline verification.

1
Technical Architecture:

* Data: Demographic (name, DoB, address, gender) + Biometric (10 fingerprints, 2 iris, facial photo). * CIDR: Central Identities Data Repository – highly secure, encrypted, centralized database. * De-duplication: Biometric matching to ensure uniqueness. * Authentication: 1:1 verification (biometric/OTP), 1:N de-duplication.

1
Key Applications:

* Financial Inclusion: Jan Dhan, AePS (Aadhaar-enabled Payment System), eKYC. * Welfare Delivery: DBT (Direct Benefit Transfer) for PDS, LPG, MGNREGA, pensions. * Taxation: Linking with PAN.

1
Privacy Enhancements: — VID, offline eKYC, tokenization.
2
UIDAI: — Statutory body, responsible for enrollment, authentication, CIDR management, security.
3
Concerns: — Privacy, exclusion (biometric failures), data security (at endpoints), function creep.

Mains Revision Notes

1
Introduction: — Aadhaar as a digital identity system, its role in Digital India, and the inherent tension between efficiency/inclusion and privacy.
2
Evolution of Legal Framework:

* Initial executive order. * Aadhaar Act, 2016: Statutory backing, Money Bill controversy, key sections (7, 29, 57). * Justice K.S. Puttaswamy (2018) Judgment: Landmark ruling, Right to Privacy (Article 21), Proportionality Test. Upholding Section 7 (welfare), striking down Section 57 (private). * Aadhaar and Other Laws (Amendment) Act, 2019: Post-SC changes, voluntary private use, VID, offline verification.

1
Technical Robustness:

* CIDR: Centralized, secure, encrypted (AES-256), biometric templates (not raw images). * Authentication Mechanisms: Biometric, OTP, offline (QR, VID). Real-time, high SLA. * De-duplication: Core for 'one person, one identity'. * Security Protocols: Multi-layered, ISO 27001, access controls.

1
Impact & Benefits:

* Financial Inclusion: JAM trinity, eKYC, AePS, bringing unbanked into formal economy. * Welfare Delivery: DBT, reduced leakages, elimination of ghost beneficiaries, improved targeting, transparency. * Governance: Paperless, presence-less, cashless transactions, improved service delivery.

1
Challenges & Concerns:

* Privacy: Centralized data, potential for surveillance, profiling, function creep. * Exclusion: Biometric failures, lack of digital literacy/access, denial of services. * Security: Vulnerabilities at 'last mile' (enrollment/authentication devices), data breaches from linked databases. * Ethical: Balancing state interest vs. individual rights, algorithmic bias.

1
Way Forward/Recommendations:

* Robust data protection law (DPDP Act, 2023) implementation. * Strengthening grievance redressal mechanisms. * Continuous technological upgrades and 'cybersecurity in digital governance' . * Ensuring alternative identification options for vulnerable groups. * Promoting privacy-enhancing technologies (VID, offline eKYC).

1
Vyyuha Analysis: — Aadhaar as a 'Digital Social Contract' – trade-offs between convenience/inclusion and privacy/surveillance.
2
Inter-topic Connections: — Digital India, e-governance, financial inclusion, cybersecurity, fundamental rights.

Vyyuha Quick Recall

The 'AADHAAR Framework' for understanding Aadhaar:

Authentication: Real-time verification using biometrics/OTP.
Authorization: Consent-based data sharing for specific services.
Data protection: Strict safeguards for CIDR, no sharing of core biometrics.
Hybrid model: Mandatory for welfare, voluntary for private services.
Accountability: UIDAI's role and legal framework for redressal.
Access rights: Entitlement to obtain Aadhaar, access to services.
Regulatory oversight: SC judgments, Aadhaar Act, UIDAI guidelines.