Aadhaar is here to stay, cyber experts say

The Supreme Court judgement has been hailed by one and all but it leaves a hole big enough for Aadhaar to slide through, cyber security experts said.

While Thursday's historic ruling offers netizens some amount of control over their data, the condition of "reasonable restrictions" the judgement imposes might keep the door open for the elephant to pass through, thereby diluting the impact of the ruling on safeguards against biometric data theft.

"There is a phrase 'with reasonable restrictions' in the ruling while terming Right to Privacy an intrinsic part of Right to Life and Personal Liberty under Article 21. So, I am not overly excited purely because such restrictions could mean letting in Aadhaar, thereby defeating the whole purpose of upholding privacy," Ankush Johar, director of BugsBounty.com, a crowd-sourced security platform for ethical hackers and organisations, told DNAMoney.

While Thursday's ruling didn't say whether linking Aadhaar to financial transactions would lead to infringement of privacy — that's a decision to be made later by another bench of the Supreme Court — it's understood that the verdict would have a bearing on the upcoming verdict, the experts believe.

"The Indian market is most vulnerable to data breach and cyber threats. Recently we have seen major cases concerning threats to cyber security in India. Due to immense migration towards the use of technology, this landmark Supreme Court ruling on privacy will give users control over their data," says Ram Punamaraju, chief executive officer, Yitsol, a cyber security provider.

But not when it comes to your 12-digit identifier. Aadhaar is being brought in without putting the right checks and balances, Johar said. While the Unique Identification Authority of India, or UIDAI, keeps sending directives to handlers of Aadhaar data, such as banks, on how to safeguard data, these are merely advisories and it's entirely up to the organisations to follow them.

In the absence of penalties for data breach, however, India's effort to ensure data protection and privacy would make little headway. A glance across the globe reveals that administrations are tightening the noose around those violating data laws. The European Union, for instance, has brought in the concept of General Data Protection Regulations , which, from 2018, would penalise organisations or companies 20 million euros or 4 per cent of their global annual turnover, whichever is higher, in case of data breach.

"If, say, Air India, which handles data of European fliers, suffers breach of a single customer, it might have to shell out such a penalty. This would potentially force all Indian bodies handling EU data to be very careful about maintaining privacy of customer data," Johar said.

In any case, the ruling would lead to wider adoption of digital services leading to the ultimate move towards a digital economy, believes Aniketh Jain, CEO and co-founder of Solutions Infini, a communications solutions outfit. "Privacy has been misused to various levels of breach till date and this verdict not only protects privacy of an individual but also builds a sound, safe and invulnerable system. Building trust in the digital ecosystem was an uncompromising requisite, which the Supreme court has fulfilled by its verdict," Jain said.

REASONABLE?

• The condition of ‘reasonable restrictions’ that the Supreme Court ruling imposes is the catch
   
• Cyber security experts believe it dilutes the impact on safeguards against biometric data theft
   
• Aadhaar is being brought in without the right checks and balances in place, some techies believe