Private firms using Aadhaar data for e-KYC try to clear legal fog

Even as Supreme Court's (SC) Aadhaar verdict is being digested by all, there is utter confusion over how the striking down of Section 57 can be read and whether there was still hope for private companies to use Aadhaar for electronic-know your customer (e-KYC).

Rahul Narayan, SC lawyer, claimed that even though the judgement clearly bars the use of Aadhaar by private firms, few sections of the corporate and legal sector believe there was some scope for interpretation.

"People are saying there is some scope for interpretation. The government is trying to do something to see how companies can do e-KYC again. It (government) is evaluating, and fintech companies are also talking to it to see whether something can be done to revive the use (of Aadhaar for customer verification)," he told DNA Money.

Narayan, however, was very sure that any legislation or guidelines brought out by the government would not survive the Constitutional challenge.

The Section 57 of the Aadhaar Act allowed private entities, in addition to the state, to use the 12-digit unique ID under Aadhaar for "establishing the identity of an individual for any purpose", pursuant to law or any contract to this effect, subject to the requirement of informed consent under Section 8 and protection of information under chapter VI of the Act.

Now that this section of the Act has been struck down by the apex court, private companies will not be able to use the unique ID number for customer authentication.

Nayaran, along with his colleague Brinda Bhandari, is very clear that enactment of any law to resume usage of Aadhaar by private sector would be seen as "unconstitutional" in the light of last week's court order.

"While there has been some speculation about whether a new law could be enacted to allow use of Aadhaar by private players again, we believe that on a holistic reading of the judgment, it is clear that all five judges agree that the use of Aadhaar authentication by private entities ("body corporate or person") is now unconstitutional. Hence, it cannot be resurrected through legislation," the duo wrote in an article for an online news portal.

According to the two advocates, some private parties could hope for the observations of justice Sikri in para 367 of the majority opinion coming to their rescue, "and that a new law could permit private persons to use Aadhaar authentication to establish identity".

Both saw some scope for interpretation in Justice Sikri's comments in para 367: "respondents may be right in their explanation that it is only an enabling provision….. If such a person voluntary wants to offer Aadhaar card as a proof of his/her identity, there may not be a problem."

"The parliament may enact a law specifying the purposes for which Aadhaar numbers may be used by the state, which will be subject to judicial scrutiny. However, for the reasons elaborated below, any law extending this facility to private persons would be tantamount to re-enacting a law that has been struck down, and would be held to be unconstitutional," said Narayan and Bhandari in their write-up.

Khushroo Panthaky, senior partner, Walker Chandiok & Co LLP, said while the Aadhaar was economical and efficiency driven means of ID verification, it will not be difficult for companies to switch over to alternative methods with so many other documents for authentication available – 10-digit Permanent Account Number (PAN) card, passport, driving license, voter ID and others.

He said companies may also have to incur the cost for deleting Aadhaar details with them if they were mandated to do so.

"Banks (and others companies with Aadhaar data) are also supposed to erase this (Aadhaar) information. That could be a cost too. I don't know how much it would be but I'm sure it'll be tedious process," he said.

Rajan S Mathews, director general, Cellular Operators Association of India (COAI), said operators were looking to the Department of Telecommunications (DoT), along with the Ministry of Home Affairs (MHA), to define secure ways to do KYC that can deal with counterfeit documents, high operational costs, customer privacy, etc.

"This is how Aadhaar-based e-KYC came about. Now that the SC has issued its order on Aadhaar, the operators will await new instructions from the DoT. The industry is reviewing the order but believes Aadhaar based e-KYC is the best method to ensure security, avoid counterfeiting and provide ease of doing business," he told DNA Money.

He dismissed any concern over sensitive Aadhaar data with telecom companies; "operators maintain no sensitive bio-metric data on customers. Only name, address and gender which would have been obtained anyway through a paper based KYC. Whether operators retain or need to remove the Aadhar number stored with them is a matter to be resolved by the DoT. No costs to remove this has been determined".

Mahesh Uppal, director with telecom consultancy firm ComsFirst Consultancy, did not see the ban on the use of Aadhaar by private companies as a "looming crisis".

"I don't see it as a crisis. After all, there was life before Aadhaar, and there will be life after it too. Telecom industry was very supportive of Aadhaar because it did help them with the verification process. It did reduce the cost and time involved. So, they were happy and now they would be disappointed that they can no longer access the Aadhaar for customer verification. But this is certainly not a looming crisis," he said.

He said the process to come out with a legislation to allow private firms to access Aadhaar data will take at least a year.

"We don't know whether this (come out with a law) is something that the government will attempt. Whatever happens, we are talking of at least a year – from the point some kind of bill is drafted, discussed, gone through revisions, introduction in the parliament to the final enactment of the law," he said.

Meanwhile, he said based on the court's direction, private sector verification by Aadhaar will have to stop.

Shivam Thakral, co-founder and CEO of BuyUcoin, who was using Aadhaar details to verify investors on his cryptocurrency platform, said companies like his were already gearing up to collaborate with a third-party organisation for physical verification of their customers.

"Physical verification requires large resources. Since our business is down after recent adverse regulatory development in the market, spending so much on verification will not be viable right now. So, we will try to partner with a third-party organisation which can do our physical verification. Most small companies will get it done through a third party while bigger companies will set up a team for it," he said.