Linking Aadhaar, voter ID: Path to a ‘Delhi Analytica’, 'Mumbai Analytica’?

The history of Aadhaar-related matters in the last seven years has important lessons when it comes to ‘mandatory-voluntary’ rhetoric

The Lok Sabha has passed the bill to amend the Representation of People Act, 1951. The bill provides for the linking of voter IDs with Aadhaar cards, ostensibly on a voluntary basis. Earlier, in 2015, the Electoral Commission of India (ECI) had managed to link the Aadhaar numbers of nearly 38 crore voters, before the Supreme Court put a stop to the exercise.

In its interim order, the apex court had explicitly prohibited the use of Aadhaar for any purpose other than State-facilitated welfare schemes aiming to distribute food grains and cooking fuel such as kerosene and LPG. Voting is a constitutional right, and can by no means be considered a welfare benefit.

While the linking is touted as being voluntary, the short history of Aadhaar-related matters in the last seven years teaches us important lessons when it comes to ‘mandatory-voluntary’ rhetoric. The government has throughout insisted on linking Aadhaar to everything from the PAN card and bank accounts to even school admissions, backing off only in the face of the Supreme Court’s ruling on Aadhaar. The new bill has revived concerns surrounding privacy and voter profiling.

The single most problematic aspect of the move is that no information has been revealed in relation to the extent to which data-sharing will occur between the Aadhaar and the Electors Photo Identification Card (EPIC) databases. No procedures through which the consent of the individual whose data is being shared can be obtained have been outlined either. If all data is indeed shared between the databases, and such sharing is done without the consent of the concerned individual, then the resulting consequences for one’s constitutionally guaranteed right to privacy will be disastrous.

The process of obtaining an Aadhaar number often requires the provision of demographic information, such as one’s caste certificate. Such information, if shared with the EPIC database, can be appropriated and can lead to targeted political advertising, disenfranchisement based on identity, commercial exploitation of one’s private sensitive data and increased surveillance.

In the past, there have been instances of targeted surveillance using Aadhaar and demographic data. For instance, a website operated by the Andhra Pradesh state government facilitated tracking the locations of several families using religion and caste as search criteria. The Cambridge Analytica scandal already confirmed the worst of our nightmares by demonstrating the impact that voter profiling can have on democracy. Commenting on the consequences of the linkage between the two databases, Justice B N Srikrishna earlier stated that the link will invariably lead to instances of ‘Delhi Analytica’, ‘Mumbai Analytica’, ‘Kolkata Analytica’, and so on.

To ensure that such a situation does not come to pass, the government should have first got the Personal Data Protection (PDP) bill passed, before pursuing the Aadhaar-voter ID integration. What’s more, the UIDAI has recently sought an exemption from the PDP bill. The PDP regime must apply to government entities and require them to obtain the explicit consent of an individual before sharing their data across the government (between the Election Commission of India and the UIDAI, in this case). Citizens would also benefit by incorporating the principle of data minimisation in such sharing. This principle would require the data controller to limit the cross-database sharing of any personal demographic data to only that which is directly relevant and, more importantly, necessary to accomplish a particular purpose.

Now, the primary rationale that the government has provided for pursuing the linking is to preserve the sanctity of the voting ecosystem by eliminating multiple enrolments. The government argues that purifying the electoral rolls is a precondition for free and fair elections, and so privacy concerns are rebutted by playing up the ‘public interest’ card. However, it is important to realise that the bill might destroy the very sanctity it purportedly seeks to preserve.

The Unique Identification Authority of India (UIDAI) has admitted that it possesses no information regarding the enrolment operator, agency, or registrar for each Aadhaar number. Neither does it have any information about the primary documents that were used to establish the identity, address, age, etc., of the person allotted an Aadhaar number. This raises questions about the possibility of dubious enrolment practices. There also exist valid concerns regarding the security of the Aadhaar database, which several experts argue is prone to data leaks.

The validity of voter IDs that are authenticated by Aadhaar numbers, which can be dubiously created, then comes under question. Before embarking on such an authentication process, we must first verify the Aadhaar number being used to verify one’s voter ID. Unless this is achieved, the bill’s intended aim will be undermined and the electoral rolls will be tainted.

There is also the question of voter deletion that needs to be addressed. In 2015, the Telangana State Election Commission utilised Aadhaar-based software to expel bogus voters from the system. This resulted in the exclusion of lakhs of voters from the electoral process. The Chief Electoral Officer of the state claimed that the majority of the exclusions were genuine. However, several lakhs of voters were still unjustly disenfranchised. The main reason for this was the fact that mandatory door-to-door verification was not carried out prior to the deletion of the voters from the database. It is not clear yet if the government plans to delete those voter IDs which cannot be authenticated on the basis of the Aadhaar number alone. It must not be so.

(The writer is a student at the National Academy of Legal Studies and Research, Hyderabad)