Privacy Concerns with the Use of Aadhaar for Banking and Financial Services

Introduction

The Aadhaar, a program launched by the Indian government aims to provide a unique identification number to every resident/citizen of India, linking their demographic and biometric information. Aadhaar, India's unique identification system, has streamlined various administrative processes but its integration with banking and financial services has raised privacy concerns. This blog explores Aadhaar's use in the financial sector, associated privacy issues, the regulatory framework, and potential solutions.

Aadhaar and its Use in Banking and Financial Institutions

Aadhaar's 12-digit number is widely used for identity verification in banking. The e-KYC process leverages Aadhaar to simplify customer onboarding and reduce operational costs. However, this integration poses privacy risks, particularly regarding the collection and storage of sensitive biometric data, and therefore, the centralised repository of personal information becomes a target for cybercriminals.

Major Privacy Concerns

Integrating Aadhaar with banking and financial services improves efficiency and reduces fraud, however, it also raises significant privacy concerns. Users and policymakers need to understand these issues to protect personal information.

• Unauthorised Access to Biometric Data: Aadhaar collects sensitive biometric information, such as fingerprints and iris scans. Unauthorized access to this data can lead to severe privacy violations. If biometric data is compromised, it can be used for identity theft and fraud. Unlike passwords, biometric data cannot be changed, making it crucial to protect this information.
• Centralised Repository of Personal Information: Aadhaar information is stored in a centralised database that has a vast amount of personal information. This makes it a prime target for cyberattacks. Any breach can result in the exposure of millions of individuals' personal information.
• Linking Aadhaar with Multiple Services: The government’s mission to link Aadhaar with various services (bank accounts, mobile numbers, etc.) has raised privacy concerns about the data being accessed and misused across different platforms.
• Mandatory Linking and Privacy Rights: Mandatory linking of Aadhaar raises concern because it provides sensitive biometric and demographic data to multiple service providers. Although the Supreme Court has restricted the mandatory linking of Aadhaar to certain services, many institutions still require it. This can infringe on individuals' privacy rights and lead to unauthorised use of their personal data.
• Potential for Misuse by Service Providers: Service providers may misuse Aadhaar data for identity theft. They can use stolen Aadhaar information to impersonate individuals, open fraudulent accounts, or carry out financial transactions in their names.
• Insufficient Data Protection Measures: Despite several regulatory frameworks, there are still gaps in the data protection measures governing Aadhaar. These gaps can result in inadequate safeguards for personal information.
• Surveillance and Profiling Risks: Aadhaar’s extensive database could be used for mass surveillance to track one’s movement or activities without their knowledge or consent infringing on one’s privacy rights.
  

How we can protect our data :

1. Lock Your Aadhaar Biometrics- The Unique Identification Authority of India (UIDAI) allows users to lock their biometrics to prevent unauthorised access. By locking your biometrics, you can ensure that no one can misuse your fingerprint or iris data for authentication.
2. Masked Aadhaar- A masked Aadhaar number displays only the last four digits of your Aadhaar number, concealing the full number. This version can be used for eKYC and other purposes, reducing the risk of identity theft.
3. Monitor Your Aadhaar Authentication History: Aadhaar authentication history provides detailed authentication logs for Aadhaar authentication performed by the individual resident in the last 6 months and a maximum of 50 records can be viewed at once. Regular monitoring of the Aadhaar authentication history will keep one aware of any suspicious activity which can be reported immediately.
4. Enable Virtual ID (VID)- The VID is a temporary, revocable 16-digit number that can be used instead of your Aadhaar number for authentication. It helps minimise the exposure of your actual Aadhaar number and enhances privacy.
5. Update Your Mobile Number and Email: Ensure that your current mobile number and email are linked to your Aadhaar. This allows you to receive alerts and notifications about any changes or transactions related to your Aadhaar, enabling prompt action in case of any unauthorised activity.
6. File a Complaint with UIDAI: UIDAI has a grievance redressal mechanism through which individuals can lodge their complaints in case of any misuse or privacy breach related to their Aadhaar.
7. Be Aware of Phishing Scams: Phishing scams can trick you into revealing your Aadhaar details. One should always verify the authenticity of the request before sharing Aadhaar information, and avoid clicking on suspicious links or sharing details over the phone or email.

Regulatory Framework

To address the privacy concerns associated with Aadhaar, the Indian government has implemented several regulatory measures.

• Aadhaar Act, 2016: This Act governs the use of Aadhaar and outlines provisions for data security and privacy. It mandates that Aadhaar data cannot be shared without consent, except under specific circumstances. It specifically prohibits UIDAI from controlling, collecting, storing, or maintaining any information regarding the purpose of authentication, either directly or through any entity.
• Reserve Bank of India (RBI) Guidelines: RBI guidelines streamline the use of Aadhaar for e-KYC, emphasising the voluntary linking of Aadhaar with bank accounts. Banks must implement robust data protection measures, including encryption and secure storage. It also allows Aadhaar masking, a process of hiding the first 8 digits of one’s Aadhaar number.
• Digital Personal Data Protection Act, 2023: This Act regulates the processing of digital personal data, balancing individuals' right to protect their personal data with lawful processing needs, and other related matters.
• Constitutional Protections: The Supreme Court in Justice K.S. Puttaswamy and Anr. v. UOI and Anr. AIR 2018 SC (SUPP) 1841 recognises privacy as a fundamental right under Article 21 of the Indian Constitution, providing a constitutional safeguard against personal data misuse. It mandates that any privacy invasion must be lawful, necessary, and proportionate.

Conclusion

Aadhaar's integration with banking and financial services raises privacy concerns regardless of its benefits. Individuals can protect their data with features like biometric locking and masked Aadhaar. The Aadhaar Act, RBI guidelines and constitutional protection, provide a framework to safeguard privacy. Policymakers must continue to enhance these measures to ensure Aadhaar's secure and responsible use in the financial sector.

References

1. THE AADHAR (TARGETED DELIVERY OF FINANCIAL AND OTHER SUBSIDIES, BENEFITS AND SERVICES) ACT, 2016 NO. 18 OF 2016

2. THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 (NO. 22 OF 2023)

3. Justice K.S. Puttaswamy and Anr. v. UOI and Anr. AIR 2018 SC (SUPP) 1841

4. RBI Master Direction - Know Your Customer (KYC) Direction, 2016