Leak of Aadhaar data

Why in news?

A reporter of The Tribune newspaper exposed breach in Aadhaar database.

What were the findings?

• The report had exposed that it got access through an "agent" to Aadhaar details of any individual submitted to the UIDAI.
• The details included name, address, postal code (PIN), photo, phone number and email.
• The report had also claimed that it took just Rs 500 and 10 minutes for the newspaper to get access to the above.

How has UIDAI responded?

• The Unique Identification Authority of India (UIDAI) has filed an FIR against the journalist.
• It has filed a criminal complaint naming the journalist of The Tribune and others.
• It justified that criminal proceedings have been initiated for the act of unauthorised access.
• Accordingly, FIR has been registered for violations of the sections of Aadhaar Act, 2016, the IT Act and under the IPC.
• UIDAI has responded that it was “duty bound” to place all facts before the police.
• So, names mentioned in the FIR are just details of the incident and does not necessarily mean they are culprits.
• UIDAI has also firmly denied that it was trying to gag the media or the whistle-blowers.

Why is the claim overstated?

• It is important to stress that the encrypted Aadhaar biometric database has not been compromised.
• The UIDAI is correct in stating that mere information such as phone numbers and addresses cannot be misused without biometric data.
• Moreover these details are already available to telemarketers and others from other databases.
• The suggestion that the entire Aadhaar project has been compromised is therefore overstated and false.

What is the significance?

• Public interest - Undercover investigations or sting operations occupy a complex and problematical ethical space in journalism.
• But it is impossible to fault The Tribune's recent unveiling of database breach.
• UIDAI's criminal complaint is thus criticised for suppressing a journalist whose investigation reports was of great public interest.
• Data protection - The issue has drawn attention to the existence of an organised racket to facilitate unauthorised access to data.
• The UIDAI expose has again highlighted the long felt need for a robust data protection law.
• Freedom - Accusing The Tribune and the reporter would constitute a direct attack on free public-spirited journalism.
• It would also dissuade attempts to hold public authorities and institutions accountable for shortcomings and promises.

What should be done?

• It is obligatory for those who collect information to see that it is secure and not used for purposes other than that meant for.
• This applies to both the government and private players such as a mobile company.
• India does not have a legal definition of what constitutes personal information.
• It also lacks a robust and comprehensive data protection law.
• Having accorded privacy the status of fundamental right, it is logical to bring in place the above two legal specifications.

Source: The Hindu