Data theft: on UIDAI exposé 

Data theft: on UIDAI exposé 

Context

The UIDAI exposé is another reminderof the need for a robust data protection law

The UIDAI exposé is another reminder of the need for a robust data protection law

Undercover investigations or so-called sting operations occupy a complex and problematical ethical space in journalism, but it is impossible to fault The Tribune’s exposé, published after accessing Aadhaar’s database of names, numbers and addresses

Public interest outweighs the act of unauthorised access

To begin with, the public interest — which lay in showing how easily the database could be breached and drawing attention to the existence of an organised racket to facilitate this — far outweighed, or more than compensated for, the act of unauthorised access, in this case secured on payment of a few hundred rupees

In the best journalistic tradition

The investigation was written up in the best journalistic tradition — it focussed on how the data were being mined for money, it did not leak any Aadhaar numbers or other details to establish this, and it sought and received a response from shocked officials of the Unique Identification Authority of India before going to print

Would have been a Travesty of Justice

It would have constituted a direct attack on free public-spirited journalism and dissuaded attempts to hold public authorities and institutions accountable for shortcomings and promises.

Encrypted Aadhaar biometric database has not been compromised

Given the noisy hubbub and the misinformation about what was breached, it is perhaps important to stress that the encrypted Aadhaar biometric database has not been compromised

UIDAI: No misuse without obtaining biometric data

The UIDAI is correct in stating that mere information such as phone numbers and addresses (much of which is already available to telemarketers and others from other databases) cannot be misused without biometric data

Aadhaar project isn’t compromised

The suggestion that the entire Aadhaar project has been compromised is therefore richly embroidered.

Precautions should be taken

But even so, it is obligatory for those who collect such information — whether it is the government or a private player such as a mobile company — ought to see that it is secure and not used for purposes other than that for which it was collected

Need a legal framework for data protection

In this digital age, a growing pool of personal information that can be easily shared has become available to government and private entities. India does not have a legal definition of what constitutes personal information and lacks a robust and comprehensive data protection law

Conclusion

We need to have both quickly in place if the Supreme Court’s judgment according privacy the status of a fundamental right is to have any meaning.