AdvocateKhoj
Login : Advocate | Client
Home Post Your Case My Account Law College Law Library
    

Supreme Court Judgments


Latest Supreme Court of India Judgments 2018

Subscribe

RSS Feed img






Justice K.S. Puttaswamy (Retd.) and Another Vs. Union of India and Others

[Writ Petition (Civil) No. 494 of 2012]

[Transferred Case (Civil) No. 151 of 2013]

[Transferred Case (Civil) No. 152 of 2013]

[Writ Petition (Civil) No. 833 of 2013]

[Writ Petition (Civil) No. 829 of 2013]

[Transferred Petition (Civil) No. 1797 of 2013]

[Writ Petition (Civil) No. 932 of 2013]

[Transferred Petition (Civil) No. 1796 of 2013]

[Contempt Petition (Civil) No. 144 of 2014 in Writ Petition (Civil) No. 494 of 2012]

[Transferred Petition (Civil) No. 313 of 2014]

[Transferred Petition (Civil) No. 312 of 2014]

[Special Leave Petition (Criminal) No. 2524 of 2014]

[Writ Petition (Civil) No. 37 of 2015]

[Writ Petition (Civil) No. 220 of 2015]

[Contempt Petition (Civil) No. 674 of 2015 in Writ Petition (Civil) No. 829 of 2013]

[Transferred Petition (Civil) No. 921 of 2015]

[Contempt Petition (Civil) No. 470 of 2015 in Writ Petition (Civil) No. 494 of 2012]

[Writ Petition (Civil) No. 231 of 2016]

[Contempt Petition (Civil) No. 444 of 2016 in Writ Petition (Civil) No. 494 of 2012]

[Contempt Petition (Civil) No. 608 of 2016 in Writ Petition (Civil) No. 494 of 2012]

[Writ Petition (Civil) No. 797 of 2016]

[Contempt Petition (Civil) No. 844 of 2017 in Writ Petition (Civil) No. 494 of 2012]

[Writ Petition (Civil) No. 342 of 2017]

[Writ Petition (Civil) No. 372 of 2017]

[Writ Petition (Civil) No. 841 of 2017]

[Writ Petition (Civil) No. 1058 of 2017]

[Writ Petition (Civil) No. 966 of 2017]

[Writ Petition (Civil) No. 1014 of 2017]

[Writ Petition (Civil) No. 1002 of 2017]

[Writ Petition (Civil) No. 1056 of 2017]

[Contempt Petition (Civil) No. 34 of 2018 in Writ Petition (Civil) No. 1014 of 2017]

A.K. SIKRI, J. (For Chief Justice, himself and A.M. Khanwilkar, J.)

Introduction and Preliminaries:

It is better to be unique than the best. Because, being the best makes you the number one, but being unique makes you the only one.

2) 'Unique makes you the only one' is the central message of Aadhaar, which is on the altar facing constitutional challenge in these petitions. 'Aadhaar' which means, in English, 'foundation' or 'base', has become the most talked about expression in recent years, not only in India but in many other countries and international bodies. A word from Hindi dictionary has assumed secondary significance. Today, mention of the word 'Aadhaar' would not lead a listener to the dictionary meaning of this word. Instead, every person on the very mentioning of this word 'Aadhaar' would associate it with the card that is issued to a person from where he/she can be identified.

It is described as an 'Unique Identity' and the authority which enrols a person and at whose behest the Aadhaar Card is issued is known as Unique Identification Authority of India (hereinafter referred to as 'UIDAI' or 'Authority'). It is described as unique for various reasons. UIDAI claims that not only it is a foolproof method of identifying a person, it is also an instrument whereby a person can enter into any transaction without needing any other document in support.

It has become a symbol of digital economy and has enabled multiple avenues for a common man. Aadhaar scheme, which was conceptualised in the year 2006 and launched in the year 2009 with the creation of UIDAI, has secured the enrolment of almost 1.1 billion people in this country. Its use is spreading like wildfire, which is the result of robust and aggressive campaigning done by the Government, governmental agencies and other such bodies. In this way it has virtually become a household symbol. The Government boasts of multiple benefits of Aadhaar.

3) At the same time, the very scheme of Aadhaar and the architecture built thereupon has received scathing criticism from a section of the society. According to them, Aadhaar is a serious invasion into the right to privacy of persons and it has the tendency to lead to a surveillance state where each individual can be kept under surveillance by creating his/her life profile and movement as well on his/her use of Aadhaar. There has been no other subject matter in recent past which has evoked the kind of intensive and heated debate wherein both sides, for and against, argue so passionately in support of their respective conviction.

The petitioners in these petitions belong to the latter category who apprehend the totalitarian state if Aadhaar project is allowed to continue. They are demanding scrapping and demolition of the entire Aadhaar structure which, according to them, is anathema to the democratic principles and rule of law, which is the bedrock of the Indian Constitution. The petitioners have challenged the Aadhaar project which took off by way of administrative action in the year 2009. Even after Aadhaar got a shield of statutory cover, challenge persists as the very enactment known as Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (hereinafter referred to as the 'Aadhaar Act') is challenged as constitutionally impermissible. The wide range of issues involved in this case is evident from the fact that it took almost four months for the parties to finish their arguments in these cases, and the Court witnessed highly skilled, suave, brilliant and intellectual advocacy, with the traces of passions as well.

4) The issue has generated heated public debate as well. Even outside the Court, there are groups advocating in favour of the Aadhaar scheme and those who are stoutly opposing the same. Interestingly, it is not only the commoners who belong to either of the two groups but intelligentsia is also equally divided. There have been number of articles, interviews for discourses in favour of or against Aadhaar. Those in favour see Aadhaar project as ushering the nation into a regime of good governance, advancing socio-economic rights, economic prosperity etc. and in the process they claim that it may make the nation a world leader. Mr. K.K. Venugopal, learned Attorney General for India, referred to the commendations by certain international bodies, including the World Bank.

We clarify that we have not been influenced by such views expressed either in favour or against Aadhaar. Those opposing Aadhaar are apprehensive that it may excessively intrude into the privacy of citizenry and has the tendency to create a totalitarian state, which would impinge upon the democratic and constitutional values. Some such opinions of various persons/bodies were referred to during the arguments. Notwithstanding the passions, emotions, annoyance, despair, ecstasy, euphoria, coupled with rhetoric, exhibited by both sides in equal measure during the arguments, this Court while giving its judgment on the issues involved is required to have a posture of calmness coupled with objective examination of the issues on the touchstone of the constitutional provisions.

5) Initiative in spearheading the attack on the Aadhaar structure was taken by the petitioners, namely, Justice K.S. Puttaswamy (Retd.) and Mr. Pravesh Khanna, by filing Writ Petition (Civil) No. 494 of 2012. At that time, Aadhaar scheme was not under legislative umbrella. In the writ petition the scheme has primarily been challenged on the ground that it violates fundamental rights of the innumerable citizens of India, namely, right to privacy falling under Article 21 of the Constitution of India. Few others joined the race by filing connected petitions. Series of orders were passed in this petition from time to time, some of which would be referred to by us at the appropriate stage. In 2016, with the passing of the Aadhaar Act, these very petitioners filed another writ petition challenging the vires of the Act. Here again, some more writ petitions have been filed with the same objective. All these writ petitions were clubbed together. There are number of interventions as well by various individuals, groups, NGOs, etc., some opposing the petitions and some supporting the Aadhaar scheme.

6) Before we go into the premise on which the attack is laid on the constitutional validity of the Aadhaar project and the Aadhaar Act, it would be apposite to take note of the events in chronological order that shaped the formulation, take off and implementation of the Aadhaar scheme.

7) On March 03, 2006, approval was given by the Department of Information Technology, Ministry of Communications and Information Technology, Government of India for the project titled 'Unique Identification for BPL Families' to be implemented by the National Informatics Centre (NIC) for over a period of twelve months. As a result, a Processes Committee was set up on July 03, 2006 to suggest the process for updation, modification, addition and deletion of data and fields from the core database to be created under the Unique Identification for BPL Families project. This Committee, on November 26, 2006, prepared a paper known as 'Strategic Vision Unique Identification of Residents'. Based thereupon, the Empowered Group of Ministers (EGoM) was set up on December 04, 2006, to collate the National Population Register under the Citizenship Act, 1955 and the Unique Identification Number project of the Department of Information Technology. The EGoM was also empowered to look into the methodology and specific milestones for early and effective completion of projects and to take a final view on these projects. The EGoM was composed of the then Ministers of External Affairs, Home Affairs, Law, Panchayati Raj and Communications and Information Technology and the then Deputy Chairman, Planning Commission.

8) Various meetings on the Unique Identification (hereinafter referred to as 'UID') project were held from time to time. In the fourth meeting held on December 22, 2006, various aspects of proposed data elements and their formats were discussed. Thereafter, in its fifth meeting held on April 27, 2007, it was decided that the evolution of UID database would be in three stages in principle. The Committee further decided that linkage with major partner databases such as Household Survey of RD and the individual State Public Distribution System (PDS) databases should be taken up in a phased manner. On June 11, 2007, at the final stage of the project, a presentation on the UID project was made to the then Prime Minister by the Cabinet Secretary. The sixth meeting of the UID project was held on June 15, 2007. The Committee, inter alia, took the following decisions:

(i) The numbering format of 11 digits was approved.

(ii) The need for UID authority to be created by an executive order under the aegis of the Planning Commission was appreciated in order to ensure pan-departmental and neutral identity for the authority.

(iii) The proposal for creation of Central and State UIDs was approved.

(iv) Department of Information Technology (DIT) was directed to work out modalities for linkage with Election Commission and initiate discussions with MoRD and PDS for linkage. (v) In principle, approval of proposed sequence for phasing plan was granted.

9) In the seventh meeting held on August 30, 2007, the proposed administrative framework and structure of UID authority and manpower requirement, including financial implications, was discussed. It was decided that a detailed proposal based on the resource model be presented to the Committee for its 'in principle' approval. At this stage, EGoM convened its first meeting on November 27, 2007. At this meeting, a consensus emerged on the following points:

(i) There is a clear need for creating an identity related resident database, regardless of whether the database is created on a de novo collection of data or is based on an already existing data (such as the Election Commission's Voter List).

(ii) Additionally, there is a critical need to create an institutional mechanism that would 'own' the database and be responsible for its maintenance and updating.

(iii) The next meeting is to consider topics relating to collating the National Population Register (NPR) and UID schemes, including methodology, effective implementation techniques, identification of the institutional mechanism stated above, and the time schedule for putting the scheme into operation. A series of meetings took place thereafter to work out the modalities of the programme. Certain issues were raised therein and to address those issues, a Committee of Secretaries was formed. The said Committee gave its recommendations which were discussed by EGoM. After approving the Aadhaar Scheme in principle, it instructed the Cabinet Secretary to convene a meeting to finalise the detailed organisational structure of the UID.

10) After considering the recommendation of the Cabinet Secretary, Notification No. A-43011/02/2009-Admn.I was issued on January 28, 2009 by the Government of India which constituted and notified the UIDAI as an attached office under the aegis of the Planning Commission. Consequent to the constitution of UIDAI, allocation of Rs.147.31 crores for Phase I of Aadhaar enrolments was approved by the Finance Minister on the recommendation of the Standing Committee on Finance. Demo-Official letter dated February 25, 2009, was sent by the Secretary, Planning Commission to all Chief Secretaries of 35 States/Union Territories apprising them of their roles and responsibilities of the States/Union Territories in implementation of UIDAI, such as appointment of the State/UT UID Commissioners, logistics support and coordination with various departments and State units. As they say, rest is history, which we recapitulate in brief hereinafter.

11) A core group was set up to advice and further the work related to UIDAI. Budgets were allocated to UIDAI to enable it to undertake its task. Staff was also allocated to it. Meetings of the core group took place from time to time. The core group, inter alia, decided that it was better to start with the electoral roll database of 2009 for undertaking the UIDAI project. The status of digitisation of PDS records, state-wise, was sought to be sent from the Department of Food and Public Distribution to the Standing Commission/UID.

This and other steps taken in this direction culminated in issuance of Notification dated July 02, 2009 whereby Mr. Nandan Nilekani was appointed as the Chairman of UIDAI for an initial tenure of five years in the rank and status of a Cabinet Minister. He assumed charge on July 24, 2009. Thereafter, the Prime Minister's Council of UIDAI was constituted on July 30, 2009 which held its first meeting on August 12, 2009 where the Chairman of UIDAI made detailed representation on the broad strategy and approach of the proposed UID project.

One of the proposals was to provide a legislative framework for UID at the earliest so that it could have the legal sanction to perform its function. Some other Committees like the Biometrics Standard Committee, Demographic Data Standards and Verification Procedure Committee were set up as a support system to the project, which submitted their respective reports in December 2009. Even a Cabinet Committee on UID was constituted vide orders dated October 22, 2009 which was headed by the Prime Minister with the aim to cover all issues relating to UIDAI, including its organisation, policies, programmes, schemes, funding and methodology to be adopted for achieving its objectives.

12) The matter was addressed in the Seventeenth Finance Commission Report also which was tabled in the Parliament on February 25, 2010. In this report, the Finance Commission suggested targeting of subsidies through UIDAI. By April 2010, UIDAI came out with its Strategy Overview. This Overview describes the features, benefits, revenue model and timelines of the UIDAI project. Furthermore, it outlined the goal of the UID to serve as a universal proof of identity, allowing residents to prove their identities anywhere in the country. The project would give the Government a clear view of India's population, enabling it to target and deliver services effectively, achieve greater returns on social investments and monitor money and resource flows across the country. It was felt that crucial to the achievement of this goal is the active participation of the central, state and local Governments as well as public and private sector entities. Only with their support will the project be able to realise a larger vision of inclusion and development in India.

13) A Cabinet Note bearing No. 4(4)/57/2010/CC-UIDAI for the Cabinet Committee on UIDAI was submitted on May 12, 2010. The Note outlined a brief background of UIDAI, proposed an approach for collection of demographic and biometric attributes of residents for the UID project and sought approval of the Cabinet Committee for adoption of the aforesaid approach and suggested that the same standards and processes be adhered to by the Registrar General of India for the NPR exercise and all other Registrars in the UID system. Rationale for inclusion of iris biometrics was also submitted with the aforesaid Cabinet Note to explain the need for capturing iris scans at the time of capturing biometric details.

14) By September 2010 enrolment process of Aadhaar began with the nationwide launch of the Aadhaar project. In December 2010, UIDAI came out with a report on enrolment process known as 'UID Enrolment Proof-of-Concept Report' studying enrolment proof-of-concept in three rural areas of Karnataka, Bihar and Andhra Pradesh published by the UIDAI. According to this report, 'the biometric matching analysis of 40,000 people showed that the accuracy levels achieved by both iris and ten fingerprints were more than an order of magnitude better compared to using either of the two individually. The multi-modal enrolment was adequate to carry out de-duplication on a much larger scale, with reasonable expectations of extending it to all residents of India'.

15) Going by the recommendation of the Chairman of UIDAI for providing legislative framework to UIDAI, a Bill was introduced in the Rajya Sabha on December 03, 2010 known as 'National Identification Authority of India Bill, 2010'. 16) Various other steps were taken to smoothen the process of enrolment. There were studies from time to time on the effectiveness of the enrolment process. Notifications/orders were also issued by the Reserve Bank of India stating that an Aadhaar letter would be recognised by Banks to open bank accounts for a resident. Similar Orders/Notifications were issued by other authorities as well. On the first anniversary of Aadhaar launch, which fell on September 29, 2011, announcement was made that 10 crores enrolments and generation of more than 3.75 crores of Aadhaar had taken place. Some of the reports submitted in due course of time, which are relevant for our purposes, are taken note of at this stage:

(i) Report of the Task Force on an Aadhaar-Enabled Unified Payment Infrastructure for the direct transfer of subsidies on Kerosene, LPG and Fertilizer.

(ii) In March 2012, Fingerprint Authentication Report was submitted to UIDAI. This Report showcased the high accuracy rates of using fingerprints to authenticate identities. The study conducted in the rural setting representing typical demography of the population established that it is technically possible to use fingerprint to authenticate a resident in 98.13% of the population. The accuracy of 96.5% can be achieved using one best finger and 99.3% can be achieved using two fingers. Further improvement is possible if the device specifications are tightened to include only the best devices and certain mechanical guide is used to aid proper placement of the finger. It was also demonstrated through benchmarking that the authentication infrastructure is able to sustain one million authentications per hour.

(iii) Fifty Third Report of the Standing Committee on Finance on the 'Demands for Grants (2012-13)' of the Ministry of Planning was presented to the Lok Sabha and Rajya Sabha on April 24, 2012. This Report summarises the objectives and financial implications of the UID scheme being implemented under the aegis of the Planning Commission.

(iv) Iris Authentication Accuracy Report was submitted to UIDAI on September 12, 2012. This Report based on an empirical study of 5833 residents demonstrated iris authentication to be viable in Indian context. With current level of device readiness for iris capture, it is capable of providing coverage for 99.67% of population with authentication accuracy of above 99.5%. Suggestions made in this document for the vendors, once implemented, will improve the rates further. The overall systems - network and software - have shown to meet desired requirements in real life condition. Finally, six different devices with variety of form and function are available to provide competitive vendor eco-system.

(v) Background Note on Introduction to Cash Transfers was prepared by the National Committee on Direct Cash Transfers in its first meeting on November 26, 2012. This Report outlines the advantages of cash transfers in the Indian context stating that a unique ID for all is a prerequisite for this purpose.

17) At this juncture, Writ Petition (Civil) No. 494 of 2012 was filed in which show-cause notice dated November 30, 2012 was issued by this Court. As pointed out above, this writ petition assailed Aadhaar scheme primarily on the ground that it violates right to privacy which is a facet of fundamental rights enshrined in Article 21 of the Constitution.

18) Counter affidavit thereto was filed by the Union of India as well as UIDAI. The stand taken by the respondents, inter alia, was that right to privacy is not a fundamental right, which was so held by the eight Judge Bench judgment in M.P. Sharma and 4 Others v. Satish Chandra Distt. Magistrate, Delhi and 4 Others1. This is notwithstanding the fact that thereafter in many judgments rendered by this Court, right to privacy was accepted as a facet of Article 21. Contention of the respondents, however, was that those judgments were contrary to the dicta laid down in M.P. Sharma and were, therefore, per in curium. The matter on this aspect was heard by a three Judge Bench and after hearing the parties, the Bench deemed it appropriate to make the reference to the Constitution Bench. A five Judge Bench was constituted, which after considering the matter, referred the same to a nine Judge Bench to resolve the controversy in an authoritative manner. The nine Judge Bench judgment has given an unanimous answer to the Reference with conclusive, unambiguous and emphatic determination that right to privacy is a part of fundamental rights which can be traced to Articles 14, 19 and 21 of the Constitution of India.

19) We may also record at this stage that in this petition certain interim orders were passed from time to time. We may give the gist of some of the relevant orders:

(a) Order dated September 23, 2013 (two Judge Bench)

"All the matters require to be heard finally. List all matters for final hearing after the Constitution Bench is over. In the meanwhile, no person should suffer for not getting the Aadhaar card in spite of the fact that some authority had issued a circular making it mandatory and when any person applies to get the Aadhaar card voluntarily, it may be checked whether that person is entitled for it under the law and it should not be given to any illegal immigrant."

(b) Order dated November 26, 2013 (two Judge Bench)

"After hearing the matter at length, we are of the view that all the States and Union Territories have to be impleaded as respondents to give effective directions. In view thereof, notice be issued to all the States and Union Territories through standing counsel.

xx xx xx

Interim order to continue, in the meantime."

(c) Order dated March 16, 2015 (three Judge Bench)

"In the meanwhile, it is brought to our notice that in certain quarters, Aadhaar identification is being insisted upon by the various authorities, we do not propose to go into the specific instances. Since Union of India is represented by learned Solicitor General and all the States are represented through their respective counsel, we expect that both the Union of India and States and all their functionaries should adhere to the order passed by this Court on 23rd September, 2013."

(d) Order dated August 11, 2015 (three Judge Bench)

"Having considered the matter, we are of the view that the balance of interest would be best served, till the matter is finally decided by a larger Bench, if the Union of India or the UIDAI proceed in the following manner:

1. The Union of India shall give wide publicity in the electronic and print media including radio and television networks that it is not mandatory for a citizen to obtain an Aadhaar card.

2. The production of an Aadhaar card will not be condition for obtaining any benefits otherwise due to a citizen.

3. The Unique Identification Number or the Aadhaar card will not be used by the respondents for any purpose other than the PDS Scheme and in particular for the purpose of distribution of food grains, etc. and cooking fuel, such as kerosene. The Aadhaar card may also be used for the purpose of LPG Distribution Scheme.

4. The information about an individual obtained by the Unique Identification Authority of India while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a Court for the purpose of criminal investigation."

(d) Order dated October 15, 2015 (Constitution Bench)

"3. After hearing the learned Attorney General for India and other learned senior counsels, we are of the view that in paragraph 3 of the order dated 11.08.2015, if we add, apart from the other two Schemes, namely, P.D.S. Scheme and L.P.G. Distribution Scheme, the Schemes like The Mahatma Gandhi National Social Assistance Programme (Old Age Pensions, Widow Pensions, Disability Pensions), Prime Minister's Jan Dhan Yojana (PMJDY) and Employees' Provident Fund Organisation (EPFO) for the present, it would not dilute earlier order passed by this Court. Therefore, we now include the aforesaid Schemes apart from the other two Schemes that this Court has permitted in its earlier order dated 11.08.2015.

4. We impress upon the Union of India that it shall strictly follow all the earlier orders passed by this Court commencing from 23.09.2013.

5. We will also make it clear that the Aadhaar card scheme is purely voluntary and it cannot be made mandatory till the matter is finally decided by this Court one way or the other."

(e) Order dated September 14, 2016 in WP (C) No. 686/2016

"Having regard to the facts and circumstances of the case, the material evidence available on record and the submissions made by learned senior counsel, we stay the operation and implementation of letters dated 14.07.2006 (i.e. Annexure P-5, P-6, P-7) for Pre-Matric Scholarship Scheme, Post-Matric Scholarship Scheme and Merit-cum- Means Scholarship Scheme to the extent they have made submission of Aadhaar mandatory and direct the Ministry of Electronics and Information Technology, Government of India, i.e. respondent No.2, to remove Aadhaar number as a mandatory condition for student registration form at the National Scholarship Portal of Ministry of Electronics and Information Technology, Government of India at the website..."

20) It is also relevant to point out that against an order passed by the High Court of Bombay at Panaji, in some criminal proceedings, wherein the Authority was directed to pass on biometric information on a person, UIDAI had filed Special Leave Petition (Criminal) No. 2524 of 2014 challenging the said order with the submission that such a direction for giving biometric information was contrary to the provisions of the Aadhaar Act and the Authority was not supposed to give such an information, which was confidential. In the said special leave petition, order dated March 24, 2014 was passed staying the operation of the orders of the Bombay High Court. This order reads as under: "Issue notice.

In addition to normal mode of service, dasti service, is permitted. Operation of the impugned order shall remain stayed. In the meanwhile, the present petitioner is restrained from transferring any biometric information of any person who has been allotted the Aadhaar number to any other agency without his consent in writing. More so, no person shall be deprived of any service for want of Aadhaar number in case he/she is otherwise eligible/entitled.

All the authorities are directed to modify their forms/circulars/likes so as to not compulsorily require the Aadhaar number in order to meet the requirement of the interim order passed by this Court forthwith. Tag and list the matter with main matter i.e. WP (C) No. 494 of 2012." 21) Likewise, in Writ Petition (Civil) No. 1002 of 2017 titled Dr. Kalyan Menon Sen v. Union of India and Others, where constitutional validity of linking bank accounts and mobile phones with Aadhaar linkage was challenged, interim order was passed on November 03, 2017 extending the last date of linking to December 31, 2017 and February 06, 2018 respectively. This order was extended thereafter and continues to operate.

22) We would also like to refer to the order dated September 14, 2011 passed in People's Union for Civil Liberties (PDS Matter) v. Union of India & Ors.2, wherein various directions were given to ensure effective implementation of the PDS Scheme and in the process to also undertake the exercise of eliminating the task and ghost ration cards. In the same manner, vide order dated March 16, 2012 it was noted that the Government had set up a task force under the Chairmanship of Mr. Nandan Nilekani to recommend, amongst others, an IT strategy for the PDS.

Mr. Nilekani was requested to suggest ways and means by which computerization process of the PDS can be expedited. Computerisation of PDS system was directed to be prepared and in this hue the process of computerisation with Aadhaar registration was also suggested. In the same very case above, which also pertained to providing night shelters to homeless destitute persons, some orders were passed on February 10, 20103 as well as on September 14, 20114.

23) Again, in the case of State of Kerala & Ors. v. President, Parent Teachers Association SNVUP School and Ors.5, where the Court was concerned with the problem of fake or bogus admissions, it was felt that instead of involving the Police in schools to prevent fake admissions, more appropriate method of verification would be Unique Identification (UID) card as means of verification.

Architecture of the Aadhaar Project and the Aadhaar Act:

24) Before adverting to the discussion on various issues that have been raised in these petitions, it would be apposite to first understand the structure of the Aadhaar Act and how it operates, having regard to various provisions contained therein. UIDAI was established in the year 2009 by an administrative order i.e. by resolution of the Govt. of India, Planning Commission, vide notification dated January 28, 2009. The object of the establishment of the said Authority was primarily to lay down policies to implement the Unique Identification Scheme (for short the 'UIS') of the Government, by which residents of India were to be provided unique identity number. The aim was to serve this as proof of identity, which is unique in nature, as each individual will have only one identity with no chance of duplication.

Another objective was that this number could be used for identification of beneficiaries for transfer of benefits, subsidies, services and other purposes. This was the primary reason, viz. to ensure correct identification of targeted beneficiaries for delivery of various subsidies, benefits, services, grants, wages and other social benefits schemes which are funded from the Consolidated Fund of India. It was felt that the identification of real and genuine beneficiaries had become a challenge for the Government. In the absence of a credible system to authenticate identity of beneficiaries, it was becoming difficult to ensure that the subsidies, benefits and services reach to intended beneficiaries.

As per the Government, failure to establish identity was proving to be major hindrance for the successful implementation of the welfare programmes and it was hitting hard the marginalised section of the society and, in particular, women, children, senior citizens, persons with disabilities, migrant unskilled and organised workers, and nomadic tribes. After the establishment of the Authority, vide the aforesaid notification, it started enrolling the residents of this country under the UIS. These residents also started using Aadhaar number allotted to them. It was found that over a period of time, the use of Aadhaar number had increased manifold. This necessitated ensuring security of the information contained in Aadhaar number as well as the information that generated as a result of the use of Aadhaar numbers. It was, thus, felt desirable to back the system with a Parliamentary enactment.

25) With this intention, the Aadhaar Bill was introduced with the following Introduction: "The Unique Identification Authority of India was established by a resolution of the Government of India in 2009. It was meant primarily to lay down policies and to implement the Unique Identification Scheme, by which residents of India were to be provided unique identity number.

This number wold serve as proof of identity and could be used for identification of beneficiaries for transfer of benefits, subsidies, services and other purposes. Later on, it was felt that the process of enrollment, authentication, security, confidentiality and use of Aadhaar related information be made statutory so as to facilitate the use of Aadhaar number for delivery of various benefits, subsidies and services, the expenditures of which were incurred from or receipts therefrom formed part of the Consolidated Fund of India. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Bill, 2016 inter alia, provides for establishment of Unique Identification Authority of India, issuance of Aadhaar number to individuals, maintenance and updating of information in the Central Identities Data Repository, issues pertaining to security, privacy and confidentiality of information as well as offences and penalties for contravention of relevant statutory provisions."

26) After mentioning the reasons recorded above, Statement of Objects and Reasons for introducing the Bill also highlight the salient features thereof in the following manner:

"5. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Bill, 2016, inter alia, seeks to provide for-

(a) issue of Aadhaar numbers to individuals on providing his demographic and biometric information to the Unique Identification Authority of India;

(b) requiring Aadhaar numbers for identifying an individual for delivery of benefits, subsidies, and services the expenditure is incurred from or the receipt therefrom forms part of the Consolidated Fund of India;

(c) authentication of the Aadhaar number of an Aadhaar number holder in relation to his demographic and biometric information;

(d) establishment of the Unique Identification Authority of India consisting of a Chairperson, two Members and a Member-Secretary to perform functions in pursuance of the objectives above;

(e) maintenance and updating the information of individuals in the Central Identities Data Repository in such manner as may be specified by regulations;

(f) measures pertaining to security, privacy and confidentiality of information in possession or control of the Authority including information stored in the Central Identities Data Repository; and

(g) offences and penalties for contravention of relevant statutory provisions."

27) The Bill having been passed by the Legislature, received the assent of the President on March 25, 2016 and, thus, became Act (18 of 2016). Preamble to this Act again emphasises the aim and objective which this Act seeks to achieve. It reads: "An Act to provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto"

28) Section 2 of the Act provides certain definitions. Some of the definitions can be noted at this stage itself, while other relevant definitions would be mentioned at the appropriate stage.

"(a) "Aadhaar number" means an identification number issued to an individual under sub-section (3) of Section 3;

(b) "Aadhaar number holder" means an individual who has been issued an Aadhaar number under this Act;

(c) "authentication" means the process by which the Aadhaar number along with demographic information or biometric information of an individual is submitted to the Central Identities Data Repository for its verification and such Repository verifies the correctness, or the lack thereof, on the basis of information available with it;

(d) "authentication record" means the record of the time of authentication and identity of the requesting entity and the response provided by the Authority thereto;

xx xx xx

(f) "benefit" means any advantage, gift, reward, relief, or payment, in cash or kind, provided to an individual or a group of individuals and includes such other benefits as may be notified by the Central Government;

(g) "biometric information" means photograph, finger print, Iris scan, or such other biological attributes of an individual as may be specified by regulations;

(h) "Central Identities Data Repository" means a centralised database in one or more locations containing all Aadhaar numbers issued to Aadhaar number holders along with the corresponding demographic information and biometric information of such individuals and other information related thereto;

xx xx xx

(j) "core biometric information" means finger print, Iris scan, or such other biological attribute of an individual as may be specified by regulations;

(k) "demographic information" includes information relating to the name, date of birth, address and other relevant information of an individual, as may be specified by regulations for the purpose of issuing an Aadhaar number, but shall not include race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history; (l) "enrolling agency" means an agency appointed by the Authority or a Registrar, as the case may be, for collecting demographic and biometric information of individuals under this Act;

(m) "enrollment" means the process, as may be specified by regulations, to collect demographic and biometric information from individuals by the enrolling agencies for the purpose of issuing Aadhaar numbers to such individuals under this Act;

(n) "identity information" in respect of an individual, includes his Aadhaar number, his biometric information and his demographic information;

xx xx xx

(r) "records of entitlement" means records of benefits, subsidies or services provided to, or availed by, any individual under any programme;

xx xx xx

(u) "requesting entity" means an agency or person that submits the Aadhaar number, and demographic information or biometric information, of an individual to the Central Identities Data Repository for authentication;

(v) "resident" means an individual who has resided in India for a period or periods amounting in all to one hundred and eighty-two days or more in the twelve months immediately preceding the date of application for enrolment;

(w) "service" means any provision, facility, utility or any other assistance provided in any form to an individual or a group of individuals and includes such other services as may be notified by the Central Government;

(x) "subsidy" means any form of aid, support, grant, subvention, or appropriation, in cash or kind, to an individual or a group of individuals and includes such other subsidies as may be notified by the Central Government."

29) Chapter II of the Act deals with enrolment. Section 3 in this Chapter entitles every resident to obtain the Aadhaar number by submitting his demographic information and biometric information. As noted above, demographic information includes information relating to the name, date of birth, address and 'other relevant information of an individual, as may be specified by regulations for the purpose of issuing an Aadhaar number'. Photograph, fingerprint, iris scan, 'or such other biological attribute of an individual as may be specified by regulations' are treated as biometric information. Sub-section (2) of Section 3 stipulates that the enrolling agency shall, at the time of enrolment, inform the individual undergoing enrolment of the following details in such manner as may be specified by regulations, namely:

(a) the manner in which the information shall be used;

(b) the nature of recipients with whom the information is intended to be shared during authentication; and

(c) the existence of a right to access information, the procedure for making requests for such access, and details of the person or department in-charge to whom such requests can be made.

30) Section 4, inter alia, provides that Aadhaar number issued to an individual shall not be reassigned to any individual. In this sense, it makes an Aadhaar number given to a particular individual 'unique'. Section 5 delineates special measures for issuance of Aadhaar number to certain categories of persons and reads as under:

"5. Special measures for issuance of Aadhaar number to certain category of persons.- The Authority shall take special measures to issue Aadhaar number to women, children, senior citizens, persons with disability, unskilled and unorganised workers, nomadic tribes or to such other persons who do not have any permanent dwelling house and such other categories of individuals as may be specified by regulations."

31) Section 6 enables the Authority to update demographic and biometric information of the Aadhaar number holders from time to time.

32) Chapter III deals with 'authentication', which has generated the maximum debate in these proceedings. Section 7 falling under this Chapter mandates that proof of Aadhaar number would be necessary for receipt of certain subsidies, benefits and services etc. meaning thereby for availing such subsidies, benefits and services, it would be necessary for the intended beneficiary to possess Aadhaar number. In case of an individual to whom no Aadhaar number has been assigned, he/she would be required to show that application for enrolment has been given.

Where the Aadhaar number is not assigned, proviso to Section 7 lays down that the individual shall be offered alternate and viable means of identification for delivery of subsidy, benefit or service. Section 8 deals with authentication of Aadhaar number and provides that on submission of request by any requesting entity, the Authority shall perform authentication of Aadhaar number. This authentication is in relation to biometric information or demographic information of an Aadhaar number holder. Before collecting identity information for the purpose of authentication, the requesting entity is to obtain consent of an individual and also to ensure that the identity information of that individual is only used for submission to the Central Identities Data Repository (CIDR) for authentication. Sections 7 and 8 read as under:

"7. Proof of Aadhaar number necessary for receipt of certain subsidies, benefits and services, etc.- The Central Government or, as the case may be, the State Government may, for the purpose of establishing identity of an individual as a condition for receipt of a subsidy, benefit or service for which the expenditure is incurred from, or the receipt therefrom forms part of, the Consolidated Fund of India, require that such individual undergo authentication, or furnish proof of possession of Aadhaar number or in the case of an individual to whom no Aadhaar number has been assigned, such individual makes an application for enrolment: Provided that if an Aadhaar number is not assigned to an individual, the individual shall be offered alternate and viable means of identification for delivery of the subsidy, benefit or service.

8. Authentication of Aadhaar number.-

(1) The Authority shall perform authentication of the Aadhaar number of an Aadhaar number holder submitted by any requesting entity, in relation to his biometric information or demographic information, subject to such conditions and on payment of such fees and in such manner as may be specified by regulations.

(2) A requesting entity shall-

(a) unless otherwise provided in this Act, obtain the consent of an individual before collecting his identity information for the purposes of authentication in such manner as may be specified by regulations; and

(b) ensure that the identity information of an individual is only used for submission to the Central Identities Data Repository for authentication.

(3) A requesting entity shall inform, in such manner as may be specified by regulations, the individual submitting his identity information for authentication, the following details with respect to authentication, namely-

(a) the nature of information that may be shared upon authentication;

(b) the uses to which the information received during authentication may be put by the requesting entity; and

(c) alternatives to submission of identity information to the requesting entity.

(4) The Authority shall respond to an authentication query with a positive, negative or any other appropriate response sharing such identity information excluding any core biometric information."

33) Under Section 10, the Authority is given power to engage one or more entities to establish and maintain the CIDR and to perform any other functions as may be specified by regulations.

34) Chapter IV deals with the Establishment of the Authority. As per Section 11, the Central Government, by notification, shall establish an Authority to be known as the Unique Identification Authority of India. Notification dated July 12, 2016 was issued by the Central Government establishing the Authority. Other provisions in this Chapter deal with the composition of the Authority, qualifications for appointment of the Chairperson and Members of Authority; term of their office and their removal; and restrictions on their employment after cessation of office. It also provides for the functions of Chairperson as well as office of the Chief Executive Officer (CEO) and his functions and the meetings of the Authority etc. Powers and functions of the Authority are stipulated in Section 23.

35) Chapter V talks of grants to the Authority by the Central Government as well as accounts and audit and annual report of the Authority.

36) Chapter VI deals with the important aspects pertaining to 'protection of information'. Section 28 of the Aadhaar Act puts an obligation on the Authority to ensure the security of identity information and authentication records of individuals. Likewise, Section 29 imposes certain restrictions on sharing information i.e. core biometric information collected or created under the Act or the identity information. The biometric information collected and stored in electronic form, in accordance with this Act and regulations made thereunder, is treated as 'electronic record' and 'sensitive personal data or information' by virtue of Section 30 of the Act. As these are very material and significant provisions of the Act, the same are reproduced verbatim in their entirety:

"28. Security and confidentiality of information.-

(1) The Authority shall ensure the security of identity information and authentication records of individuals.

(2) Subject to the provisions of this Act, the Authority shall ensure confidentiality of identity information and authentication records of individuals.

(3) The Authority shall take all necessary measures to ensure that the information in the possession or control of the Authority, including information stored in the Central Identities Data Repository, is secured and protected against access, use or disclosure not permitted under this Act or regulations made there under, and against accidental or intentional destruction, loss or damage.

(4) Without prejudice to sub-sections (1) and (2), the Authority shall-

(a) adopt and implement appropriate technical and organisational security measures;

(b) ensure that the agencies, consultants, advisors or other persons appointed or engaged for performing any function of the Authority under this Act, have in place appropriate technical and organisational security measures for the information; and

(c) ensure that the agreements or arrangements entered into with such agencies, consultants, advisors or other persons, impose obligations equivalent to those imposed on the Authority under this Act, and require such agencies, consultants, advisors and other persons to act only on instructions from the Authority.

29. Restriction on sharing information.-

(1) No core biometric information, collected or created under this Act, shall be-

(a) shared with anyone for any reason whatsoever; or

(b) used for any purpose other than generation of Aadhaar numbers and authentication under this Act.

(2) The identity information, other than core biometric information, collected or created under this Act may be shared only in accordance with the provisions of this Act and in such manner as may be specified by regulations.

(3) No identity information available with a requesting entity shall be-

(a) used for any purpose, other than that specified to the individual at the time of submitting any identity information for authentication; or

(b) disclosed further, except with the prior consent of the individual to whom such information relates.

(4) No Aadhaar number or core biometric information collected or created under this Act in respect of an Aadhaar number holder shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations.

30. Biometric information deemed to be sensitive personal information.-

The biometric information collected and stored in electronic form, in accordance with this Act and regulations made thereunder, shall be deemed to be "electronic record" and "sensitive personal data or information", and the provisions contained in the Information Technology Act, 2000 (21 of 2000) and the rules made thereunder shall apply to such information, in addition to, and to the extent not in derogation of the provisions of this Act.

Explanation.-For the purposes of this section, the expressions-

(a) "electronic form" shall have the same meaning as assigned to it in clause (r) of sub-section (1) of Section 2 of the Information Technology Act, 2000 (21 of 2000);

(b) "electronic record" shall have the same meaning as assigned to it in clause (t) of sub-section (1) of Section 2 of the Information Technology Act, 2000 (21 of 2000);

(c) "sensitive personal data or information" shall have the same meaning as assigned to it in clause (iii) of the Explanation to Section 43-A of the Information Technology Act, 2000 (21 of 2000)."

37) Section 32 provides that the Authority shall maintain authentication records in such manner and for such period as may be specified by regulations and enables every Aadhaar number holder to obtain his authentication record in such manner as may be specified by regulations.

This provision also puts an embargo upon the Authority to collect, keep or maintain any information about 'purpose of authentication'. Section 33, however, creates an exception to the provisions of Section 28(ii) and

(v) as well as Section 29(ii) by stipulating that the information can be disclosed pursuant to an order of a court not inferior to that of a District Judge. It also carves out another exception in those cases where it becomes necessary to disclose the information in the interest of national security in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government of India specially authorised in this behalf by an order of the Central Government.

38) Sections 34 to 47 in Chapter VII of the Act enumerate various kinds of offences and provide penalties for such offences. For our purposes, relevant Section is Section 37 which makes act of disclosing identity information as offence which is punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees. In the case of a company, this fine can extend to one lakh rupees. Likewise, Section 38 provides for penalty for unauthorised access to the CIDR. Penalties for tampering with data in CIDR (Section 39) and unauthorised use by requesting entity (Section 40) are also stipulated. Cognizance of offences under this Chapter can be taken by a court only on a complaint made by the Authority or any officer or person authorised by it.

39) Section 50 of the Act empowers the Central Government to issue directions to the Authority in writing from time to time and the Authority shall be bound to carry out such directions on questions of policy. Section 53 empowers the Central Government to make rules to carry out the provisions of the Act generally as well as the specific matters enumerated in sub-section (2) thereof. Section 54 empowers the Authority to make regulations consistent with the Act and Rules made thereunder, for carrying out the provisions of the Act and, in particular, the matters mentioned in sub-section (2). Such Rules and Regulations are to be laid before the Parliament, as provided in Section 55.

40) Section 57 provides that the Aadhaar Act would not prevent the use of Aadhaar number for establishing the identity of an individual for any purpose and reads as under:

"57. Act not to prevent use of Aadhaar number for other purposes under law.-

Nothing contained in this Act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect: Provided that the use of Aadhaar number under this section shall be subject to the procedure and obligations under Section 8 and Chapter VI."

41) If any difficulty arises in giving effect to the provisions of the Act, the Central Government is empowered to make provisions to remove those difficulties, provided that such provisions are not inconsistent with the provisions of the Act. Section 59, which is the last provision in the Act, is an attempt to save all the acts and actions of the Central Government under Notification dated January 28, 2009 vide which the Authority was established or the Department of Electronics and Information Technology under the Cabinet Secretariat Notification dated September 12, 2015. This provision is couched in the following language:

"59. Savings.-

Anything done or any action taken by the Central Government under the Resolution of the Government of India, Planning Commission bearing Notification Number A-43011/02/2009-Admin. I, dated the 28th January, 2009, or by the Department of Electronics and Information Technology under the Cabinet Secretariat Notification bearing Notification Number S.O. 2492(E), dated the 12th September, 2015, as the case may be, shall be deemed to have been validly done or taken under this Act."

42) Regulations have been framed under the Act, namely,

(1) The Aadhaar (Enrolment and Update) Regulations, 2016;

(2) The Aadhaar (Authentication) Regulations, 2016;

(3) The Aadhaar (Data Security) Regulations, 2016; and

(4) The Aadhaar (Sharing of Information) Regulations, 2016. The relevant provisions in these Regulations are reproduced below:

"The Aadhaar (Enrolment and Update) Regulations, 2016

4. Demographic information required for enrolment. -

(1) The following demographic information shall be collected from all individuals undergoing enrolment (other than children below five years of age):

(i) Name;

(ii) Date of Birth;

(iii) Gender;

(iv) Residential Address.

(2) The following demographic information may also additionally be collected during enrolment, at the option of the individual undergoing enrolment:

(i) Mobile number

(ii) Email address

(3) In case of Introducer-based enrolment, the following additional information shall be collected:

(i) Introducer name;

(ii) Introducer's Aadhaar number.

(4) In case of Head of Family based enrolment, the following additional information shall be collected:

(i) Name of Head of Family;

(ii) Relationship;

(iii) Head of Family's Aadhaar number;

(iv) One modality of biometric information of the Head of Family.

(5) The standards of the above demographic information shall be as may be specified by the Authority for this purpose.

(6) The demographic information shall not include race, religion, caste, tribe, ethnicity, language, record of entitlement, income or medical history of the resident.

The Aadhaar (Authentication) Regulations, 2016

3. Types of Authentication.- There shall be two types of authentication facilities provided by the Authority, namely-

(i) Yes/No authentication facility, which may be carried out using any of the modes specified in regulation 4(2); and

(ii) e-KYC authentication facility, which may be carried out only using OTP and/ or biometric authentication modes as specified in regulation 4(2).

4. Modes of Authentication. -

(1) An authentication request shall be entertained by the Authority only upon a request sent by a requesting entity electronically in accordance with these regulations and conforming to the specifications laid down by the Authority.

(2) Authentication may be carried out through the following modes:

(a) Demographic authentication: The Aadhaar number and demographic information of the Aadhaar number holder obtained from the Aadhaar number holder is matched with the demographic information of the Aadhaar number holder in the CIDR.

(b) One-time pin based authentication: A One Time Pin (OTP), with limited time validity, is sent to the mobile number and/ or e-mail address of the Aadhaar number holder registered with the Authority, or generated by other appropriate means. The Aadhaar number holder shall provide this OTP along with his Aadhaar number during authentication and the same shall be matched with the OTP generated by the Authority.

(c) Biometric-based authentication: The Aadhaar number and biometric information submitted by an Aadhaar number holder are matched with the biometric information of the said Aadhaar number holder stored in the CIDR. This may be fingerprints-based or iris-based authentication or other biometric modalities based on biometric information stored in the CIDR.

(d) Multi-factor authentication: A combination of two or more of the above modes may be used for authentication.

(3) A requesting entity may choose suitable mode(s) of authentication from the modes specified in sub-regulation (2) for a particular service or business function as per its requirement, including multiple factor authentication for enhancing security. For the avoidance of doubt, it is clarified that e-KYC authentication shall only be carried out using OTP and/ or biometric authentication.

xx xx xx

7. Capturing of biometric information by requesting entity.-

(1) A requesting entity shall capture the biometric information of the Aadhaar number holder using certified biometric devices as per the processes and specifications laid down by the Authority.

(2) A requesting entity shall necessarily encrypt and secure the biometric data at the time of capture as per the specifications laid down by the Authority.

(3) For optimum results in capturing of biometric information, a requesting entity shall adopt the processes as may be specified by the Authority from time to time for this purpose.

xx xx xx

9. Process of sending authentication requests.-

(1) After collecting the Aadhaar number or any other identifier provided by the requesting entity which is mapped to Aadhaar number and necessary demographic and / or biometric information and/ or OTP from the Aadhaar number holder, the client application shall immediately package and encrypt these input parameters into PID block before any transmission, as per the specifications laid down by the Authority, and shall send it to server of the requesting entity using secure protocols as may be laid down by the Authority for this purpose.

(2) After validation, the server of a requesting entity shall pass the authentication request to the CIDR, through the server of the Authentication Service Agency as per the specifications laid down by the Authority. The authentication request shall be digitally signed by the requesting entity and/or by the Authentication Service Agency, as per the mutual agreement between them.

(3) Based on the mode of authentication request, the CIDR shall validate the input parameters against the data stored therein and return a digitally signed Yes or No authentication response, or a digitally signed e-KYC authentication response with encrypted e-KYC data, as the case may be, along with other technical details related to the authentication transaction.

(4) In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the input parameters specified in sub-regulation (1) above such that authentication is always reduced to a 1:1 match.

(5) A requesting entity shall ensure that encryption of PID Block takes place at the time of capture on the authentication device as per the processes and specifications laid down by the Authority.

xx xx xx

18. Maintenance of logs by requesting entity. -

(1) A requesting entity shall maintain logs of the authentication transactions processed by it, containing the following transaction details, namely:-

(a) the Aadhaar number against which authentication is sought;

(b) specified parameters of authentication request submitted;

(c) specified parameters received as authentication response;

(d) the record of disclosure of information to the Aadhaar number holder at the time of authentication; and (e) record of consent of the Aadhaar number holder for authentication, but shall not, in any event, retain the PID information.

(2) The logs of authentication transactions shall be maintained by the requesting entity for a period of 2 (two) years, during which period an Aadhaar number holder shall have the right to access such logs, in accordance with the procedure as may be specified.

(3) Upon expiry of the period specified in sub-regulation (2), the logs shall be archived for a period of five years or the number of years as required by the laws or regulations governing the entity, whichever is later, and upon expiry of the said period, the logs shall be deleted except those records required to be retained by a court or required to be retained for any pending disputes.

(4) The requesting entity shall not share the authentication logs with any person other than the concerned Aadhaar number holder upon his request or for grievance redressal and resolution of disputes or with the Authority for audit purposes. The authentication logs shall not be used for any purpose other than stated in this sub-regulation.

(5) The requesting entity shall comply with all relevant laws, rules and regulations, including, but not limited to, the Information Technology Act, 2000 and the Evidence Act, 1872, for the storage of logs.

(6) The obligations relating to authentication logs as specified in this regulation shall continue to remain in force despite termination of appointment in accordance with these regulations.

xx xx xx

26. Storage and Maintenance of Authentication Transaction Data. -

(1) The Authority shall store and maintain authentication transaction data, which shall contain the following information:-

(a) authentication request data received including PID block;

(b) authentication response data sent;

(c) meta data related to the transaction;

(d) any authentication server side configurations as necessary Provided that the Authority shall not, in any case, store the purpose of authentication.

The Aadhaar (Data Security) Regulations, 2016

3. Measures for ensuring information security. -

(1) The Authority may specify an information security policy setting out inter alia the technical and organisational measures to be adopted by the Authority and its personnel, and also security measures to be adopted by agencies, advisors, consultants and other service providers engaged by the Authority, registrar, enrolling agency, requesting entities, and Authentication Service Agencies.

(2) Such information security policy may provide for:-

(a) identifying and maintaining an inventory of assets associated with the information and information processing facilities;

(b) implementing controls to prevent and detect any loss, damage, theft or compromise of the assets;

(c) allowing only controlled access to confidential information;

(d) implementing controls to detect and protect against virus/malwares;

(e) a change management process to ensure information security is maintained during changes;

(f) a patch management process to protect information systems from vulnerabilities and security risks;

(g) a robust monitoring process to identify unusual events and patterns that could impact security and performance of information systems and a proper reporting and mitigation process;

(h) encryption of data packets containing biometrics, and enabling decryption only in secured locations;

(i) partitioning of CIDR network into zones based on risk and trust;

(j) deploying necessary technical controls for protecting CIDR network;

(k) service continuity in case of a disaster; (l) monitoring of equipment, systems and networks;

(m) measures for fraud prevention and effective remedies in case of fraud;

(n) requirement of entering into non-disclosure agreements with the personnel;

(o) provisions for audit of internal systems and networks;

(p) restrictions on personnel relating to processes, systems and networks.

(q) inclusion of security and confidentiality obligations in the agreements or arrangements with the agencies, consultants, advisors or other persons engaged by the Authority.

(3) The Authority shall monitor compliance with the information security policy and other security requirements through internal audits or through independent agencies.

(4) The Authority shall designate an officer as Chief Information Security Officer for disseminating and monitoring the information security policy and other security-related programmes and initiatives of the Authority.

xx xx xx

5. Security obligations of service providers, etc. - The agencies, consultants, advisors and other service providers engaged by the Authority for discharging any function relating to its processes shall:

(a) ensure compliance with the information security policy specified by the Authority;

(b) periodically report compliance with the information security policy and contractual requirements, as required by the Authority;

(c) report promptly to the Authority any security incidents affecting the confidentiality, integrity and availability of information related to the Authority's functions;

(d) ensure that records related to the Authority shall be protected from loss, destruction, falsification, unauthorised access and unauthorised release;

(e) ensure confidentiality obligations are maintained during the term and on termination of the agreement;

(f) ensure that appropriate security and confidentiality obligations are provided for in their agreements with their employees and staff members;

(g) ensure that the employees having physical access to CIDR data centers and logical access to CIDR data centers undergo necessary background checks;

(h) define the security perimeters holding sensitive information, and ensure only authorised individuals are allowed access to such areas to prevent any data leakage or misuse; and

(i) where they are involved in the handling of the biometric data, ensure that they use only those biometric devices which are certified by a certification body as identified by the Authority and ensure that appropriate systems are built to ensure security of the biometric data.

The Aadhaar (Sharing of Information) Regulations, 2016.

3. Sharing of information by the Authority. -

(1) Core biometric information collected by the Authority under the Act shall not be shared with anyone for any reason whatsoever.

(2) The demographic information and photograph of an individual collected by the Authority under the Act may be shared by the Authority with a requesting entity in response to an authentication request for e-KYC data pertaining to such individual, upon the requesting entity obtaining consent from the Aadhaar number holder for the authentication process, in accordance with the provisions of the Act and the Aadhaar (Authentication) Regulations, 2016.

(3) The Authority shall share authentication records of the Aadhaar number holder with him in accordance with regulation 28 of the Aadhaar (Authentication) Regulations, 2016.

(4) The Authority may share demographic information and photograph, and the authentication records of an Aadhaar number holder when required to do so in accordance with Section 33 of the Act.

xx xx xx

6. Restrictions on sharing, circulating or publishing of Aadhaar number. -

(1) The Aadhaar number of an individual shall not be published, displayed or posted publicly by any person or entity or agency.

(2) Any individual, entity or agency, which is in possession of Aadhaar number(s) of Aadhaar number holders, shall ensure security and confidentiality of the Aadhaar numbers and of any record or database containing the Aadhaar numbers.

(3) Without prejudice to sub-regulations (1) and (2), no entity, including a requesting entity, which is in possession of the Aadhaar number of an Aadhaar number holder, shall make public any database or record containing the Aadhaar numbers of individuals, unless the Aadhaar numbers have been redacted or blacked out through appropriate means, both in print and electronic form.

(4) No entity, including a requesting entity, shall require an individual to transmit his Aadhaar number over the Internet unless such transmission is secure and the Aadhaar number is transmitted in encrypted form except where transmission is required for correction of errors or redressal of grievances.

(5) No entity, including a requesting entity, shall retain Aadhaar numbers or any document or database containing Aadhaar numbers for longer than is necessary for the purpose specified to the Aadhaar number holder at the time of obtaining consent."

43) To sum up broadly, the Authority is established under the Act as a statutory body which is given the task of developing the policy, procedure and system for issuing Aadhaar numbers to individuals and also to perform authentication thereof as per the provisions of the Act. For the purpose of enrolment and assigning Aadhaar numbers, enrolling agencies are recruited by the Authority. All the residents in India are eligible to obtain an Aadhaar number.

To enable a resident to get Aadhaar number, he is required to submit demographic as well as biometric information i.e., apart from giving information relating to name, date of birth and address, biometric information in the form of photograph, fingerprint, iris scan is also to be provided. Aadhaar number given to a particular person is treated as unique number as it cannot be reassigned to any other individual. Insofar as subsidies, benefits or services to be given by the Central Government or the State Government, as the case may be, is concerned, these Governments can mandate that receipt of these subsidies, benefits and services would be given only on furnishing proof of possession of Aadhaar number (or proof of making an application for enrolment, where Aadhaar number is not assigned). An added requirement is that such individual would undergo authentication at the time of receiving such benefits etc.

A particular institution/body from which the aforesaid subsidy, benefit or service is to be claimed by such an individual, the intended recipient would submit his Aadhaar number and is also required to give her biometric information to that agency. On receiving this information and for the purpose of its authentication, the said agency, known as Requesting Entity, would send the request to the Authority which shall perform the job of authentication of Aadhaar number. On confirming the identity of a person, the individual is entitled to receive subsidy, benefit or service. Aadhaar number is permitted to be used by the holder for other purposes as well.

44) In this whole process, any resident seeking to obtain an Aadhaar number is, in the first instance, required to submit her demographic information and biometric information at the time of enrolment. She, thus, parts with her photograph, fingerprint and iris scan at that stage by giving the same to the enrolling agency, which may be a private body/person. Likewise, every time when such Aadhaar holder intends to receive a subsidy, benefit or service and goes to specified/designated agency or person for that purpose, she would be giving her biometric information to that requesting entity, which, in turn, shall get the same authenticated from the Authority before providing a subsidy, benefit or service.

Whenever request is received for authentication by the Authority, record of such a request is kept and stored in the CIDR. At the same time, provisions for protection of such information/data have been made, as indicated above. Aadhaar number can also be used for purposes other than stated in the Act i.e. purposes other than provided under Section 7 of the Act, as mentioned in Section 57 of the Act, which permit the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect, to use the Aadhaar number for establishing the identity of an individual. It can be used as a proof of identity, like other identity proofs such as PAN card, ration card, driving licence, passport etc.

45) Piercing into the aforesaid Aadhaar programme and its formation/structure under the Aadhaar Act, foundational arguments are that it is a grave risk to the rights and liberties of the citizens of this country which are secured by the Constitution of India. It militates against the constitutional abiding values and its foundational morality and has the potential to enable an intrusive state to become a surveillance state on the basis of information that is collected in respect of each individual by creation of a joint electronic mesh. In this manner, the Act strikes at the very privacy of each individual thereby offending the right to privacy which is elevated and given the status of fundamental right by tracing it to Articles 14, 19 and 21 of the Constitution of India by a nine Judge Bench judgment of this Court in K.S. Puttaswamy & Anr. v. Union of India & Ors.6. Most of the counsel appearing for different petitioners (though not all) conceded that there cannot be a serious dispute insofar as allotment of Aadhaar number, for the purpose of unique identification of the residents, is concerned.

However, apprehensions have been expressed about the manner in which the Scheme has been rolled out and implemented. The entire edifice of the aforesaid projection is based on the premise that it forces a person, who intends to enrol for Aadhaar, to part with his core information namely biometric information in the form of fingerprints and iris scan. These are to be given to the enrolment agency in the first instance which is a private body and, thus, there is risk of misuse of this vital information pertaining to an individual. Further, it is argued that the most delicate and fragile part, susceptible to misuse, is the authentication process which is to be carried out each time the holder of Aadhaar number wants to establish her identity.

At that stage, not only the individual parts with the biometric information again with the RE (which may again be a private agency as well), the purpose for which such a person approaches the RE would also be known i.e. the nature of transaction which is supposed to be undertaken by the said person at that time. Such information relating to different transactions of a person across the life of the citizen is connected to a central database. This record may enable the State to profile citizens, track their movements, assess their habits and silently influence their behaviour. Over a period of time, the profiling would enable the State to stifle dissent and influence political decision making. It may also enable the State to act as a surveillant state and there is a propensity for it to become a totalitarian state. It is stressed that at its core, Aadhaar alters the relationship between the citizen and the State.

It diminishes the status of the citizen. Rights freely exercised, liberties freely enjoyed, entitlements granted by the Constitution and laws are all made conditional, on a compulsory barter. The barter compels the citizen to give up her biometrics 'voluntarily', allow her biometrics and demographic information to be stored by the State and private operators and then used for a process termed 'authentication'. To put it in nutshell, provisions of the Aadhaar Act are perceived by the petitioners as giving away of vital information about the residents to the State not only in the form of biometrics but also about the movement as well as varied kinds of transactions which a resident would enter into from time to time.

The threat is in the form of profiling the citizens by the State on the one hand and also misuse thereof by private agencies whether it is enrolling agency or requesting agency or even private bodies mentioned in Section 57 of the Act. In essence, it is stated that not only data of aforesaid nature is stored by the CIDR, which has the threat of being leaked, it can also be misused by non-State actors. In other words, it is sought to be highlighted that there is no assurance of any data protection at any level.

46) The respondents, on the other hand, have attempted to shake the very foundation of the aforesaid structure of the petitioners' case. They argue that in the first instance, minimal biometric information of the applicant, who intends to have Aadhaar number, is obtained which is also stored in CIDR for the purpose of authentication.

Secondly, no other information is stored. It is emphasised that there is no data collection in respect of religion, caste, tribe, language records of entitlement, income or medical history of the applicant at the time of Aadhaar enrolment.

Thirdly, the Authority also claimed that the entire Aadhaar enrolment ecosystem is foolproof inasmuch as within few seconds of the biometrics having been collected by the enrolling agency, the said information gets transmitted the Authorities/CIDR, that too in an encrypted form, and goes out of the reach of the enrolling agency. Same is the situation at the time of authentication as biometric information does not remain with the requesting agency.

Fourthly, while undertaking the authentication process, the Authority simply matches the biometrics and no other information is received or stored in respect of purpose, location or nature or transaction etc. Therefore, the question of profiling does not arise at all. A powerpoint presentation was given by Dr. Ajay Bhushan Pandey, CEO of the Authority, in the Court, while explaining various nuances of the whole process. In this presentation, the enrolment process has been projected in the following manner:

47) Insofar as Aadhaar authentication service is concerned, it was explained that the same is e-KYC wherein following process is involved:

48) It was asserted with all vehemence that while doing the aforesaid authentication, no other information is collected or stored by the Authority/CIDR, specifically pointing that:

(a) The Authority does not collect purpose, location or details of transaction. Thus, it is purpose blind.

(b) The information collected as aforesaid remains in silos.

(c) Merging of silos is prohibited.

(d) The RE is provided answer only in Yes or No about the authentication of the person concerned.

(e) The authentication process is not exposed to the internet world.

(f) Security measures as per the provisions of Section 29(3) read with Section 38(g) as well as Regulation 17(1)(d) of the Authentication Regulations are strictly followed and adhere to. The Aadhaar Authentication Security has been described in the following manner:

49) In this hue, the Authority has projected that the Aadhaar design takes full care of privacy and security of the persons. It is sought to be demonstrated by pointing out the following features:

(i) Privacy is ensured by the very design of Aadhaar which was conceived by the Authority from very inception and is now even incarnated in the Aadhaar Act because :

(a) it is backed by minimal data, federated databases, optimal ignorance; and

(b) there is no transaction/pooling data coupled with the fact that resident authorised access to identity data is available.

(ii) Aadhaar is designed for inclusion inasmuch as :

(a) there is flexibility of demographic data, multi-modal biometrics, and flexible processes;

(b) DDSVP Committee by Dr. V.N. Vittal, former CVC; and

(c) Biometric design and Standards Committee by Dr. Gairola, Former DG, NIC.

(iii) All security numbers are followed which can be seen from:

(a) PKI-2048 encryption from the time of capture,

(b) adoption of best-in-class security standards and practices, and

(c) strong audit and traceability as well as fraud detection.

50) It was explained that the security and data privacy is ensured in the following way:

(i) The data sent to ABIS is completely anonymised. The ABIS systems do not have access to resident's demographic information as they are only sent biometric information of a resident with a reference number and asked to de-duplicate. The de-duplication result with the reference number is mapped back to the correct enrolment number by the Authorities own enrolment server.

(ii) The ABIS providers only provide their software and services. The data is stored in UIDAI storage and it never leaves the secure premises.

(iii) The ABIS providers do not store the biometric images (source). They only store template for the purpose of de- duplication (with reference number).

(iv) The encrypted enrolment packet sent by the enrolment client software to the CIDR is decrypted by the enrolment server but the decrypted packet is never stored.

(v) The original biometric images of fingerprints, iris and face are archived and stored offline. Hence, they cannot be accessed through an online network.

(vi) The biometric system provides high accuracy of over 99.86%. The mixed biometric have been adopted only t enhance the accuracy and to reduce the errors which may arise on account of some residents either not having biometrics or not having some particular biometric.

51) Above all, there is an oversight by Technology and Architecture Review Board (TARB) and Security Review Committee. This Board and Committee consists of very high profiled officers. The aforesaid security measures are shown by the Authority in the following manner:

52) We may point out at this stage that to the powerpoint presentation by Dr. Pandey on the aforesaid lines, certain questions were put to him by Mr. Shyam Divan as well as Mr. Vishwanathan, senior advocates, and the answers thereto were given by Dr. Pandey. In order to have the complete picture, we will be well advised to reproduce these questions and their answers as well, which are as follows:

53) Questions and Answers to the queries raised by the petitioners in W.P. (C) No. 1056 of 2017 entitled 'Nachiket Udupa & Anr. v. Union of India

(1) What are the figures for authentication failures, both at the national and state level? Please provide a breakup, between fingerprints and iris.

Ans.: UIDAI cannot provide authentication failure rates at the state level since it does not track the location of the authentication transactions. Authentication failure rate at national level is as below:

Modality

Unique UID Participated

Failed Unique ID

Failed Percentage

IRIS

1,08,50,391

9,27,132

8.54%

FINGER

61,63,63,346

3,69,62,619

6.00%

It must be stated that authentication failures do not mean exclusion or denial from subsidies, benefits or services since the requesting entities are obliged under the law to provide for exception handling mechanisms.

(2) In case a person who is claiming a biometric exception (e.g. a person suffering from leprosy) does not have a mobile phone number, or has not given it in the enrolment form, or if the phone number changes - how will her Aadhaar enrolment and subsequent authentication occur and under which provision of law? Ans.: Aadhaar enrolment is done for all residents, even of residents with leprosy. Biometric exception process is defined in the UIDAI resident enrolment process. In the case of a leprosy patient, who may not be able to do fingerprint authentication, iris authentication can be used for update (and add the mobile number).

This was the reason for multi-modal enrolment and authentication being selected for use in Aadhaar. Only in an unlikely scenario where both iris and fingerprint cannot be used for authentication, the mobile number is one of the methods for authentication. In cases where authentication through mobile number is not possible or feasible, the requesting entities have to provide their own exception and backup mechanism to ensure services to Aadhaar holders. As part of the exception handling mechanism, UIDAI has already implemented a digitally signed QR code into e-Aadhaar which allows agencies to verify the Aadhaar card in an off-line manner and trust the data (based on digital signature validation) without accessing e-KYC API service of UIDAI.

This is a simple off-line mechanism to quickly verify the legitimacy of the Aadhaar card. But, it does not ensure that the person holding the card is the owner of that Aadhaar number. It needs either manual check of photo against the face of the individual (like the way ID is verified at the entry of airports) or some form of electronic authentication using Aadhaar authentication API or agency specific authentication scheme. QR code based verification allows Aadhaar number holders to use their ID on a day-to-day purpose without using online e-KYC authentication. The verification through offline QR code can be used for those purposes or cases where proof of presence or proof of ownership of card is not required. The Aadhaar Act and Aadhaar

(Enrolment and Update)

Regulations, 2016 define special provision for enrolment of residents with biometric exception. Further, as per Regulation 14(i) of the Authentication Regulations, RE shall implement exception-handling mechanisms and backup identity authentication mechanisms to ensure seamless provision of authentication services to Aadhaar number holders. Accordingly, DBT Mission Cabinet Secretariat has issued a detailed circular dated December 19, 2017 regarding exception handling during use of Aadhaar in the benefit schemes of the Government.

(3) Are there any surprise checks, field studies done to check the authenticity of the exemption registers?

Ans.: As per Regulation 14(i) of the Authentication Regulations, this exception handling mechanism is to be implemented and monitored by the requesting entities and in case of the Government, their respective Ministries. Further, the DBT Mission Cabinet Secretariat had issued Circular dated December 19, 2017 on exception handling and audit of exceptions.

(4) Between the ages of 5-15 years, can a school, as an 'introducer', enrol a child without parental consent? Ans.: School officials, if permitted to act as 'introducer', can enrol only when there is a parental consent to enrol. The disclosure requirement as per Section 3(2) of the Aadhaar Act and the Aadhaar (Enrolment and Update) Regulations, 2016 (Schedule-I) is implemented through the enrolment form which is signed by the resident making it informed disclosure. In case of children, the consent form will be signed by the parent/guardian.

(5) Once a child attains the age of 18 years, is there any way for them to opt out or revoke consent? Ans.: It is not permissible under the Aadhaar Act. However, residents have the option of permanently locking their biometrics and only temporarily unlock it when needed for biometric authentication as per Regulation 11 of the Authentication Regulations.

(6) What is the status of the enrolments done by the 49,000 blacklisted enrolment operators? Please provide the number of enrolments done by them? Ans.: UIDAI has a policy to enforce the process guidelines and data quality check during the enrolment process. 100% of the enrolment done by operators undergoes a quality assurance check, wherein every enrolment passes through a human eye. Any Aadhaar enrolment found to be contrary to the UIDAI process, the enrolment itself gets rejected and Aadhaar is not generated. The resident is advised to re-enroll. Once an operator is blacklisted or suspended, further enrolments cannot be carried out by him during the time the order of blacklisting/suspension is valid.

(7) What are the total number of biometric De-duplication rejections that have taken place till date? In case an enrolment is rejected either for:

(a) duplicate enrolment and

(b) other technical reason under Regulation 14 of the Aadhaar Enrolment Regulations, what happens to the data packet that contains the stored biometric and demographic information?

Ans.: The total number of biometric de-duplication rejections that have taken place are 6.91 crores as on March 21, 2018. These figures do not pertain to the number of unique individuals who have been denied Aadhaar enrolment resulting in no Aadhaar issued to them. This figure merely pertains to the number of applications which have been identified by the Aadhaar de-duplication system as having matching biometrics to an existing Aadhaar number holder. The biometric de-duplication system is designed to identify as duplicate those cases where any one of the biometrics (ten fingers and two irises) match. However, very often it is found that all the biometrics match. It is highly improbable for the biometrics to match unless the same person has applied again.

There are a number of reasons why the same person might apply more than once. For instance, many individuals innocently apply for enrolment multiple times because of the delay in getting their Aadhaar cards due to postal delays, loss or destruction of their cards or confusion about how the system works. Each time one applies for Aadhaar, the system identifies her as a new enrolment but when it recognises that the individual's biometrics match with already those in the database, thereafter further checks, including manual check through experienced personnels, are done.

After that exercise, if it is found that the person is already registered, it rejects the enrolment application. One of their main reasons for rejection is that multiple people would put their biometric details like fingerprints for Aadhaar generation either as a fraudulent exercise or by mistake, which also would get rejected. There were many fakes and frauds in the earlier systems and several reports have found that almost 50% of the subsidies were getting pilfered away by fakes and duplicates in the system.

Then, there would also be several such people who may have tried to defraud the Aadhaar enrolment system as well but failed get multiple Aadhaar numbers due to the stringent Aadhaar de-duplication process. Thus, the mere fact that 6.23 crore enrolments have been rejected as biometric duplicates does not mean that 6.23 crore people have been denied an Aadhaar number as has been alleged by the petitioners. Any genuine person who does not have an Aadhaar number and whose enrolment has been rejected can always apply again for enrolment.

It is worth noting that none of the deduplication rejects have come forward to lodge complaints either with the Authority or with the Government about denial of Aadhaar number. None of them have even approached any Court of law. Evidently, the genuine residents have got themselves re-enrolled and the rest are those who were trying to reach the Aadhaar system by fraudulent means. That explains why no one has approached a court of law complaining denial of Aadhaar number. All the enrolment packets received by UIDAI (accepted/rejected) are archived in the CIDR irrespective of its status.

(8) If the figure of rejection of enrolment packets was 8 crore, as on 2015, what is the total rejection figure for enrolment packets as on date? How many field studies/physical verification have been done to ensure that these persons (who have been rejected) are indeed "False or duplicate" enrolments?

Ans.: The total rejection figure for enrolment packets is 18.0 cr. as on March 26, 2018. These rejections are due to various technical reasons like:

(i) data quality reject such as address incomplete, name incomplete, use of expletives in names, address etc. photo is of object, photo of photo, age photo mismatch etc.; and

(ii) OSI validation reject such as operator / supervisor / introducer validation failed, operator / supervisor / introducer / Head of Family biometric validation failed etc. Those whose enrolments have been rejected for any reason and who do not have Aadhaar can re-enrol and obtain Aadhaar. Rejection of enrolments do not mean that the person will never be able to get Aadhaar.

(9) What does "any other appropriate response" under Section 8(4) of the Aadhaar Act include? Ans.: "Any other appropriate responses" includes e-KYC or limited e-KYC data. As per Regulation 3 of Authentication Regulations, UIDAI provides two types of authentication facilities, namely -

(i) Yes/No authentication facility; and

(ii) e-KYC authentication facility. In Yes/No authentication, UIDAI provides the response as Yes or No along with relevant error codes, if any. In e-KYC authentication, UIDAI provides the demographic data along with photograph and in case of mismatch/error, the relevant error codes.

54) Questions and Answers to the queries raised by the petitioners in W.P. (C) No. 829 of 2013 entitled 'S.G. Vombatkere & Anr. v. Union of India

(1) Please confirm that no UIDAI official verifies the correctness of documents offered at the stage of enrolment/updating.

Ans.: As per UIDAI process, the verification of the documents is entrusted to the Registrar. For Verification based on Documents, the verifier present at the Enrolment Centre will verify the documents. Registrars/Enrolment agency must appoint personnel for the verification of documents.

(2) Please confirm that UIDAI does not know whether the documents shown at the time of enrolment/updating are genuine or false. Ans.: The answer is same as in (1) above.

(3) Please confirm: (a) UIDAI does not identify the persons it only matches the biometric information received at the time of authentication with its records and provides a Yes/No response; Ans.: Biometric authentication of an Aadhaar number holder is always performed as 1:1 biometric match against his/her Aadhaar number (identity) in CIDR. Based on the match, UIDAI provides Yes or No response. A "Yes" response means a positive identification of the Aadhaar number holder. Each enrolment is biometrically de-duplicated against all (1.2 billion) residents to issue the Aadhaar number (or Unique Identity).

(b) UIDAI takes no responsibility with respect to the correctness of the name, date of birth or address of the person enrolled. Ans.: The Name/Address/DOB are derived from the Proof of Identity (POI)/Proof of Address (POA) documents submitted during enrolments. The enrolment/update packet (encrypted) retains a scanned copy of the POI/POA documents used for the enrolment which can be reviewed in case of dispute. UIDAI maintains the update history of each Aadhaar number related to changes in name, address, date of birth etc.

(4) Please confirm:

(a) UIDAI takes no responsibility with respect to the correct identification of a person. Ans.: Please refer to Answer (1) above. Additionally, it may be stated that enrolment of Aadhaar is done through a resident enrolment process and verification of the POI/POA document is done against the acceptable documents, as per the UIDAI valid list of documents as provided in Schedule II and III Aadhaar (Enrolment and Update) Regulations, 2016 read with Regulation

10. UIDAI takes responsibility in creating and implementing standards, ensuring matching systems installed in CIDR work as they are designed to do, and providing options to Aadhaar holders in terms of controlling their identity (such as updating their data, locking their biometrics, etc.) and accessing their own authentication records. One of the key goals of Aadhaar is to issue a unique identity for the residents of India. Hence, each enrolment is biometrically de-duplicated against all (1.2 billion) residents to issue the Aadhaar number (or Unique Identity). Section 4 of Aadhaar lays down the properties of an Aadhaar number. Sub-section (3) of Section 4 reads as under:

"(3) An Aadhaar number, in physical or electronic form subject to authentication and other conditions, as may be specified by regulations, may be accepted as proof of identity of the Aadhaar number holder for any purpose." The requesting entities are at liberty to use any or multiple of authentication mode available under Regulation 4 of Aadhaar (Authentication) Regulation, 2016 as per their requirements and needs of security etc. (b) The biometric authentication is based on a probabilistic match of the biometric captured during authentication and the record stored with CIDR. Ans.: Biometric authentication is based on 1:1 matching and, therefore, in that sense it is not probabilistic. If biometrics are captured it will lead to successful authentication. If biometrics are not well captured during authentication or an impostor tries authentication, it will lead to authentication failure. Aadhaar Proof of Concept studies show that a vast majority of residents (>98%) can successfully authenticate using biometric modalities such fingerprints and/or iris. However, the Aadhaar Act and Regulations provides that an Aadhaar number holder cannot be denied service due to the failure of Aadhaar authentication. Hence, all Aadhaar applications must implement exception processes. Possible methods to implement the exception process include:

(i) Family Based Authentication: Family based applications such as PDS or Health applications may allow authentication by family members to allow resident to avail services.

(ii) Alternate Modalities: Some applications may use different modalities for exception handling. Alternate modalities include:

(a) Iris Authentication

(b) OTP Authentication (if allowed by policy)

(iii) Biometric Fusion: UIDAI is introducing face authentication as secondary authentication factor to reduce the rate of authentication failures, especially for senior citizens. At this time, face authentication will be used only conjunction with another authentication factor such as finger/iris/OTP.

(a) Face + Finger Fusion

(b) Face + Iris Fusion (c) Face + OTP Fusion

(iv) Non Aadhaar Based Exception process: Applications may implement non-Aadhaar based exception process to ensure that no resident is denied service. Applications need to monitor the use of exceptions in their applications to prevent misuse of the exception process.

(v) Accordingly, DBT Mission Cabinet Secretariat had issued a detailed circular dated December 19, 2017 regarding use of Aadhaar in benefit schemes of Government - exception handling.

(5) Please confirm that with respect to individuals under 15 years and over 60 years of age, biometric authentication is likely to fail due to changes in/fading of biometrics such as fingerprints.

Ans.: Though there is no conclusive evidence to say that biometric authentication success is dependent upon age, slightly higher authentication failure rates have been observed only for fingerprints for senior citizens above the age of 70. A number of exception processes are provided in answer to Question 4(b) above to prevent denial of service for failure of authentication. Further, in case of any issue in biometric authentication, an Aadhaar number holder may update his/her biometric at any of the Aadhaar enrolment centres, which is also provided for in the Aadhaar Act.

(6) Please confirm that the reasons why over 49000 enrolment operators were blacklisted include:

(i) failure to verify documents presented;

(ii) failure to maintain records of documents submitted;

(iii) misuse of information submitted; and

(iv) aiding or abetting false enrolments?

Ans.: UIDAI has a policy to enforce the process guidelines and data quality check during the enrolment process. 100% of the enrolments done by operators undergoes a quality assurance check. If any Aadhaar enrolment is found to be not as per the UIDAI process, the enrolment itself gets rejected and Aadhaar is not generated. If such mistake by an operator crosses a threshold defined in the policy, the operator is blacklisted/ removed from the UIDAI ecosystem. As such, of the 49,000 operators who have been blacklisted/removed from the UIDAI eco-system, all the enrolments which were in violation of the process were rejected in the QA stage. Enrolment operators may be blacklisted for the following reasons:

  • illegally charging the resident for Aadhaar enrolment
  • poor demographic data quality
  • invalid biometric exceptions
  • other process malpractice

(7) Please confirm:

(a) At the stage of enrolment, there is no verification as to whether a person is an illegal immigrant.

(b) At the stage of enrolment, there is no verification about a person being resident in India for 182 days or more in the past 12 months.

(c) Foreign nationals may enrol and are issued Aadhaar numbers.

(d) Persons retain their Aadhaar number even after they cease to be resident. This is true of foreign nationals as well.

Ans.:

(a) At the time of enrolment, verification is done based upon documents provided by the resident. In case any violation of prescribed guidelines comes to light, the concerned Aadhaar is omitted/deactivated.

(b) This has been included through the enrolment form where resident undertakes and signs the disclosure: "Disclosure under Section 3(2) of the Aadhaar (Targeted Delivery of Financial And Other Subsidies, Benefits and Services) Act, 2016 I confirm that I have been residing in India for at least 182 days in the preceding 12 months & information (including biometrics) provided by me to the UIDAI is my own and is true, correct and accurate. I am aware that my information (including biometrics) will be used for generation of Aadhaar and authentication. I understand that my identity information (except core biometric) may be provided to an agency only with my consent during authentication or as per the provisions of the Aadhaar Act. I have a right to access my identity information (except core biometrics) following the procedure laid down by UIDAI."

(c) Aadhaar is issued to the resident of India and the word 'resident' is defined in Section 2(v) of the Aadhaar Act. Aadhaar numbers may be issued to foreign nationals who are resident in India. Section 2(v) reads as under: " 'resident' means an individual who has resided in India for a period or periods amounting in all to one hundred and eighty-two days or more in the twelve months immediately preceding the date of application for enrolment;" A foreign national fulfilling the above criteria is eligible for Aadhaar, provided he submits the acceptable POI/POA document as per the UIDAI valid list of documents.

(d) As per the Aadhaar Act, an Aadhaar number is issued to a resident who has been residing in India for at least 182 days in the preceding 12 months. An Aadhaar number is issued to an individual for life and may be omitted/deactivated in case of violation of prescribed guidelines only. Ineligibility of a person to retain an Aadhaar number owing to become non-resident may be treated as a ground for deactivation of Aadhaar number and Regulation 28(l)(f) of the Aadhaar Enrolment Regulations. This is in keeping with Section 31(1) and (3) of the Aadhaar Act wherein it is an obligation on an Aadhaar number holder to inform the UIDAI of changes in demographic information and for the Authority to make the necessary alteration.

(8) Please confirm the Points of Service (POS) biometric readers are capable of storing biometric information. Ans.: UIDAI has mandated use of Registered Devices (RD) for all authentication requests. With RDs, biometric data is signed within the device/RD service using the provider key to ensure it is indeed captured live. The device provider RD service encrypts the PID block before returning to the host application. This RD service encapsulates the biometric capture, signing and encryption of biometrics all within it. Therefore, introduction of RD in Aadhaar authentication system rules out any possibility of use of stored biometric and replay of biometrics captured from other source. Requesting entities are not legally allowed to store biometrics captured for Aadhaar authentication under Regulation 17(1)(a) of the Authentication Regulations.

(9) Referring to slide/page 13, please confirm that the architecture under the Aadhaar Act includes:

(i) authentication user agencies (e.g. Kerala Dairy Farmers Welfare Fund Board);

(ii) authentication service agencies (e.g. Airtel); and

(iii) CIDR. Ans.: UIDAI appoints Requesting Entities (AUA/KUA) and Authentication Service Agency (ASA) as per Regulation 12 of Authentication Regulations. List of Requesting Entitles (AUA/KUA) and Authentication Service Agency appointed by UIDAI is available on UIDAI's website. An AUA/KUA can do authentication on behalf of other entities under Regulation 15 and Regulation 16.

(10) Please confirm that one or more entitles in the Aadhaar architecture described in the previous paragraph record the date and time of the authentication, the client IP, the device ID and purpose of authentication. Ans.: UIDAI does not ask requesting entities to maintain any logs related to IP address of the device, GPS coordinates of the device and purpose of authentication. However, AUAs like banks, telecom etc., in order to ensure that their systems are secure, frauds are managed, they may store additional information as per their requirement under their respective laws to secure their system. Section 32(3) of the Aadhaar Act specifically prevents the UIDAI from either by itself or through any entity under its control to keep or maintain any information about the purpose of authentication. Requesting entities are mandated to maintain following logs as per Regulation 18 of the Authentication Regulations.

These are:

(i) the Aadhaar number against which authentication is sought;

(ii) specified parameters of authentication request submitted;

(iii) specified parameters received as authentication response;

(iv) the record of disclosure of information to the Aadhaar number holder at the time of authentication; and

(v) record of consent of the Aadhaar number holder for authentication, but shall not, in any event, retain the PID information.

Further, even if a requesting entity captures any other data as per their own requirement, UIDAI will only audit the authentication logs maintained by the requesting entity as per Regulation 18(1) of the Authentication Regulations. ASAs are not permitted to maintain any logs related to IP address of the device, GPS coordinates of the device etc. ASAs are mandated to maintain logs as per Regulation 20 of the Authentication Regulations:

(i) identity of the requesting entity;

(ii) parameters of authentication request submitted; and

(iii) parameters received as authentication response. Provided that no Aadhaar number, PID information, device identity related data and e-KYC response data, where applicable, shall be retained.

(11) Referring to slide/page 7 and 14, please confirm that 'traceability' features enable UIDAI to track the specific device and its location from where each and every authentication takes place.

Ans.: UIDAI gets the AUA code, ASA code, unique device code, registered device code used for authentication. UIDAI does not get any information related to the IP address or the GPS location from where authentication is performed as these parameters are not part of authentication (v2.0) and e-KYC (v2.1) API UIDAI would only know from which device the authentication has happened, through which AUA/ASA etc.

This is what the slides meant by traceability. UIDAI does not receive any information about at what location the authentication device is deployed, its IP address and its operator and the purpose of authentication. Further, the UIDAI or any entity under its control is statutorily barred from collecting, keeping or maintaining any information about the purpose of authentication under Section 32(3) of the Aadhaar Act.

Summing up the Scheme:

55) The whole architecture of Aadhaar is devised to give unique identity to the citizens of this country. No doubt, a person can have various documents on the basis of which that individual can establish her identify. It may be in the form of a passport, Permanent Account Number (PAN) card, ration card and so on. For the purpose of enrolment itself number of documents are prescribed which an individual can produce on the basis of which Aadhaar card can be issued. Thus, such documents, in a way, are also proof of identity.

However, there is a fundamental difference between the Aadhaar card as a mean of identity and other documents through which identity can be established. Enrolment for Aadhaar card also requires giving of demographic information as well as biometric information which is in the form of iris and fingerprints. This process eliminates any chance of duplication. It is emphasised that an individual can manipulate the system by having more than one or even number of PAN cards, passports, ration cards etc.

When it comes to obtaining Aadhaar card, there is no possibility of obtaining duplicate card. Once the biometric information is stored and on that basis Aadhaar card is issued, it remains in the system with the Authority. Wherever there would be a second attempt for enrolling for Aadhaar and for this purpose same person gives his biometric information, it would immediately get matched with the same biometric information already in the system and the second request would stand rejected. It is for this reason the Aadhaar card is known as Unique Identification (UID). Such an identity is unparalleled.

56) There is, then, another purpose for having such a system of issuing unique identification cards in the form of Aadhaar card. A glimpse thereof is captured under the heading 'Introduction' above while mentioning how and under what circumstances the whole project was conceptualised. To put it tersely, in addition to enabling any resident to obtain such unique identification proof, it is also to empower marginalised section of the society, particularly those who are illiterate and living in abject poverty or without any shelter etc. It gives identity to such persons also. Moreover, with the aid of Aadhaar card, they can claim various privileges and benefits etc. which are actually meant for these people. Identity of a person has a significance for every individual in his/her life.

In a civilised society every individual, on taking birth, is given a name. Her place of birth and parentage also becomes important as she is known in the society and these demographic particulars also become important attribute of her personality. Throughout their lives, individuals are supposed to provide such information: be it admission in a school or college or at the time of taking job or engaging in any profession or business activity, etc. When all this information is available in one place, in the form of Aadhaar card, it not only becomes unique, it would also qualify as a document of empowerment. Added with this feature, when an individual knows that no other person can clone her, it assumes greater significance.

57) Thus, the scheme by itself can be treated as laudable when it comes to enabling an individual to seek Aadhaar number, more so, when it is voluntary in nature. Howsoever benevolent the scheme may be, it has to pass the muster of constitutionality. According to the petitioners, the very architecture of Aadhaar is unconstitutional on various grounds, glimpse whereof can be provided at this stage:

Gist of the challenge to the Aadhaar Scheme as well as the Act:

58) The petitioners accept that the case at hand is unique, simply because of the reason that the programme challenged here is itself without precedent. According to them, no democratic society has adopted a programme that is similar in its command and sweep. The case is about a new technology that the Government seeks to deploy and a new architecture of governance that it seeks to build on this technology. The petitioners are discrediting the Government's claim that biometric technology employed and the Aadhaar Act is greatly beneficial. As per the petitioners, this is an inroad into the rights and liberties of the citizens which the Constitution of India guarantees. It is intrusive in nature. At its core, Aadhaar alters the relationship between the citizen and the State. It diminishes the status of the citizens. Rights freely exercised, liberties freely enjoyed, entitlements granted by the Constitution and laws are all made conditional, on a compulsory barter. The barter compels the citizens to give up their biometrics 'voluntarily', allow their biometrics and demographic information to be stored by the State and private operators and then used for a process termed 'authentication'. According to them, by the very scheme of the Act and the way it operates, it has propensity to cause 'civil death' of an individual by simply switching of Aadhaar of that person. It is the submission of the petitioners that the Constitution balances rights of individuals against State interest. The Aadhaar completely upsets this balance and skews the relationship between the citizen and the State enabling the State to totally dominate the individual.

59) The challenge is directed at the constitutional validity of the following facets of Aadhaar:

(i) The Aadhaar programme that operated between January 28, 2009 until the bringing into force of the Aadhaar Act on July 12, 2016.

(ii) The Aadhaar Act (and alternatively certain provisions of that Act).

(iii) Elements of the Aadhaar project or programme that continues to operate, though not within the cover of the Aadhaar Act.

(iv) Specific Regulations framed under the Aadhaar Act, illustratively the Aadhaar (Authentication) Regulations, 2016.

(v) A set of subordinate legislation in the form of statutory rules/regulations including the Money Laundering (Amendment) Rules, 2017.

(vi) All notifications (nearly 139) issued under Section 7 of the Aadhaar Act (assuming the Act is upheld) insofar as they make Aadhaar mandatory for availing certain benefits/services/subsidies, including PDS, MGNREGA and social security pension.

(vii) Actions on the part of the authorities to make Aadhaar mandatory even where not covered by Section 7, inter alia: Actions by CBSE, NEET, JEE and UGC requirements for scholarship.

(viii) Specifically, actions on part of the Government mandating linking of mobile phones and Aadhaar vide DoT circular dated March 23, 2017.

(ix) Section 139AA of the Income Tax Act, 1961 insofar as it violates Article 21 by mandating linking Aadhaar to PAN and requiring Aadhaar linkage for filing returns.

60) Apart from the declaratory reliefs regarding ultra vires and certiorari to quash the provisions/actions enumerated above, there are certain other reliefs that are also sought, including:

(i) Suitable declarations regarding the physical autonomy of a person over her own body qua the Indian State.

(ii) Mandatory directions requiring the respondents to give an option to persons who are enrolled with the Aadhaar programme to opt out and to delete the data with suitable certification for compliance.

(iii) Mandatory directions to all concerned authorities that should the Aadhaar Act, etc. be upheld, nevertheless, every person must be entitled to avail services, benefits etc. through alternative means of identification. Negatively, nothing can be withheld from a citizen merely because he/she does not have an Aadhaar Card or does not wish to use their Aadhaar Card.

(iv) Mandatory directions consistent with the fundamental right to privacy and the right of a citizen to be let alone that no electronic trial or record of his/her authentication be maintained.

61) On the aforesaid premise, the petitioners point out following heads of challenge:

Surveillance:

62) The project creates the architecture for pervasive surveillance and unless the project is stopped, it will lead to an Orwellian State where every move of the citizen is constantly tracked and recorded by the State. The architecture of the project comprises a Central Identities Data Repository (CIDR) which stores and maintains authentication transaction data. The authentication record comprises the time of authentication and the identity of the requesting entity. Based on this architecture it is possible for the State to track down the location of the person seeking authentication. Since the requesting entity is also identified, the activity that the citizen is engaging in is also known.

Violation of Fundamental Right to Privacy:

63) The fundamental right to privacy is breached by the Aadhaar project and the Aadhaar Act in numerous ways. Following are the illustrations given by the petitioners:

(a) Between 2009-10 and July 2016 the project violated the right to privacy with respect to personal demographic as well as biometric information collected, stored and shared as there was no law authorising these actions.

(b) During both the pre-Act and post-Act periods, the project continues to violate the right to privacy by requiring individuals to part with demographic as well as biometric information to private enrolling agencies.

(c) By enabling private entities to use the Aadhaar authentication platform, the citizen's right to informational privacy is violated inasmuch as the citizen is compelled to 'report' his/her actions to the State.

(d) Even where a person is availing of a subsidy, benefit or service from the State, mandatory authentication through the Aadhaar platform (without an option to the citizen to use an alternative mode of identification) violates the right to informational privacy.

(e) With Aadhaar being made compulsory for holding a bank account, operating a cell phone, having a valid PAN, holding mutual funds, securing admission to school, taking a board examination, etc. the citizen has no option but to obtain Aadhaar. Compelling the citizen to part with biometric information violates individual autonomy and dignity. (f) In a digital society an individual has the right to protect himself by controlling the dissemination of personal information, including biometric information. Compelling an individual to establish his identity by planting her biometric at multiple points of service violates privacy involving the person.

(g) The seeding of Aadhaar in distinct databases enables the content of information about an individual that is stored in different silos to be aggregated. This enables the State to build complete profiles of individuals violating privacy through the convergence of data.

Limited Government:

64) A fundamental feature of the Constitution is the sovereignty of the people with limited Government authority. The Constitution limits governmental authority in various ways, amongst them Fundamental Rights, the distribution of powers amongst organs of the State and the ultimate check by way of judicial review. The Aadhaar project is destructive of the limited Government. The Constitution is not about the power of the State, but about the limits on the power of the State. Post Aadhaar, the State will completely dominate the citizen and alter the relationship between citizen and the State. The features of a totalitarian state is seen from:

(a) A person cannot conduct routine activities such as operating a bank account, holding an investment in mutual funds, receiving government pension, receiving scholarship, receiving food rations, operating a mobile phone without the State knowing about these activities.

(b) The State can build a profile of the individual based on the trial of authentication from which the nature of the citizen's activity can be determined.

(c) By disabling Aadhaar the State can cause civil death of the person.

(d) By making Aadhaar compulsory for other activities such as air travel, rail travel, directorship in companies, services and benefits extended by the State Governments and Municipal Corporations, etc. there will be virtually no zone of activity left where the citizen is not under the gaze of the State. This will have a chilling effect on the citizen.

(e) In such a society, there is little or no personal autonomy. The State is pervasive, and dignity of the individual stands extinguished.

(f) This is an inversion of the accountability in the Right to Information age: instead of the State being transparent to the citizen, it is the citizen who is rendered transparent to the State.

Impugned Act illegally passed as a 'Money Bill':

65) The Bill No. 47 of 2016 introduced in the Lok Sabha and which upon passage became the impugned Act was not a Money Bill in terms of Article 110 of the Constitution of India. Even though the object and purpose of the impugned legislation states that it is to be used for the delivery of subsidies, benefits and services, expenditure for which is incurred from the Consolidated Fund of India, the scope of the impugned Act is far beyond what is envisaged under Article 110.

Inasmuch as the impugned Act has not followed the constitutional procedure mandated for the passage of a law by disguising the statute as a 'Money Bill', there is no valid legislative process that has been followed in this case. The legislative process being colourable and since judicial review extends wherever Part III rights are violated, the Aadhaar Act is liable to be struck down.

Procedure followed violates Articles 14 and 21 of the Constitution:

66) The procedure adopted by the respondents, both pre-Act and post-Act, is arbitrary and in violation of Articles 14 and 21 of the Constitution because:

(a) There is no informed consent at the time of enrolment. Individuals are not told about crucial aspects such as potential misuse of the information, the commercial value of the information, the storage of information in a centralised database, that the information supplied could be used against the individual in criminal proceedings pursuant to a court order, there is no optout option, the entire enrolment process is conducted by private entities without any governmental supervision, etc.

(b) UIDAI has no direct relationship with the enrolling agency which collects sensitive personal information (biometric and demographic).

(c) The data collected and uploaded in to the CIDR is not verified by any Government official designated by the UIDAI. The data collected and stored lacks integrity.

(d) The procedure at the stage of enrolment and authentication enables the enrolling agency as well as the 'requesting entity' to capture, store and misuse/use the biometric as well as demographic information without the UIDAI having any control over such misuse/use.

Unreliability of Biometrics and Exclusion:

67) The foundation of the project, i.e. biometrics, is an unreliable and untested technology. Moreover, biometric exceptions severely erode reliability. The biometric authentication system works on a probabilistic model. Consequently, entitlements are reduced from certainty to a chance delivery where the biometrics match. Across the country several persons are losing out on their entitlements, for say food rations, because of a biometric mismatch resulting in them being excluded from various welfare schemes. The project is not an 'identity' project but an 'identification' exercise. Unless the biometrics work, a person in flesh and blood, does not exist for the State.

Illegal Object:

68) It is submitted before us that the objective of creating a single pervasive identification over time is itself illegal. There are several facets to the illegality and amongst them is the very negation of an individual citizen's freedom to identify through different means. The coercive foundation of the impugned Act is in substance an illegal objective that renders the statute ultra vires Article 14 of the Constitution of India.

Democracy, Identity and Choice:

69) A citizen or resident in a democratic society has a choice to identify himself/herself through different modes in the course of his/her interactions generally in society as well as his/her interactions with the State. Mandating identification by only one highly intrusive mode is excessive, disproportionate and violates Articles 14, 19 and 21.

Children:

70) As per the petitioners, there is no justification to include children in the Aadhaar programme for various reasons.

71) It may also be recorded at this juncture itself that insofar as the Aadhaar Act is concerned, following provisions thereof are specifically attacked as unconstitutional:

(i) Section 2(c) and 2(d) - authentication and authentication record, read with Section 32

(ii) Section 2(h) read with Section 10 of CIDR

(iii) Section 2(l) read with Regulation 23 of the Aadhaar (Enrolment and Updates) Regulation - 'enrolling agency'

(iv) Section 2

(v) - 'resident'

(v) Section 3 - Aadhaar Number

(vi) Section 5 - Special treatment to children

(vii) Section 6 - Update of information

(viii) Section 7

(ix) Section 8

(x) Section 9

(xi) Chapter IV - Sections 11 to 23

(xii) Sections 23 and 54 - excessive delegation

(xiii) Section 23(2)(g) read with Chapter VI & VII - Regulations 27 to 32 of the Aadhaar (Enrolment and Update) Regulations, 2016

(xiv) Section 29 (xv) Section 33

(xvi) Section 47

(xvii) Section 48 - Power of Central Government to supersede UIDAI

(xviii) Section 57

(xix) Section 59

Some Introductory Remarks:

72) Before proceeding further, it would be necessary to state here the approach which we have adopted in dealing with various issues that are raised in these petitions. That may help in understanding the manner in which the matter is dealt with. This necessitates some introductory remarks:

(i) We may remark at this stage itself that many of the heads of challenge which are taken note of above are overlapping and, therefore, discussion on one aspect may provide substantial answers to the arguments advanced under the other head of challenge as well. Our endeavour, therefore, would be to eschew the repetitive discussion. However, our anxiety to bring clarity and also in order to have continuity of thought while discussing a particular head, may have led to some repetitions at different places. In any case, we would be dealing with the various heads of challenge, one by one, so as to cover the entire spectrum.

(ii) In order to have a smooth flow of discussion, we are going to formulate the questions which arise in all these petitions and then decide those issues. Since, number of advocates7 appeared on both sides, many of the arguments addressed by them were overlapping and repetitive. In this scenario, we deem it proper to collate the arguments of all the counsel and present the same while undertaking the discussion on each of the issues. Thus, in the process, we would not be referring to each counsel and her arguments.

We may, however, intend to place on record that all the counsel on both sides had taken the advocacy to its highest level by presenting all possible nuances of the complex issues involved. In the process, plethora of literature on such issues, including the law prevailing across the Globe was cited. We, therefore, place on record our appreciation of the sublime nature of lawyering in this case.

(iii) As pointed out above, many number of foreign judgments were cited during arguments. The history of this Court reflects that this Court has liberally accepted the good practices, rules of interpretation and norms of constitutional courts of other jurisdictions. In fact, in drafting Indian Constitution itself, the framing fathers had studied various foreign models and adopted provisions from different Constitutions after deep reflection. Constitutional influences of system prevailing in some of the countries on Indian Constitution can be summarised as under:

From UK

- Parliamentary Type of Government

 

- Cabinet System of Ministers - Bicameral Parliament - Lower House more powerful

 

- Council of Minsters responsible to Lower House

From US

- Written Constitution - Executive head of State known as President and his being the Supreme Commander of the Armed Forces

 

- Vice-President as the ex-officio Chairman of Rajya Sabha

 

- Bill of Rights

 

- Supreme Court

 

- Provision of States

 

- Independence of Judiciary and judicial review

 

- Preamble - Removal of Supreme Court and High Court Judges

From USSR

- Fundamental Duties

 

- Five Year Plan

From Australia

- Concurrent List

 

- Language of the preamble

 

- Provision regarding trade, commerce and intercourse

From Japan

- Law on which the Supreme Court function

From Weimar Constitution of Germany

- Suspension of Fundamental Rights during the emergency

From Canada

- Scheme of federation with a strong centre

 

- Distribution of powers between the centre and the states and placing residuary powers with the centre

From Ireland

- Concept of Directive Principles of States Policy

 

- Method of election of President

 

- Nomination of members in the Rajya Sabha by the President

It was, therefore, but natural to find out the manner in which particular provisions have been interpreted by the constitutional courts of the aforesaid countries. Case law of this Court would reflect this for interpreting the provisions relating to 'Inter-State Trade, Commerce & Intercourse'. The case law of the Australian High Court is liberally referred as this Chapter is influenced by the provisions contained in the Australian Constitution. Likewise, for interpreting provisions of Part IX of the Constitution on 'Relations between the Union and the States' where Canadian model is followed, the judgments of Canadian Supreme Court have been cited by this Court from time to time.

Influence of U.S. Constitutionalism, tempered by the wish to preserve India's own characteristics, while interpreting chapter relating to fundamental rights as well as power of judicial review is also discernible. A critical analysis of the various judgments of this Court, where foreign precedents are cited8, formulates four typologies of use, namely:

(a) Where the court relies on foreign precedents for guidance on general constitutional principles and when necessary to;

(b) Where the court frames the issue posed for adjudication and/or to formulate evaluative test and frameworks;

(c) To distinguish the country's context from the foreign one9;

(d) To 'read' in the Constitution implied or unenumerated rights10. It can be said that though this Court has been liberally relying upon the judgments of the constitutional courts of other countries, particularly when it comes to human rights discourse, at the same time, in certain situations, note of caution is also added to give a message that the judgment of other jurisdiction cannot be relied blindly and it would depend as to whether a particular judgment will fit in Indian context or not. As a matter of fact, in Basheshar Nath, the Court discussed the doctrine of waiver in force in the United States and rejected it firmly stating that: :...the doctrine of waiver enunciated by some American Judges in construing the American Constitution cannot be introduced in our Constitution...We are not for the moment convinced that this theory has any relevancy in construing the fundamental rights conferred by Part III of the Constitution."

On the contrary, in Romesh Thappar, the Court completely based its decision to strike down a law restricting the free circulation of newspapers on two US precedents, Ex parte Jackson11 and Lovell v. City of Griffin12, and affirmed that the protection of freedom of expression in India follows the maxim of Madison that the Court transposed from its quotation in Near v. Minnesota13, according to which 'it is better to leave a few of its noxious branches to their luxuriant growth, than, by pruning them away, to injure the vigour of those yielding the proper fruits'. Likewise, the role of foreign precedents in a majority opinion is confirmed in the decision of His Holiness Kesavananda Bharati Sripadagalvaru which clarifies Parliament's power to amend the Constitution.

At the same time, looking to the use of foreign precedents in this judgment, Justice S.M. Sikri (as His Lordship then was), dealing with the interpretation of Article 368 of the Constitution, first of all, highlighted that: "No other Constitution in the world is like ours. No other Constitution combines under its wings such diverse peoples, numbering now more than 550 millions [sic], with different languages and religions and in different stages of economic development, into one nation, and no other nation is faced with such vast socio-economic problems. After this premise, however, His Lordship accepts, in order to define what an 'amendment' is according to the Indian Constitution, the reasoning of Lord Greene in Bidie v. General Accident, Fire and Life Assurance Corporation14 and that of Justice Holmes in Towne v. Eisner15, which affirm that to understand a word it is necessary to understand the context in which it is inserted.

To strengthen this, James v. Commonwealth of Australia16 is also referred to. We have stated the trend in brief with a purpose. Number of judgments of U.K. Courts, German Supreme Court, European Commission of Human Rights (ECHR), U.S. Supreme Court etc. were cited. However, there is no similarity in approach by these Courts in deciding a particular issue by applying different principles, particularly when it comes to the issues of data protection and privacy.

In this backdrop, it becomes necessary, while referring to these judgments, to keep in mind the ethos, cultural background and vast socio-economic problems of this country and on that basis to accept a particular norm, or for that matter, to formulate a constitutional norm which is relevant in our context. That is the endeavour which is made by us. (iv) Many arguments of the petitioners relate to the working of the system. The petitioners had argued that the architecture of Aadhaar, by its very nature, is probabilistic and, therefore, it may result in exclusion, in many cases. Therefore, rather than extending subsidies, benefits and services to the section of society for which these are meant, it may have the tendency to exclude them from receiving such subsidies, benefits and services.

The respondents, on the other hand, have stated on affidavit that the attempt of the respondents would be to ensure that no individual who is eligible for such benefits etc. is deprived form receiving those benefits, even when in a particular case, it is found that on authentication, his fingerprints or iris are not matching and is resulting into failure. It was clarified that since Aadhaar project is an ongoing project, there may be some glitches in its working and there is a continuous attempt to make improvements in order to ensure that it becomes foolproof over a period of time.

We have eschewed detailed discussion in respect of those arguments, which may not have much relevance when judging the constitutional validity of the Act and the scheme. However, such arguments of exclusion etc. leading to violation of Articles 14 and 21 are dealt with at an appropriate stage. But the argument based on alleged inaccurate claims of savings by the Authority/Union of India in respect of certain programmes, like saving of USD 11 billion per annum due to the Aadhaar project, as well as savings in the implementation of the MGNREGA scheme, LPG subsidy, PDS savings need not detain us for long. Such rebuttals raised by the petitioners may have relevance insofar as working of the Act is concerned. That by itself cannot be a ground to invalidate the statute.

(v) As mentioned above, notwithstanding the passions and emotions evoked on both sides in equal measure, this Court has adopted a lambent approach while dealing with the issues raised, having a posture of calmness coupled with objective examination of the issues on the touchstone of the constitutional provisions. We are in the age of constitutional democracy, that too substantive and liberal democracy. Such a democracy is not based solely on the rule of people through their representatives which is known as "formal democracy".

It also has other precepts like rule of law, human rights, independence of judiciary, separation of powers, etc. The framers of Indian Constitution duly recognized the aforesaid precepts of liberal and substantive democracy with rule of law as an important and fundamental pillar. At the same time, in the scheme of the Constitution, it is the judiciary which is assigned the role of upholding rule of law and protecting the Constitution and democracy. The essence of rule of law is to preclude arbitrary action. Dicey, who propounded the rule of law, gave distinct meaning to this concept and explained that it was based on three kindered features, which are as follows:

(i) absence of arbitrary powers on the part of authorities;

(ii) equality before law; and

(iii) the Constitution is part of the ordinary law of the land. There are three aspects of the rule of law, which are as follows:

(a) A formal aspect which means making the law rule.

(b) A jurisprudential or doctrinal aspect which is concerned with the minimal condition for the existence of law in society.

(c) A substantive aspect as per which the rule of law is concerned with properly balancing between the individual and society. When we talk of jurisprudential rule of law, it includes certain minimum requirements without which a legal system cannot exist and which distinguished a legal system from an automatic system where the leader imposes his will on everyone else. Professor Lon Fuller has described these requirements collectively as the 'inner morality of law'. In addition to jurisprudential concept, which is important and an essential condition for the rule of law, the substantive concept of the rule of law is equally important and inseparable norm of the rule of law in real sense. It encompasses the 'right conception' of the rule of law propounded by Dworkin.

It means guaranteeing fundamental values of morality, justice, and human rights, with a proper balance between these and the other needs of the society. Justice Aharon Barak, former Chief Justice of Israel, has lucidly explained this facet of rule of law in the following manner: "The rule of law is not merely public order, the rule of law is social justice based on public order. The law exists to ensure proper social life. Social life, however, is not a goal in itself but a means to allow the individual to live in dignity and develop himself. The human being and human rights underlie this substantive perception of the rule of law, with a proper balance among the different rights and between human rights and the proper needs of society.

The substantive rule of law "is the rule of proper law, which balances the needs of society and the individual". This is the rule of law that strikes a balance between society's need for political independence, social equality, economic development, and internal order, on the one hand, and the needs of the individual, his personal liberty, and his human dignity on the other. The Judge must protect this rich concept of the rule of law." The 'rule of law', which is a fine sonorous phrase, is dynamic and ever expanding and can be put alongside the brotherhood of man, human rights and human dignity. About the modern rule of law, Professor Garner observed:

"The concept in its modern dress meets a need that has been felt throughout the history of civilization, law is not sufficient in itself and it must serve some purpose. Man is a social animal, but to live in society he has had to fashion for himself and in his own interest the law and other instruments of government, and as a consequence those must to some extent limit his personal liberties. The problem is how to control those instruments of government in accordance with the Rule of Law and in the interest of the governed." Likewise, the basic spirit of our Constitution is to provide each and every person of the nation equal opportunity to grow as a human being, irrespective of race, caste, religion, community and social status. Granville Austin while analyzing the functioning of Indian Constitution in first 50 years has described three distinguished strands of Indian Constitution:

(i) protecting national unity and integrity,

(ii) establishing the institution and spirit of democracy; and

(iii) fostering social reforms.

The strands are mutually dependent and inextricably intertwined in what he elegantly describes as a 'seamless web'. And there cannot be social reforms till it is ensured that each and every citizen of this country is able to exploit his/her potentials to the maximum. The Constitution, although drafted by the Constituent Assembly, was meant for the people of India and that is why it is given by the people to themselves as expressed in the opening words "We the People...". What is the most important gift to the common person given by this Constitution is "fundamental rights" which may be called human rights as well. Speaking for the vision of our founding fathers, in State of Karnataka & Anr. v. Shri Ranganatha Reddy & Anr.17, this Court speaking through Justice Krishna Iyer observed: "The social philosophy of the Constitution shapes creative judicial vision and orientation.

Our nation has, as its dynamic doctrine, economic democracy sans which political democracy is chimerical. We say so because our Constitution, in Parts III and IV and elsewhere, ensouls such a value system, and the debate in this case puts precisely this soul in peril....Our thesis is that the dialectics of social justice should not be missed if the synthesis of Parts III and Part IV is to influence State action and court pronouncements. Constitutional problems cannot be studied in a socio-economic vacuum, since socio-cultural changes are the source of the new values, and sloughing off old legal thought is part of the process the new equity- loaded legality. A judge is a social scientist in his role as constitutional invigilator and fails functionally if he forgets this dimension in his complex duties."

In Dattatraya Govind Mahajan v. State of Maharashtra18 the spirit of our Constitution was explained thus: "Our Constitution is a tryst with destiny, preamble with lucent solemnity in the words 'Justice - social, economic and political.' The three great branches of Government, as creatures of the Constitution, must remember this promise in their fundamental role and forget it at their peril, for to do so will be a betrayal of chose high values and goals which this nation set for itself in its objective Resolution and whose elaborate summation appears in Part IV of the Paramount Parchment.

The history of our country's struggle for independence was the story of a battle between the forces of socio-economic exploitation and the masses of deprived people of varying degrees and the Constitution sets the new sights of the nation.....Once we grasp the dharma of the Constitution, the new orientation of the karma of adjudication becomes clear. Our founding fathers, aware of our social realities, forged our fighting faith and integrating justice in its social, economic and political aspects. While contemplating the meaning of the Articles of the Organic Law, the Supreme Court shall not disown Social Justice."

In National Human Rights Commission v. State of Arunachal Pradesh19, the Supreme Court explained it again, as under: "We are a country governed by the Rule of Law. Our Constitution confers certain rights on every human being and certain other rights on citizens. Every person is entitled to equality before the law and equal protection of the laws." Looking the matter from this angle, when the judiciary is assigned the role of upholding the rule of law, the first function of the judiciary is to protect the democracy as well as the Constitution.

At the same time, second role of the Court, which is equally important, is to bridge the gap between the law and the society. In the process of undertaking this role, a third role, which is of equal significance also springs up. Judiciary is also to ensure that social and economic justice is meted out to the deserving lot by affirmative action of the State. Our attempt has been to strive the balancing of competing Constitutional norms. The complex issues are dealt with keeping in view this role of the Supreme Court as assigned by the Constitution; albeit within the constitutional norms.

Scope of Judicial Review:

73) The aforesaid discussion leads us to pick up and discuss another strand viz. the scope of judicial review in such matters.

74) Judicial review means the Supremacy of law. It is the power of the court to review the actions of the Legislature, the Executive and the Judiciary itself and to scrutinize the validity of any law or action. It has emerged as one of the most effective instruments of protecting and preserving the cherished freedoms in a constitutional democracy and upholding principles such as separation of powers and rule of law. The Judiciary, through judicial review, prevents the decisions of other branches from impinging on the constitutional values. The fundamental nature of the Constitution is that of a limiting document, it curtails the powers of majoritarianism from hijacking the State. The power of review is the shield which is placed in the hands of the most judiciaries of constitutional democracies to enable the protection of the supreme document.

75) In Binoy Viswam v. Union of India & Ors.20, scope of judicial review of legislative Act was described in the following manner:

"76. Under the Constitution, Supreme Court as well as High Courts are vested with the power of judicial review of not only administrative acts of the executive but legislative enactments passed by the legislature as well. This power is given to the High Courts under Article 226 of the Constitution and to the Supreme Court under Article 32 as well as Article 136 of the Constitution. At the same time, the parameters on which the power of judicial review of administrative act is to be undertaken are different from the parameters on which validity of legislative enactment is to be examined. No doubt, in exercises of its power of judicial review of legislative action, the Supreme Court, or for that matter, the High Courts can declare law passed by Parliament or the State Legislature as invalid. However, the power to strike down primary legislation enacted by the Union or the State Legislatures is on limited grounds.

Courts can strike down legislation either on the basis that it falls foul of federal distribution of powers or that it contravenes fundamental rights or other constitutional rights/provisions of the Constitution of India. No doubt, since the Supreme Court and the High Courts are treated as the ultimate arbiter in all matters involving interpretation of the Constitution, it is the courts which have the final say on questions relating to rights and whether such a right is violated or not. The basis of the aforesaid statement lies in Article 13(2) of the Constitution which proscribes the State from making "any law which takes away or abridges the right conferred by Part III", enshrining fundamental rights. It categorically states that any law made in contravention thereof, to the extent of the contravention, be void.

77. We can also take note of Article 372 of the Constitution at this stage which applies to pre-constitutional laws. Article 372(1) reads as under:

"372. Continuance in force of existing laws and their adaptation.-

(1) Notwithstanding the repeal by this Constitution of the enactments referred to in Article 395 but subject to the other provisions of this Constitution, all the laws in force in the territory of India immediately before the commencement of this Constitution shall continue in force therein until altered or repealed or amended by a competent legislature or other competent authority."

In the context of judicial review of legislation, this provision gives an indication that all laws enforced prior to the commencement of the Constitution can be tested for compliance with the provisions of the Constitution by courts. Such a power is recognised by this Court in Union of India v. SICOM Ltd. In that judgment, it was also held that since the term "laws", as per Article 372, includes common law the power of judicial review of legislation, which is a part of common law applicable in India before the Constitution came into force, would continue to vest in the Indian courts.

78. ...These contours of the judicial review are spelled out in the clear terms in Rakesh Kohli, and particularly in the following paragraphs: (SCC pp. 321-22 & 325-27, paras 16-17, 26-28 & 30) "16. The statute enacted by Parliament or a State Legislature cannot be declared unconstitutional lightly. The court must be able to hold beyond any iota of doubt that the violation of the constitutional provisions was so glaring that the legislative provision under challenge cannot stand. Sans flagrant violation of the constitutional provisions, the law made by Parliament or a State Legislature is not declared bad.

17. This Court has repeatedly stated that legislative enactment can be struck down by court only on two grounds, namely (i) that the appropriate legislature does not have the competence to make the law, and (ii) that it does not (sic) take away or abridge any of the fundamental rights enumerated in Part III of the Constitution or any other constitutional provisions. In McDowell and Co. while dealing with the challenge to an enactment based on Article 14, this Court stated in para 43 of the Report as follows: (SCC pp. 737-38) '43. ... A law made by Parliament or the legislature can be struck down by courts on two grounds and two grounds alone viz. (1) lack of legislative competence, and (2) violation of any of the fundamental rights guaranteed in Part III of the Constitution or of any other constitutional provision. There is no third ground. ... if an enactment is challenged as violative of Article 14, it can be struck down only if it is found that it is violative of the equality clause/equal protection clause enshrined therein. Similarly, if an enactment is challenged as violative of any of the fundamental rights guaranteed by sub-clauses (a) to (g) of Article 19(1), it can be struck down only if it is found not saved by any of the clauses (2) to (6) of Article 19 and so on.

No enactment can be struck down by just saying that it is arbitrary or unreasonable. Some or the other constitutional infirmity has to be found before invalidating an Act. An enactment cannot be struck down on the ground that court thinks it unjustified. Parliament and the legislatures, composed as they are of the representatives of the people, are supposed to know and be aware of the needs of the people and what is good and bad for them. The court cannot sit in judgment over their wisdom.'

xx xx xx

26. In Mohd. Hanif Quareshi, the Constitution Bench further observed that there was always a presumption in favour of constitutionality of an enactment and the burden is upon him, who attacks it, to show that there has been a clear violation of the constitutional principles. It stated in para 15 of the Report as under: (AIR pp. 740-41)

'15. ... The courts, it is accepted, must presume that the legislature understands and correctly appreciates the needs of its own people, that its laws are directed to problems made manifest by experience and that its discriminations are based on adequate grounds. It must be borne in mind that the legislature is free to recognise degrees of harm and may confine its restrictions to those cases where the need is deemed to be the clearest and finally that in order to sustain the presumption of constitutionality the court may take into consideration matters of common knowledge, matters of common report, the history of the times and may assume every state of facts which can be conceived existing at the time of legislation.'

27. The above legal position has been reiterated by a Constitution Bench of this Court in Mahant Moti Das v. S.P. Sahi.

28. In Hamdard Dawakhana v. Union of India, inter alia, while referring to the earlier two decisions, namely, Bengal Immunity Co. Ltd. and Mahant Moti Das, it was observed in para 8 of the Report as follows: (Hamdard Dawakhana case, AIR p. 559) '8. Therefore, when the constitutionality of an enactment is challenged on the ground of violation of any of the articles in Part III of the Constitution, the ascertainment of its true nature and character becomes necessary i.e. its subject-matter, the area in which it is intended to operate, its purport and intent have to be determined.

In order to do so it is legitimate to take into consideration all the factors such as history of the legislation, the purpose thereof, the surrounding circumstances and conditions, the mischief which it intended to suppress, the remedy for the disease which the legislature resolved to cure and the true reason for the remedy....' In Hamdard Dawakhana, the Court also followed the statement of law in Mahant Moti Das and the two earlier decisions, namely, Charanjit Lal Chowdhury v. Union of India and State of Bombay v. F.N. Balsara and reiterated the principle that presumption was always in favour of constitutionality of an enactment.

xx xx xx

30. A well-known principle that in the field of taxation, the legislature enjoys a greater latitude for classification, has been noted by this Court in a long line of cases. Some of these decisions are Steelworth Ltd. v. State of Assam [Steelworth Ltd. v. State of Assam, 1962 Supp (2) SCR 589], Gopal Narain v. State of U.P. [Gopal Narain v. State of U.P., AIR 1964 SC 370], Ganga Sugar Corpn. Ltd. v. State of U.P. [Ganga Sugar Corpn. Ltd. v. State of U.P., (1980) 1 SCC 223 : 1980 SCC (Tax) 90], R.K. Garg v. Union of India [R.K. Garg v. Union of India, (1981) 4 SCC 675 : 1982 SCC (Tax) 30] and State of W.B. v. E.I.T.A. India Ltd. [State of W.B. v. E.I.T.A. India Ltd., (2003) 5 SCC 239]"

(emphasis in original)

xx xx xx

83. It is, thus, clear that in exercise of power of judicial review, the Indian courts are invested with powers to strike down primary legislation enacted by Parliament or the State Legislatures. However, while undertaking this exercise of judicial review, the same is to be done at three levels. In the first stage, the Court would examine as to whether impugned provision in a legislation is compatible with the fundamental rights or the constitutional provisions (substantive judicial review) or it falls foul of the federal distribution of powers (procedural judicial review). If it is not found to be so, no further exercise is needed as challenge would fail.

On the other hand, if it is found that legislature lacks competence as the subject legislated was not within the powers assigned in the List in Schedule VII, no further enquiry is needed and such a law is to be declared as ultra vires the Constitution. However, while undertaking substantive judicial review, if it is found that the impugned provision appears to be violative of fundamental rights or other constitutional rights, the Court reaches the second stage of review. At this second phase of enquiry, the Court is supposed to undertake the exercise as to whether the impugned provision can still be saved by reading it down so as to bring it in conformity with the constitutional provisions. If that is not achievable then the enquiry enters the third stage. If the offending portion of the statute is severable, it is severed and the Court strikes down the impugned provision declaring the same as unconstitutional."

76) In support of the aforesaid proposition that an Act of the Parliament can be invalidated only on the aforesaid two grounds, passages from various judgments were extracted21. The Court also noted the observations from State of A.P. & Ors. v. MCDOWELL & Co. & Ors.22 wherein it was held that apart from the aforesaid two grounds, no third ground is available to validate any piece of legislation. In the process, it was further noted that in Rajbala & Ors. v. State of Haryana & Ors.23 (which followed MCDOWELL & Co. case), the Court held that a legislation cannot be declared unconstitutional on the ground that it is 'arbitrary' inasmuch as examining as to whether a particular Act is arbitrary or not implies a value judgment and courts do not examine the wisdom of legislative choices, and, therefore, cannot undertake this exercise.

77) The issue whether law can be declared unconstitutional on the ground of arbitrariness has received the attention of this Court in a Constitution Bench judgment in the case of Shayara Bano v. Union of India & Ors.24. R.F. Nariman and U.U. Lalit, JJ. discredited the ratio of the aforesaid judgments wherein the Court had held that a law cannot be declared unconstitutional on the ground that it is arbitrary. The Judges pointed out the larger Bench judgment in the case of Dr. K.R. Lakshmanan v. State of T.N. & Anr.25 and Maneka Gandhi v. Union of India & Anr.26 where 'manifest arbitrariness' is recognised as the third ground on which the legislative Act can be invalidated. Following discussion in this behalf is worthy of note:

"87. The thread of reasonableness runs through the entire fundamental rights chapter. What is manifestly arbitrary is obviously unreasonable and being contrary to the rule of law, would violate Article 14. Further, there is an apparent contradiction in the three-Judge Bench decision in McDowell [State of A.P. v. McDowell and Co., (1996) 3 SCC 709] when it is said that a constitutional challenge can succeed on the ground that a law is "disproportionate, excessive or unreasonable", yet such challenge would fail on the very ground of the law being "unreasonable, unnecessary or unwarranted".

The arbitrariness doctrine when applied to legislation obviously would not involve the latter challenge but would only involve a law being disproportionate, excessive or otherwise being manifestly unreasonable. All the aforesaid grounds, therefore, do not seek to differentiate between State action in its various forms, all of which are interdicted if they fall foul of the fundamental rights guaranteed to persons and citizens in Part III of the Constitution. 88. We only need to point out that even after McDowell [State of A.P. v. McDowell and Co., (1996) 3 SCC 709] , this Court has in fact negated statutory law on the ground of it being arbitrary and therefore violative of Article 14 of the Constitution of India. In Malpe Vishwanath Acharya v. State of Maharashtra [Malpe Vishwanath Acharya v. State of Maharashtra, (1998) 2 SCC 1] , this Court held that after passage of time, a law can become arbitrary, and, therefore, the freezing of rents at a 1940 market value under the Bombay Rent Act would be arbitrary and violative of Article 14 of the Constitution of India (see paras 8 to 15 and 31). xx xx xx

99. However, in State of Bihar v. Bihar Distillery Ltd. [State of Bihar v. Bihar Distillery Ltd., (1997) 2 SCC 453] , SCC at para 22, in State of M.P. v. Rakesh Kohli [State of M.P. v. Rakesh Kohli, (2012) 6 SCC 312 : (2012) 3 SCC (Civ) 481], SCC at paras 17 to 19, in Rajbala v. State of Haryana [Rajbala v. State of Haryana, (2016) 2 SCC 445], SCC at paras 53 to 65 and in Binoy Viswam v. Union of India [Binoy Viswam v. Union of India, (2017) 7 SCC 59], SCC at paras 80 to 82, McDowell [State of A.P. v. McDowell and Co., (1996) 3 SCC 709] was read as being an absolute bar to the use of "arbitrariness" as a tool to strike down legislation under Article 14. As has been noted by us earlier in this judgment, McDowell [State of A.P. v. McDowell and Co., (1996) 3 SCC 709] itself is per incuriam, not having noticed several judgments of Benches of equal or higher strength, its reasoning even otherwise being flawed. The judgments, following McDowell [State of A.P. v. McDowell and Co., (1996) 3 SCC 709] are, therefore, no longer good law."

78) The historical development of the doctrine of arbitrariness has been noticed by the said Judges in Shayara Bano in detail. It would be suffice to reproduce paragraphs 67 to 69 of the said judgment as the discussion in these paras provide a sufficient guide as to how a doctrine of arbitrariness is to be applied while adjudging the constitutional validity of a legislation.

"67. We now come to the development of the doctrine of arbitrariness and its application to State action as a distinct doctrine on which State action may be struck down as being violative of the rule of law contained in Article 14. In a significant passage, Bhagwati, J., in E.P. Royappa v. State of T.N. stated: (SCC p. 38, para 85) "85. The last two grounds of challenge may be taken up together for consideration. Though we have formulated the third ground of challenge as a distinct and separate ground, it is really in substance and effect merely an aspect of the second ground based on violation of Articles 14 and 16. Article 16 embodies the fundamental guarantee that there shall be equality of opportunity for all citizens in matters relating to employment or appointment to any office under the State.

Though enacted as a distinct and independent fundamental right because of its great importance as a principle ensuring equality of opportunity in public employment which is so vital to the building up of the new classless egalitarian society envisaged in the Constitution, Article 16 is only an instance of the application of the concept of equality enshrined in Article 14. In other words, Article 14 is the genus while Article 16 is a species. Article 16 gives effect to the doctrine of equality in all matters relating to public employment. The basic principle which, therefore, informs both Articles 14 and 16 is equality and inhibition against discrimination. Now, what is the content and reach of this great equalising principle?

It is a founding faith, to use the words of Bose, J., "a way of life", and it must not be subjected to a narrow pedantic or lexicographic approach. We cannot countenance any attempt to truncate its allembracing scope and meaning, for to do so would be to violate its activist magnitude. Equality is a dynamic concept with many aspects and dimensions and it cannot be "cribbed, cabined and confined" within traditional and doctrinaire limits. From a positivistic point of view, equality is antithetic to arbitrariness. In fact equality and arbitrariness are sworn enemies; one belongs to the rule of law in a republic while the other, to the whim and caprice of an absolute monarch. Where an act is arbitrary, it is implicit in it that it is unequal both according to political logic and constitutional law and is therefore violative of Article 14, and if it effects any matter relating to public employment, it is also violative of Article 16. Articles 14 and 16 strike at arbitrariness in State action and ensure fairness and equality of treatment.

They require that State action must be based on valid relevant principles applicable alike to all similarly situate and it must not be guided by any extraneous or irrelevant considerations because that would be denial of equality. Where the operative reason for State action, as distinguished from motive inducing from the antechamber of the mind, is not legitimate and relevant but is extraneous and outside the area of permissible considerations, it would amount to mala fide exercise of power and that is hit by Articles 14 and 16. Mala fide exercise of power and arbitrariness are different lethal radiations emanating from the same vice: in fact the latter comprehends the former. Both are inhibited by Articles 14 and 16."

(emphasis supplied)

68. This was further fleshed out in Maneka Gandhi v. Union of India, where, after stating that various fundamental rights must be read together and must overlap and fertilise each other, Bhagwati, J., further amplified this doctrine as follows: (SCC pp. 283-84, para 7) "The nature and requirement of the procedure under Article 21 7. Now, the question immediately arises as to what is the requirement of Article 14: what is the content and reach of the great equalising principle enunciated in this article? There can be no doubt that it is a founding faith of the Constitution. It is indeed the pillar on which rests securely the foundation of our democratic republic. And, therefore, it must not be subjected to a narrow, pedantic or lexicographic approach.

No attempt should be made to truncate its all-embracing scope and meaning, for to do so would be to violate its activist magnitude. Equality is a dynamic concept with many aspects and dimensions and it cannot be imprisoned within traditional and doctrinaire limits. We must reiterate here what was pointed out by the majority in E.P. Royappa v. State of T.N. , namely, that: (SCC p. 38, para 85) '85. ... From a positivistic point of view, equality is antithetic to arbitrariness. In fact equality and arbitrariness are sworn enemies; one belongs to the rule of law in a republic, while the other, to the whim and caprice of an absolute monarch. Where an act is arbitrary, it is implicit in it that it is unequal both according to political logic and constitutional law and is therefore violative of Article 14....' Article 14 strikes at arbitrariness in State action and ensures fairness and equality of treatment. The principle of reasonableness, which legally as well as philosophically, is an essential element of equality or non-arbitrariness pervades Article 14 like a brooding omnipresence and the procedure contemplated by Article 21 must answer the test of reasonableness in order to be in conformity with Article 14. It must be "right and just and fair" and not arbitrary, fanciful or oppressive; otherwise, it would be no procedure at all and the requirement of Article 21 would not be satisfied."

(emphasis supplied)

69. This was further clarified in A.L. Kalra v. Project and Equipment Corpn., following Royappa and holding that arbitrariness is a doctrine distinct from discrimination. It was held: (A.L. Kalra case, SCC p. 328, para 19)

"19. ... It thus appears well settled that Article 14 strikes at arbitrariness in executive/administrative action because any action that is arbitrary must necessarily involve the negation of equality. One need not confine the denial of equality to a comparative evaluation between two persons to arrive at a conclusion of discriminatory treatment. An action per se arbitrary itself denies equal of (sic) protection by law. The Constitution Bench pertinently observed in Ajay Hasia case and put the matter beyond controversy when it said: (SCC p. 741, para 16) '16. ... Wherever therefore, there is arbitrariness in State action whether it be of the legislature or of the executive or of an "authority" under Article 12, Article 14 immediately springs into action and strikes down such State action.'

This view was further elaborated and affirmed in D.S. Nakara v. Union of India . In Maneka Gandhi v. Union of India it was observed that Article 14 strikes at arbitrariness in State action and ensures fairness and equality of treatment. It is thus too late in the day to contend that an executive action shown to be arbitrary is not either judicially reviewable or within the reach of Article 14." The same view was reiterated in Babita Prasad v. State of Bihar , SCC at p. 285, para 31." This doctrine is, thus, treated as a facet of both Articles 14 and 21 of the Constitution.

79) We would like to record that we have proceeded on the premise that manifest arbitrariness also furnishes a ground on the basis on which a legislative enactment can be judicially reviewed. In the process, even the constitutional validity of Section 139AA of the Income Tax Act, 1961 is given a fresh look on the touchstone of this norm.

Explaining the doctrine/principles on which the cases are to be decided:

80) Our discussion up to this stage, which gives a glimpse of the attack to the Aadhaar scheme and the Aadhaar Act, spearheaded by the petitioners, would reveal that in the forefront is the right to privacy and that forms the main pillar on which the edifice of arguments is substantially constructed27. Inbuilt in this right to privacy is the right to live with dignity, which is a postulate of right to privacy. In the process, discussion leads to the issue of proportionality, viz. whether measures taken under the Aadhaar Act satisfy the doctrine of proportionality. We would, therefore, be well advised to explain these concepts, so that their application to the fact situation is undertaken with clear and stable norms in mind.

Contours of Right to Privacy:

81) It stands established, with conclusive determination of the nine Judge Bench judgment of this Court in K.S. Puttaswamy that right to privacy is a fundamental right. The majority judgment authored by Dr. D.Y. Chandrachud, J. (on behalf of three other Judges) and five concurring judgments of other five Judges have declared, in no uncertain terms and most authoritatively, right to privacy to be a fundamental right. This judgment also discusses in detail the scope and ambit of right to privacy. The relevant passages in this behalf have been reproduced above while taking note of the submissions of the learned counsel for the petitioners as well as respondents. One interesting phenomenon that is discerned from the respective submissions on either side is that both sides have placed strong reliance on different passages from this very judgment to support their respective stances. A close reading of this judgment brings about the following features:

(i) Privacy has always been a natural right: The correct position in this behalf has been established by a number of judgments starting from Gobind v. State of M.P.28 Various opinions conclude that:

(a) privacy is a concomitant of the right of the individual to exercise control over his or her personality.

(b) Privacy is the necessary condition precedent to the enjoyment of any of the guarantees in Part III.

(c) The fundamental right to privacy would cover at least three aspects -

(i) intrusion with an individual's physical body,

(ii) informational privacy, and

(iii) privacy of choice.

(d) One aspect of privacy is the right to control the dissemination of personal information. And that every individual should have a right to be able to control exercise over his/her own life and image as portrayed in the world and to control commercial use of his/her identity. Following passages from different opinions reflect the aforesaid proposition:

Dr. D.Y. Chandrachud, J.:

42. Privacy is a concomitant of the right of the individual to exercise control over his or her personality. It finds an origin in the notion that there are certain rights which are natural to or inherent in a human being. Natural rights are inalienable because they are inseparable from the human personality. The human element in life is impossible to conceive without the existence of natural rights. In 1690, John Lockehad in his Second Treatise of Government observed that the lives, liberties and estates of individuals are as a matter of fundamental natural law, a private preserve.

The idea of a private preserve was to create barriers from outside interference. In 1765, William Blackstone in his Commentaries on the Laws of England spoke of a "natural liberty". There were, in his view, absolute rights which were vested in the individual by the immutable laws of nature. These absolute rights were divided into rights of personal security, personal liberty and property. The right of personal security involved a legal and uninterrupted enjoyment of life, limbs, body, health and reputation by an individual.

xx xx xx

46. Natural rights are not bestowed by the State. They inhere in human beings because they are human. They exist equally in the individual irrespective of class or strata, gender or orientation.

xx xx xx

318. Life and personal liberty are inalienable rights. These are rights which are inseparable from a dignified human existence. The dignity of the individual, equality between human beings and the quest for liberty are the foundational pillars of the Indian Constitution.

S.A. Bobde, J. :

415. Therefore, privacy is the necessary condition precedent to the enjoyment of any of the guarantees in Part III. As a result, when it is claimed by rights bearers before constitutional courts, a right to privacy may be situated not only in Article 21, but also simultaneously in any of the other guarantees in Part III. In the current state of things, Articles 19(1), 20(3), 25, 28 and 29 are all rights helped up and made meaningful by the exercise of privacy. This is not an exhaustive list. Future developments in technology and social ordering may well reveal that there are yet more constitutional sites in which a privacy right inheres that are not at present evident to us.

R.F. Nariman, J. :

In the Indian context, a fundamental right to privacy would cover at least the following three aspects:

  • Privacy that involves the person i.e. when there is some invasion by the State of a person's rights relatable to his physical body, such as the right to move freely;
  • Informational privacy which does not deal with a person's body but deals with a person's mind, and therefore recognises that an individual may have control over the dissemination of material that is personal to him. Unauthorised use of such information may, therefore lead to infringement of this right; and
  • The privacy of choice, which protects an individual's autonomy over fundamental personal choices.

For instance, we can ground physical privacy or privacy relating to the body in Articles 19(1)(d) and (e) read with Article 21; ground personal information privacy under Article 21; and the privacy of choice in Articles 19(1)(a) to (c), 20(3), 21 and 25. The argument based on "privacy" being a vague and nebulous concept need not, therefore, detain us.

xx xx xx

532. The learned counsel for the petitioners also referred to another important aspect of the right to privacy. According to the learned counsel for the petitioner this right is a natural law right which is inalienable. Indeed, the reference order itself, in para 12, refers to this aspect of the fundamental right contained. It was, therefore, argued before us that given the international conventions referred to hereinabove and the fact that this right inheres in every individual by virtue of his being a human being, such right is not conferred by the Constitution but is only recognised and given the status of being fundamental. There is no doubt that the petitioners are correct in this submission. However, one important roadblock in the way needs to be got over.

533. In ADM, Jabalpur v. Shivakant Shukla, a Constitution Bench of this Court arrived at the conclusion (by majority) that Article 21 is the sole repository of all rights to life and personal liberty, and, when suspended, takes away those rights altogether. A remarkable dissent was that of Khanna, J. [ Khanna, J. was in line to be Chief Justice of India but was superseded because of this dissenting judgment. Nani Palkhivala in an article written on this great Judge's supersession ended with a poignant sentence, "To the stature of such a man, the Chief Justiceship of India can add nothing." Seervai, in his monumental treatise Constitutional Law of India had this to say:"53. If in this Appendix the dissenting judgment of Khanna, J. has not been considered in detail, it is not for lack of admiration for the judgment, or the courage which he showed in delivering it regardless of the cost and consequences to himself.

It cost him the Chief Justiceship of India, but it gained for him universal esteem not only for his courage but also for his inflexible judicial independence. If his judgment is not considered in detail it is because under the theory of precedents which we have adopted, a dissenting judgment, however valuable, does not lay down the law and the object of a critical examination of the majority judgments in this Appendix was to show that those judgments are untenable in law, productive of grave public mischief and ought to be overruled at the earliest opportunity.

The conclusion which Justice Khanna has reached on the effect of the suspension of Article 21 is correct. His reminder that the rule of law did not merely mean giving effect to an enacted law was timely, and was reinforced by his reference to the mass murders of millions of Jews in Nazi concentration camps under an enacted law. However, the legal analysis in this Chapter confirms his conclusion though on different grounds from those which he has given." (at Appendix p. 2229).] The learned Judge held: (SCC pp. 747 & 751, paras 525 & 531) "525. The effect of the suspension of the right to move any court for the enforcement of the right conferred by Article 21, in my opinion, is that when a petition is filed in a court, the court would have to proceed upon the basis that no reliance can be placed upon that article for obtaining relief from the court during the period of emergency.

Question then arises as to whether the rule that no one shall be deprived of his life or personal liberty without the authority of law still survives during the period of emergency despite the Presidential Order suspending the right to move any court for the enforcement of the right contained in Article 21. The answer to this question is linked with the answer to the question as to whether Article 21 is the sole repository of the right to life and personal liberty. After giving the matter my earnest consideration, I am of the opinion that Article 21 cannot be considered to be the sole repository of the right to life and personal liberty.

The right to life and personal liberty is the most precious right of human beings in civilised societies governed by the rule of law. Many modern Constitutions incorporate certain fundamental rights, including the one relating to personal freedom. According to Blackstone, the absolute rights of Englishmen were the rights of personal security, personal liberty and private property. The American Declaration of Independence (1776) states that all men are created equal, and among their inalienable rights are life, liberty, and the pursuit of happiness.

The Second Amendment to the US Constitution refers inter alia to security of person, while the Fifth Amendment prohibits inter alia deprivation of life and liberty without due process, of law. The different Declarations of Human Rights and fundamental freedoms have all laid stress upon the sanctity of life and liberty. They have also given expression in varying words to the principle that no one shall be derived of his life or liberty without the authority of law. The International Commission of Jurists, which is affiliated to UNESCO, has been attempting with, considerable success to give material content to "the rule of law", an expression used in the Universal Declaration of Human Rights.

One of its most notable achievements was the Declaration of Delhi, 1959. This resulted from a Congress held in New Delhi attended by jurists from more than 50 countries, and was based on a questionnaire circulated to 75,000 lawyers. "Respect for the supreme value of human personality" was stated to be the basis of all law (see p. 21 of the Constitutional and Administrative Law by O. Hood Phillips, 3rd Edn.).

xx xx xx 531. I am unable to subscribe to the view that when right to enforce the right under Article 21 is suspended, the result would be that there would be no remedy against deprivation of a person's life or liberty by the State even though such deprivation is without the authority of law or even in flagrant violation of the provisions of law. The right not to be deprived of one's life or liberty without the authority of law was not the creation of the Constitution. Such right existed before the Constitution came into force.

The fact that the Framers of the Constitution made an aspect of such right a part of the fundamental rights did not have the effect of exterminating the independent identity of such right and of making Article 21 to be the sole repository of that right. Its real effect was to ensure that a law under which a person can be deprived of his life or personal liberty should prescribe a procedure for such deprivation or, according to the dictum laid down by Mukherjea, J. in Gopalan case [A.K. Gopalan v. State of Madras, AIR 1950 SC 27 : 1950 SCR 88] , such law should be a valid law not violative of fundamental rights guaranteed by Part III of the Constitution. Recognition as fundamental right of one aspect of the preconstitutional right cannot have the effect of making things less favourable so far as the sanctity of life and personal liberty is concerned compared to the position if an aspect of such right had not been recognised as fundamental right because of the vulnerability of fundamental rights accruing from Article 359.

I am also unable to agree that in view of the Presidential Order in the matter of sanctity of life and liberty, things would be worse off compared to the state of law as it existed before the coming into force of the Constitution."

(emphasis in original)

S.K. Kaul, J.:

574. I have had the benefit of reading the exhaustive and erudite opinions of Rohinton F. Nariman and Dr D.Y. Chandrachud, JJ. The conclusion is the same, answering the reference that privacy is not just a common law right, but a fundamental right falling in Part III of the Constitution of India. I agree with this conclusion as privacy is a primal, natural right which is inherent to an individual. However, I am tempted to set out my perspective on the issue of privacy as a right, which to my mind, is an important core of any individual existence.

xx xx xx

620. I had earlier adverted to an aspect of privacy - the right to control dissemination of personal information. The boundaries that people establish from others in society are not only physical but also informational. There are different kinds of boundaries in respect to different relations. Privacy assists in preventing awkward social situations and reducing social frictions. Most of the information about individuals can fall under the phrase "none of your business". On information being shared voluntarily, the same may be said to be in confidence and any breach of confidentiality is a breach of the trust.

This is more so in the professional relationships such as with doctors and lawyers which requires an element of candour in disclosure of information. An individual has the right to control one's life while submitting personal data for various facilities and services. It is but essential that the individual knows as to what the data is being used for with the ability to correct and amend it. The hallmark of freedom in a democracy is having the autonomy and control over our lives which becomes impossible, if important decisions are made in secret without our awareness or participation. [ Daniel Solove,

"10 Reasons Why Privacy Matters" published on 20-1-2014 "https://www.teachprivacy.com/10-reasonsprivacy- matters/".]

xx xx xx

625. Every individual should have a right to be able to exercise control over his/her own life and image as portrayed to the world and to control commercial use of his/her identity. This also means that an individual may be permitted to prevent others from using his image, name and other aspects of his/her personal life and identity for commercial purposes without his/her consent. [ The Second Circuit's decision in Haelan Laboratories Inc. v. Topps Chewing Gum Inc., 202 F 2d 866 (2d Cir 1953) penned by Jerome Frank, J. defined the right to publicity as "the right to grant the exclusive privilege of publishing his picture".]"

xx xx xx

646. If the individual permits someone to enter the house it does not mean that others can enter the house. The only check and balance is that it should not harm the other individual or affect his or her rights. This applies both to the physical form and to technology. In an era where there are wide, varied, social and cultural norms and more so in a country like ours which prides itself on its diversity, privacy is one of the most important rights to be protected both against State and non-State actors and be recognised as a fundamental right. How it thereafter works out in its interplay with other fundamental rights and when such restrictions would become necessary would depend on the factual matrix of each case.

That it may give rise to more litigation can hardly be the reason not to recognise this important, natural, primordial right as a fundamental right."

(ii) The sanctity of privacy lies in its functional relationship with dignity: Privacy ensures that a human being can lead a life of dignity by securing the inner recesses of the human personality from unwanted intrusions. While the legitimate expectation of privacy may vary from intimate zone to the private zone and from the private to the public arena, it is important to underscore that privacy is not lost or surrendered merely because the individual is in a public place. Further, privacy is a postulate of dignity itself. Also, privacy concerns arise when the State seeks to intrude into the body and the mind of the citizen. This aspect is discussed in the following manner:

Dr. D.Y. Chandrachud, J. :

127. The submission that recognising the right to privacy is an exercise which would require a constitutional amendment and cannot be a matter of judicial interpretation is not an acceptable doctrinal position. The argument assumes that the right to privacy is independent of the liberties guaranteed by Part III of the Constitution. There lies the error. The right to privacy is an element of human dignity. The sanctity of privacy lies in its functional relationship with dignity. Privacy ensures that a human being can lead a life of dignity by securing the inner recesses of the human personality from unwanted intrusion. Privacy recognises the autonomy of the individual and the right of every person to make essential choices which affect the course of life.

In doing so privacy recognises that living a life of dignity is essential for a human being to fulfill the liberties and freedoms which are the cornerstone of the Constitution. To recognise the value of privacy as a constitutional entitlement and interest is not to fashion a new fundamental right by a process of amendment through judicial fiat. Neither are the Judges nor is the process of judicial review entrusted with the constitutional responsibility to amend the Constitution. But judicial review certainly has the task before it of determining the nature and extent of the freedoms available to each person under the fabric of those constitutional guarantees which are protected. Courts have traditionally discharged that function and in the context of Article 21 itself, as we have already noted, a panoply of protections governing different facets of a dignified existence has been held to fall within the protection of Article 21.

xx xx xx

297. What, then, does privacy postulate? Privacy postulates the reservation of a private space for the individual, described as the right to be let alone. The concept is founded on the autonomy of the individual. The ability of an individual to make choices lies at the core of the human personality. The notion of privacy enables the individual to assert and control the human element which is inseparable from the personality of the individual. The inviolable nature of the human personality is manifested in the ability to make decisions on matters intimate to human life. The autonomy of the individual is associated over matters which can be kept private. These are concerns over which there is a legitimate expectation of privacy. The body and the mind are inseparable elements of the human personality.

The integrity of the body and the sanctity of the mind can exist on the foundation that each individual possesses an inalienable ability and right to preserve a private space in which the human personality can develop. Without the ability to make choices, the inviolability of the personality would be in doubt. Recognising a zone of privacy is but an acknowledgment that each individual must be entitled to chart and pursue the course of development of personality. Hence privacy is a postulate of human dignity itself. Thoughts and behavioural patterns which are intimate to an individual are entitled to a zone of privacy where one is free of social expectations. In that zone of privacy, an individual is not judged by others. Privacy enables each individual to take crucial decisions which find expression in the human personality.

It enables individuals to preserve their beliefs, thoughts, expressions, ideas, ideologies, preferences and choices against societal demands of homogeneity. Privacy is an intrinsic recognition of heterogeneity, of the right of the individual to be different and to stand against the tide of conformity in creating a zone of solitude. Privacy protects the individual from the searching glare of publicity in matters which are personal to his or her life. Privacy attaches to the person and not to the place where it is associated. Privacy constitutes the foundation of all liberty because it is in privacy that the individual can decide how liberty is best exercised. Individual dignity and privacy are inextricably linked in a pattern woven out of a thread of diversity into the fabric of a plural culture.

xx xx xx

322. Privacy is the constitutional core of human dignity. Privacy has both a normative and descriptive function. At a normative level privacy subserves those eternal values upon which the guarantees of life, liberty and freedom are founded. At a descriptive level, privacy postulates a bundle of entitlements and interests which lie at the foundation of ordered liberty.

323. Privacy includes at its core the preservation of personal intimacies, the sanctity of family life, marriage, procreation, the home and sexual orientation. Privacy also connotes a right to be left alone. Privacy safeguards individual autonomy and recognises the ability of the individual to control vital aspects of his or her life. Personal choices governing a way of life are intrinsic to privacy. Privacy protects heterogeneity and recognises the plurality and diversity of our culture. While the legitimate expectation of privacy may vary from the intimate zone to the private zone and from the private to the public arenas, it is important to underscore that privacy is not lost or surrendered merely because the individual is in a public place. Privacy attaches to the person since it is an essential facet of the dignity of the human being.

S.A. Bobde, J. :

407. Undoubtedly, privacy exists, as the foregoing demonstrates, as a verifiable fact in all civilised societies. But privacy does not stop at being merely a descriptive claim. It also embodies a normative one. The normative case for privacy is intuitively simple. Nature has clothed man, amongst other things, with dignity and liberty so that he may be free to do what he will consistent with the freedom of another and to develop his faculties to the fullest measure necessary to live in happiness and peace. The Constitution, through its Part III, enumerates many of these freedoms and their corresponding rights as fundamental rights. Privacy is an essential condition for the exercise of most of these freedoms. Ex facie, every right which is integral to the constitutional rights to dignity, life, personal liberty and freedom, as indeed the right to privacy is, must itself be regarded as a fundamental right.

408. Though he did not use the name of "privacy", it is clear that it is what J.S. Mill took to be indispensable to the existence of the general reservoir of liberty that democracies are expected to reserve to their citizens. In the introduction to his seminal On Liberty (1859), he characterised freedom in the following way:

"This, then, is the appropriate region of human liberty. It comprises, first, the inward domain of consciousness; demanding liberty of conscience, in the most comprehensive sense; liberty of thought and feeling; absolute freedom of opinion and sentiment on all subjects, practical or speculative, scientific, moral, or theological. The liberty of expressing and publishing opinions may seem to fall under a different principle, since it belongs to that part of the conduct of an individual which concerns other people; but, being almost of as much importance as the liberty of thought itself, and resting in great part on the same reasons, is practically inseparable from it. Secondly, the principle requires liberty of tastes and pursuits; of framing the plan of our life to suit our own character; of doing as we like, subject to such consequences as may follow: without impediment from our fellow creatures, so long as what we do does not harm them, even though they should think our conduct foolish, perverse, or wrong.

Thirdly, from this liberty of each individual, follows the liberty, within the same limits, of combination among individuals; freedom to unite, for any purpose not involving harm to others: the persons combining being supposed to be of full age, and not forced or deceived. No society in which these liberties are not, on the whole, respected, is free, whatever may be its form of Government; and none is completely free in which they do not exist absolute and unqualified.

The only freedom which deserves the name, is that of pursuing our own good in our own way, so long as we do not attempt to deprive others of theirs, or impede their efforts to obtain it. Each is the proper guardian of his own health, whether bodily, or mental and spiritual. Mankind are greater gainers by suffering each other to live as seems good to themselves, than by compelling each to live as seems good to the rest. Though this doctrine is anything but new, and, to some persons, may have the air of a truism, there is no doctrine which stands more directly opposed to the general tendency of existing opinion and practice. Society has expended fully as much effort in the attempt (according to its lights) to compel people to conform to its notions of personal, as of social excellence." [John Stuart Mill, On Liberty and Other Essays (Stefan Collini Edition, 1989) (1859)]

(emphasis supplied)

409. The first and natural home for a right to privacy is in Article 21 at the very heart of "personal liberty" and life itself. Liberty and privacy are integrally connected in a way that privacy is often the basic condition necessary for exercise of the right of personal liberty. There are innumerable activities which are virtually incapable of being performed at all and in many cases with dignity unless an individual is left alone or is otherwise empowered to ensure his or her privacy. Birth and death are events when privacy is required for ensuring dignity amongst all civilised people. Privacy is thus one of those rights "instrumentally required if one is to enjoy" [ Laurence H. Tribe and Michael C. Dorf, "Levels of Generality in the Definition of Rights", 57 U CHI L REV 1057 (1990) at p. 1068.] rights specified and enumerated in the constitutional text.

410. This Court has endorsed the view that "life" must mean "something more than mere animal existence" [Munn v. Illinois, 1876 SCC OnLine US SC 4 : 24 L Ed 77 : 94 US 113 (1877) (Per Field, J.) as cited in Kharak Singh, (1964) 1 SCR 332 at pp. 347-48] on a number of occasions, beginning with the Constitution Bench in Sunil Batra (1) v. Delhi Admn. [Sunil Batra v. Delhi Admn., (1978) 4 SCC 494 : 1979 SCC (Cri) 155] Sunil Batra [Sunil Batra v. Delhi Admn., (1978) 4 SCC 494 : 1979 SCC (Cri) 155] connected this view of Article 21 to the constitutional value of dignity. In numerous cases, including Francis Coralie Mullin v. UT of Delhi [Francis Coralie Mullin v. UT of Delhi, (1981) 1 SCC 608 : 1981 SCC (Cri) 212] , this Court has viewed liberty as closely linked to dignity. Their relationship to the effect of taking into the protection of "life" the protection of "faculties of thinking and feeling", and of temporary and permanent impairments to those faculties. In Francis Coralie Mullin[Francis Coralie Mullin v. UT of Delhi, (1981) 1 SCC 608 : 1981 SCC (Cri) 212] , Bhagwati, J. opined as follows: (SCC p. 618, para 7) "7. Now obviously, the right to life enshrined in Article 21 cannot be restricted to mere animal existence. It means something much more than just physical survival. In Kharak Singh v. State of U.P. [Kharak Singh v. State of U.P., AIR 1963 SC 1295 : (1963) 2 Cri LJ 329 : (1964) 1 SCR 332], Subba Rao, J. quoted with approval the following passage from the judgment of Field, J. in Munn v. Illinois [Munn v. Illinois, 1876 SCC OnLine US SC 4 : 24 L Ed 77 : 94 US 113 (1877)] to emphasise the quality of life covered by Article 21: (Kharak Singh case [Kharak Singh v. State of U.P., AIR 1963 SC 1295 : (1963) 2 Cri LJ 329 : (1964) 1 SCR 332] , AIR p. 1301, para 15) 15. ...

"By the term "life" as here used something more is meant than mere animal existence. The inhibition against its deprivation extends to all those limbs and faculties by which life is enjoyed. The provision equally prohibits the mutilation of the body or amputation of an arm or leg or the putting out of an eye or the destruction of any other organ of the body through which the soul communicates with the outer world." ' and this passage was again accepted as laying down the correct law by the Constitution Bench of this Court in the first Sunil Batra case [Sunil Batra v. Delhi Admn., (1978) 4 SCC 494 : 1979 SCC (Cri) 155].

Every limb or faculty through which life is enjoyed is thus protected by Article 21 and a fortiori, this would include the faculties of thinking and feeling. Now deprivation which is inhibited by Article 21 may be total or partial, neither any limb or faculty can be totally destroyed nor can it be partially damaged. Moreover it is every kind of deprivation that is hit by Article 21, whether such deprivation be permanent or temporary and, furthermore, deprivation is not an act which is complete once and for all: it is a continuing act and so long as it lasts, it must be in accordance with procedure established by law. It is therefore clear that any act which damages or injures or interferes with the use of, any limb or faculty of a person, either permanently or even temporarily, would be within the inhibition of Article 21."

(emphasis supplied)

Privacy is, therefore, necessary in both its mental and physical aspects as an enabler of guaranteed freedoms. 411. It is difficult to see how dignity-whose constitutional significance is acknowledged both by the Preamble and by this Court in its exposition of Article 21, among other rights -can be assured to the individual without privacy. Both dignity and privacy are intimately intertwined and are natural conditions for the birth and death of individuals, and for many significant events in life between these events. Necessarily, then, the right to privacy is an integral part of both "life" and "personal liberty" under Article 21, and is intended to enable the rights bearer to develop her potential to the fullest extent made possible only in consonance with the constitutional values expressed in the Preamble as well as across Part III.

R.F. Nariman, J :

But most important of all is the cardinal value of fraternity which assures the dignity of the individual. [ In 1834, Jacques-Charles Dupont de l'Eure associated the three terms liberty, equality and fraternity together in the Revue Républicaine, which he edited, as follows:"Any man aspires to liberty, to equality, but he cannot achieve it without the assistance of other men, without fraternity."Many of our decisions recognise human dignity as being an essential part of the fundamental rights chapter. For example, see Prem Shankar Shukla v. Delhi Admn., (1980) 3 SCC 526 at para 21, Francis Coralie Mullin v. UT of Delhi, (1981) 1 SCC 608 at paras 6, 7 and 8, Bandhua Mukti Morcha v. Union of India, (1984) 3 SCC 161 at para 10, Maharashtra University of Health Sciences v. Satchikitsa Prasarak Mandal, (2010) 3 SCC 786 at para 37, Shabnam v. Union of India, (2015) 6 SCC 702 at paras 12.4 and 14 and Jeeja Ghosh v. Union of India, (2016) 7 SCC 761 at para 37.] The dignity of the individual encompasses the right of the individual to develop to the full extent of his potential. And this development can only be if an individual has autonomy over fundamental personal choices and control over dissemination of personal information which may be infringed through an unauthorised use of such information.

It is clear that Article 21, more than any of the other articles in the fundamental rights chapter, reflects each of these constitutional values in full, and is to be read in consonance with these values and with the international covenants that we have referred to. In the ultimate analysis, the fundamental right to privacy, which has so many developing facets, can only be developed on a case-to-case basis. Depending upon the particular facet that is relied upon, either Article 21 by itself or in conjunction with other fundamental rights would get attracted.

S.K. Kaul, J. :

618. Rohinton F. Nariman, and Dr D.Y. Chandrachud, JJ., have emphasised the importance of the protection of privacy to ensure protection of liberty and dignity. I agree with them and seek to refer to some legal observations in this regard:

618.1. In Robertson and Nicol on Media Law [ Geoffrey Robertson, QC and Andrew Nicol, QC, Media Law, 5th Edn., p. 265.] it was observed: "Individuals have a psychological need to preserve an intrusion-free zone for their personality and family and suffer anguish and stress when that zone is violated. Democratic societies must protect privacy as part of their facilitation of individual freedom, and offer some legal support for the individual choice as to what aspects of intimate personal life the citizen is prepared to share with others. This freedom in other words springs from the same source as freedom of expression: a liberty that enhances individual life in a democratic community."

618.2. Lord Nicholls and Lord Hoffmann in their opinion in Naomi Campbell case[Campbell v. MGN Ltd., (2004) 2 AC 457 : (2004) 2 WLR 1232 : (2004) UKHL 22 (HL)] recognised the importance of the protection of privacy. Lord Hoffman opined as under: (AC p. 472 H & 473 A-D, paras 50-51)

"50. What human rights law has done is to identify private information as something worth protecting as an aspect of human autonomy and dignity. And this recognition has raised inescapably the question of why it should be worth protecting against the state but not against a private person. There may of course be justifications for the publication of private information by private persons which would not be available to the state - I have particularly in mind the position of the media, to which I shall return in a moment - but I can see no logical ground for saying that a person should have less protection against a private individual than he would have against the state for the publication of personal information for which there is no justification. Nor, it appears, have any of the other Judges who have considered the matter.

51. The result of these developments has been a shift in the centre of gravity of the action for breach of confidence when it is used as a remedy for the unjustified publication of personal information. ... Instead of the cause of action being based upon the duty of good faith applicable to confidential personal information and trade secrets alike, it focuses upon the protection of human autonomy and dignity - the right to control the dissemination of information about one's private life and the right to the esteem and respect of other people."

618.3. Lord Nicholls opined as under: (Naomi Campbell case [Campbell v. MGN Ltd., (2004) 2 AC 457 : (2004) 2 WLR 1232 : (2004) UKHL 22 (HL)] , AC p. 464 D-F, para 12)

"12. The present case concerns one aspect of invasion of privacy: wrongful disclosure of private information. The case involves the familiar competition between freedom of expression and respect for an individual's privacy. Both are vitally important rights. Neither has precedence over the other. The importance of freedom of expression has been stressed often and eloquently, the importance of privacy less so. But it, too, lies at the heart of liberty in a modern state.

A proper degree of privacy is essential for the well-being and development of an individual. And restraints imposed on government to pry into the lives of the citizen go to the essence of a democratic state: see La Forest J. in R. v. Dyment [R. v. Dyment, 1988 SCC OnLine Can SC 86 : (1988) 2 SCR 417] , SCC OnLine Can SC para 17 : SCR p. 426." 619. Privacy is also the key to freedom of thought. A person has a right to think. The thoughts are sometimes translated into speech but confined to the person to whom it is made. For example, one may want to criticise someone but not share the criticism with the world.

Chelameswar, J.:

372. History abounds with examples of attempts by Governments to shape the minds of subjects. In other words, conditioning the thought process by prescribing what to read or not to read; what forms of art alone are required to be appreciated leading to the conditioning of beliefs; interfering with the choice of people regarding the kind of literature, music or art which an individual would prefer to enjoy. [Stanleyv. Georgia, 1969 SCC OnLine US SC 78 : 22 L Ed 2d 542 : 394 US 557 (1969)"3. ... that the mere private possession of obscene matter cannot constitutionally be made a crime.

***9. ... State has no business telling a man, sitting alone in his own house, what books he may read or what films he may watch. Our whole constitutional heritage rebels at the thought of giving Government the power to control men's minds." (SCC OnLine US SC paras 3 & 9)] Such conditioning is sought to be achieved by screening the source of information or prescribing penalties for making choices which Governments do not approve. [Bijoe Emmanuel v. State of Kerala, (1986) 3 SCC 615] Insofar as religious beliefs are concerned, a good deal of the misery our species suffer owes its existence to and centres around competing claims of the right to propagate religion. Constitution of India protects the liberty of all subjects guaranteeing ["25. Freedom of conscience and free profession, practice and propagation of religion.-

(1) Subject to public order, morality and health and to the other provisions of this Part, all persons are equally entitled to freedom of conscience and the right freely to profess, practice and propagate religion.(2) Nothing in this article shall affect the operation of any existing law or prevent the State from making any law-

(a) regulating or restricting any economic, financial, political or other secular activity which may be associated with religious practice;

(b) providing for social welfare and reform or the throwing open of Hindu religious institutions of a public character to all classes and sections of Hindus.

Explanation I.-The wearing and carrying of kirpans shall be deemed to be included in the profession of the Sikh religion.

Explanation II.-In sub-clause

(b) of clause (2), the reference to Hindus shall be construed as including a reference to persons professing the Sikh, Jaina or Buddhist religion, and the reference to Hindu religious institutions shall be construed accordingly."] the freedom of conscience and right to freely profess, practice and propagate religion. While the right to freely "profess, practice and propagate religion" may be a facet of free speech guaranteed under Article 19(1)(a), the freedom of the belief or faith in any religion is a matter of conscience falling within the zone of purely private thought process and is an aspect of liberty. There are areas other than religious beliefs which form part of the individual's freedom of conscience such as political belief, etc. which form part of the liberty under Article 21.

373. Concerns of privacy arise when the State seeks to intrude into the body of subjects. [Skinner v. Oklahoma, 1942 SCC OnLine US SC 125 : 86 L Ed 1655 : 316 US 535 (1942)"20. There are limits to the extent to which a legislatively represented majority may conduct biological experiments at the expense of the dignity and personality and natural powers of a minority-even those who have been guilty of what the majority defines as crimes." (SCC OnLine US SC para 20)-Jackson, J.] Corporeal punishments were not unknown to India, their abolition is of a recent vintage. Forced feeding of certain persons by the State raises concerns of privacy. An individual's rights to refuse life prolonging medical treatment or terminate his life is another freedom which falls within the zone of the right to privacy. I am conscious of the fact that the issue is pending before this Court.

But in various other jurisdictions, there is a huge debate on those issues though it is still a grey area. [ For the legal debate in this area in US, See Chapter 15.11 of American Constitutional Law by Laurence H. Tribe, 2nd Edn.] A woman's freedom of choice whether to bear a child or abort her pregnancy are areas which fall in the realm of privacy. Similarly, the freedom to choose either to work or not and the freedom to choose the nature of the work are areas of private decision-making process. The right to travel freely within the country or go abroad is an area falling within the right to privacy. The text of our Constitution recognised the freedom to travel throughout the country under Article 19(1)(d).

This Court has already recognised that such a right takes within its sweep the right to travel abroad. [Maneka Gandhi v. Union of India, (1978) 1 SCC 248] A person's freedom to choose the place of his residence once again is a part of his right to privacy [Williams v. Fears, 1900 SCC OnLine US SC 211 : 45 L Ed 186 : 179 US 270 (1900)-"8. Undoubtedly the right of locomotion, the right to remove from one place to another according to inclination, is an attribute of personal liberty...." (SCC OnLine US SC para 8)] recognised by the Constitution of India under Article 19(1)(e) though the predominant purpose of enumerating the abovementioned two freedoms in Article 19(1) is to disable both the federal and State Governments from creating barriers which are incompatible with the federal nature of our country and its Constitution. The choice of appearance and apparel are also aspects of the right to privacy. The freedom of certain groups of subjects to determine their appearance and apparel (such as keeping long hair and wearing a turban) are protected not as a part of the right to privacy but as a part of their religious belief. Such a freedom need not necessarily be based on religious beliefs falling under Article 25.

Informational traces are also an area which is the subject-matter of huge debate in various jurisdictions falling within the realm of the right to privacy, such data is as personal as that of the choice of appearance and apparel. Telephone tappings and internet hacking by State, of personal data is another area which falls within the realm of privacy. The instant reference arises out of such an attempt by the Union of India to collect biometric data regarding all the residents of this country. The abovementioned are some of the areas where some interest of privacy exists. The examples given above indicate to some extent the nature and scope of the right to privacy.

374. I do not think that anybody in this country would like to have the officers of the State intruding into their homes or private property at will or soldiers quartered in their houses without their consent. I do not think that anybody would like to be told by the State as to what they should eat or how they should dress or whom they should be associated with either in their personal, social or political life. Freedom of social and political association is guaranteed to citizens under Article 19(1)(c). Personal association is still a doubtful area. [The High Court of A.P. held that Article 19(1) (c) would take within its sweep the matrimonial association in T. Sareetha v. T. Venkata Subbaiah, 1983 SCC OnLine AP 90 : AIR 1983 AP 356. However, this case was later overruled by this Court in Saroj Rani v. Sudarshan Kumar Chadha, (1984) 4 SCC 90 : AIR 1984 SC 1562.] The decision-making process regarding the freedom of association, freedoms of travel and residence are purely private and fall within the realm of the right to privacy. It is one of the most intimate decisions.

375. All liberal democracies believe that the State should not have unqualified authority to intrude into certain aspects of human life and that the authority should be limited by parameters constitutionally fixed. Fundamental rights are the only constitutional firewall to prevent State's interference with those core freedoms constituting liberty of a human being. The right to privacy is certainly one of the core freedoms which is to be defended. It is part of liberty within the meaning of that expression in Article 21.

376. I am in complete agreement with the conclusions recorded by my learned Brothers in this regard." (iii) Privacy is intrinsic to freedom, liberty and dignity: The right to privacy is inherent to the liberties guaranteed by Part-III of the Constitution and privacy is an element of human dignity. The fundamental right to privacy derives from Part-III of the Constitution and recognition of this right does not require a constitutional amendment. Privacy is more than merely a derivative constitutional right. It is the necessary basis of rights guaranteed in the text of the Constitution. Discussion in this behalf is captured in the following passages:

Dr. D.Y. Chandrachud, J. :

127. The submission that recognising the right to privacy is an exercise which would require a constitutional amendment and cannot be a matter of judicial interpretation is not an acceptable doctrinal position. The argument assumes that the right to privacy is independent of the liberties guaranteed by Part III of the Constitution. There lies the error. The right to privacy is an element of human dignity. The sanctity of privacy lies in its functional relationship with dignity. Privacy ensures that a human being can lead a life of dignity by securing the inner recesses of the human personality from unwanted intrusion. Privacy recognises the autonomy of the individual and the right of every person to make essential choices which affect the course of life. In doing so privacy recognises that living a life of dignity is essential for a human being to fulfill the liberties and freedoms which are the cornerstone of the Constitution.

To recognise the value of privacy as a constitutional entitlement and interest is not to fashion a new fundamental right by a process of amendment through judicial fiat. Neither are the Judges nor is the process of judicial review entrusted with the constitutional responsibility to amend the Constitution. But judicial review certainly has the task before it of determining the nature and extent of the freedoms available to each person under the fabric of those constitutional guarantees which are protected. Courts have traditionally discharged that function and in the context of Article 21 itself, as we have already noted, a panoply of protections governing different facets of a dignified existence has been held to fall within the protection of Article 21.

S.A. Bobde, J. :

416. There is nothing unusual in the judicial enumeration of one right on the basis of another under the Constitution. In the case of Article 21's guarantee of "personal liberty", this practice is only natural if Salmond's formulation of liberty as "incipient rights" [ P.J. Fitzgerald, Salmond on Jurisprudence at p. 228.] is correct. By the process of enumeration, constitutional courts merely give a name and specify the core of guarantees already present in the residue of constitutional liberty. Over time, the Supreme Court has been able to imply by its interpretative process that several fundamental rights including the right to privacy emerge out of expressly stated fundamental rights. In Unni Krishnan, J.P. v. State of A.P. [Unni Krishnan, J.P. v. State of A.P., (1993) 1 SCC 645] , a Constitution Bench of this Court held that "several unenumerated rights fall within Article 21 since personal liberty is of widest amplitude" [Unni Krishnan, J.P. v. State of A.P., (1993) 1 SCC 645 at p. 669, para 29] on the way to affirming the existence of a right to education. It went on to supply the following indicative list of such rights, which included the right to privacy: (SCC pp. 669-70, para 30)

"30. The following rights are held to be covered under Article 21:

1. The right to go abroad. Satwant Singh v. D. Ramarathnam [Satwant Singh Sawhney v. D. Ramarathnam, (1967) 3 SCR 525 : AIR 1967 SC 1836] .

2. The right to privacy. Gobind v. State of M.P. [Gobind v. State of M.P., (1975) 2 SCC 148 : 1975 SCC (Cri) 468] In this case reliance was placed on the American decision in Griswold v. Connecticut [Griswold v. Connecticut, 1965 SCC OnLine US SC 124 : 14 L Ed 2d 510 : 85 S Ct 1678 : 381 US 479 (1965)] , US at p. 510.

3. The right against solitary confinement. Sunil Batra (1) v. Delhi Admn. [Sunil Batra v. Delhi Admn., (1978) 4 SCC 494 : 1979 SCC (Cri) 155] , SCC at p. 545.

4. The right against bar fetters. Charles Sobhraj v. Supt., Central Jail [Charles Sobraj v. Supt., Central Jail, (1978) 4 SCC 104 : 1978 SCC (Cri) 542].

5. The right to legal aid. M.H. Hoskot v. State of Maharashtra [M.H. Hoskot v. State of Maharashtra, (1978) 3 SCC 544 : 1978 SCC (Cri) 468].

6. The right to speedy trial. Hussainara Khatoon (1) v. State of Bihar[Hussainara Khatoon (1) v. State of Bihar, (1980) 1 SCC 81 : 1980 SCC (Cri) 23] .

7. The right against handcuffing. Prem Shankar v. Delhi Admn. [Prem Shankar Shukla v. Delhi Admn., (1980) 3 SCC 526 : 1980 SCC (Cri) 815]

8. The right against delayed execution. T.V. Vatheeswaran v. State of T.N. [T.V. Vatheeswaran v. State of T.N., (1983) 2 SCC 68 : 1983 SCC (Cri) 342]

9. The right against custodial violence. Sheela Barse v. State of Maharashtra [Sheela Barse v. State of Maharashtra, (1983) 2 SCC 96 : 1983 SCC (Cri) 353].

10. The right against public hanging. Attorney General of India v. Lachma Devi [Attorney General of India v. Lachma Devi, 1989 Supp (1) SCC 264 : 1989 SCC (Cri) 413].

11. Doctor's assistance. Paramananda Katara v. Union of India [Parmanand Katara v. Union of India, (1989) 4 SCC 286 : 1989 SCC (Cri) 721].

12. Shelter. Santistar Builders v. Narayan Khimalal Totame [Shantistar Builders v. Narayan Khimalal Totame, (1990) 1 SCC 520] ."

In the case of privacy, the case for judicial enumeration is especially strong. It is no doubt a fair implication from Article 21, but also more. Privacy is a right or condition, "logically presupposed" [ Laurence H. Tribe And Michael C. Dorf, "Levels of Generality in the Definition of Rights", 57 U CHI L REV 1057 (1990) at p. 1068.] by rights expressly recorded in the constitutional text, if they are to make sense. As a result, privacy is more than merely a derivative constitutional right. It is the necessary and unavoidable logical entailment of rights guaranteed in the text of the Constitution.

R.F. Nariman, J:

482. Shri Sundaram has argued that rights have to be traced directly to those expressly stated in the fundamental rights chapter of the Constitution for such rights to receive protection, and privacy is not one of them.

It will be noticed that the dignity of the individual is a cardinal value, which is expressed in the Preamble to the Constitution. Such dignity is not expressly stated as a right in the fundamental rights chapter, but has been read into the right to life and personal liberty. The right to live with dignity is expressly read into Article 21 by the judgment in Jolly George Varghesev. Bank of Cochin [Jolly George Varghese v. Bank of Cochin, (1980) 2 SCC 360] , at para 10. Similarly, the right against bar fetters and handcuffing being integral to an individual's dignity was read into Article 21 by the judgment in Sunil Batra v. Delhi Admn. [Sunil Batra v. Delhi Admn., (1978) 4 SCC 494 : 1979 SCC (Cri) 155] , at paras 192, 197-B, 234 and 241 and Prem Shankar Shukla v. Delhi Admn. [Prem Shankar Shukla v. Delhi Admn., (1980) 3 SCC 526 : 1980 SCC (Cri) 815] , at paras 21 and 22. It is too late in the day to canvas that a fundamental right must be traceable to express language in Part III of the Constitution.

As will be pointed out later in this judgment, a Constitution has to be read in such a way that words deliver up principles that are to be followed and if this is kept in mind, it is clear that the concept of privacy is contained not merely in personal liberty, but also in the dignity of the individual."

(iv) Privacy has both positive and negative content: The negative content restrains the State from committing an intrusion upon the life and personal liberty of a citizen. Its positive content imposes an obligation on the State to take all necessary measures to protect the privacy of the individual.

Dr. D.Y. Chandrachud, J.:

326. Privacy has both positive and negative content. The negative content restrains the State from committing an intrusion upon the life and personal liberty of a citizen. Its positive content imposes an obligation on the State to take all necessary measures to protect the privacy of the individual."

(v) Informational Privacy is a facet of right to privacy: The old adage that 'knowledge is power' has stark implications for the position of individual where data is ubiquitous, an allencompassing presence. Every transaction of an individual user leaves electronic tracks without her knowledge. Individually these information silos may seem inconsequential. In aggregation, information provides a picture of the beings. The challenges which big data poses to privacy emanate from both State and non-State entities.

This proposition is described in the following manner:

Dr. D.Y. Chandrachud, J.:

300. Ours is an age of information. Information is knowledge. The old adage that "knowledge is power" has stark implications for the position of the individual where data is ubiquitous, an all-encompassing presence. Technology has made life fundamentally interconnected. The internet has become all-pervasive as individuals spend more and more time online each day of their lives. Individuals connect with others and use the internet as a means of communication.

The internet is used to carry on business and to buy goods and services. Individuals browse the web in search of information, to send e-mails, use instant messaging services and to download movies. Online purchases have become an efficient substitute for the daily visit to the neighbouring store. Online banking has redefined relationships between bankers and customers. Online trading has created a new platform for the market in securities. Online music has refashioned the radio. Online books have opened up a new universe for the bibliophile. The old-fashioned travel agent has been rendered redundant by web portals which provide everything from restaurants to rest houses, airline tickets to art galleries, museum tickets to music shows. These are but a few of the reasons people access the internet each day of their lives.

Yet every transaction of an individual user and every site that she visits, leaves electronic tracks generally without her knowledge. These electronic tracks contain powerful means of information which provide knowledge of the sort of person that the user is and her interests [See Francois Nawrot, Katarzyna Syska and Przemyslaw Switalski, "Horizontal Application of Fundamental Rights - Right to Privacy on the Internet", 9th Annual European Constitutionalism Seminar (May 2010), University of Warsaw, available at "http://en.zpc.wpia.uw.edu.pl/wpcontent/ uploads/2010/04/9_Horizontal_Application_of_Fun damental_Rights.pdf".] .

Individually, these information silos may seem inconsequential. In aggregation, they disclose the nature of the personality: food habits, language, health, hobbies, sexual preferences, friendships, ways of dress and political affiliation. In aggregation, information provides a picture of the being: of things which matter and those that do not, of things to be disclosed and those best hidden.

xx xx xx

304. Data mining processes together with knowledge discovery can be combined to create facts about individuals. Metadata and the internet of things have the ability to redefine human existence in ways which are yet fully to be perceived. This, as Christina Moniodis states in her illuminating article, results in the creation of new knowledge about individuals; something which even she or he did not possess. This poses serious issues for the Court. In an age of rapidly evolving technology it is impossible for a Judge to conceive of all the possible uses of information or its consequences: "... The creation of new knowledge complicates data privacy law as it involves information the individual did not possess and could not disclose, knowingly or otherwise. In addition, as our State becomes an "information State" through increasing reliance on information-such that information is described as the "lifeblood that sustains political, social, and business decisions.

It becomes impossible to conceptualize all of the possible uses of information and resulting harms. Such a situation poses a challenge for courts who are effectively asked to anticipate and remedy invisible, evolving harms." [ Christina P. Moniodis, "Moving from Nixon to NASA: Privacy's Second Strand - A Right to Informational Privacy", Yale Journal of Law and Technology (2012), Vol. 15 (1), at p. 154.] The contemporary age has been aptly regarded as "an era of ubiquitous dataveillance, or the systematic monitoring of citizen's communications or actions through the use of information technology" [Yvonne McDermott, "Conceptualizing the Right to Data Protection in an Era of Big Data", Big Data and Society (2017), at p. 1.] .

It is also an age of "big data" or the collection of data sets. These data sets are capable of being searched; they have linkages with other data sets; and are marked by their exhaustive scope and the permanency of collection. [Id, at pp. 1 and 4.] The challenges which big data poses to privacy interests emanate from State and non-State entities. Users of wearable devices and social media networks may not conceive of themselves as having volunteered data but their activities of use and engagement result in the generation of vast amounts of data about individual lifestyles, choices and preferences. Yvonne McDermott speaks about the quantified self in eloquent terms:

"... The rise in the so-called 'quantified self', or the self-tracking of biological, environmental, physical, or behavioural information through tracking devices, Internet-of-things devices, social network data and other means (?Swan.2013) may result in information being gathered not just about the individual user, but about people around them as well. Thus, a solely consent-based model does not entirely ensure the protection of one's data, especially when data collected for one purpose can be repurposed for another." [Id, at p. 4.]

xx xx xx

328. Informational privacy is a facet of the right to privacy. The dangers to privacy in an age of information can originate not only from the State but from non-State actors as well. We commend to the Union Government the need to examine and put into place a robust regime for data protection. The creation of such a regime requires a careful and sensitive balance between individual interests and legitimate concerns of the State. The legitimate aims of the State would include for instance protecting national security, preventing and investigating crime, encouraging innovation and the spread of knowledge, and preventing the dissipation of social welfare benefits.

These are matters of policy to be considered by the Union Government while designing a carefully structured regime for the protection of the data. Since the Union Government has informed the Court that it has constituted a Committee chaired by Hon'ble Shri Justice B.N. Srikrishna, former Judge of this Court, for that purpose, the matter shall be dealt with appropriately by the Union Government having due regard to what has been set out in this judgment.

S.K. Kaul, J.:

585. The growth and development of technology has created new instruments for the possible invasion of privacy by the State, including through surveillance, profiling and data collection and processing. Surveillance is not new, but technology has permitted surveillance in ways that are unimaginable. Edward Snowden shocked the world with his disclosures about global surveillance. States are utilising technology in the most imaginative ways particularly in view of increasing global terrorist attacks and heightened public safety concerns.

One such technique being adopted by the States is "profiling". The European Union Regulation of 2016 [ Regulation No. (EU) 2016/679 of the European Parliament and of the Council of 27-4- 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive No. 95/46/EC (General Data Protection Regulation).] on data privacy defines "profiling" as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements [ Regulation No. (EU) 2016/679 of the European Parliament and of the Council of 27-4-2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive No. 95/46/EC (General Data Protection Regulation).] . Such profiling can result in discrimination based on religion, ethnicity and caste. However, "profiling" can also be used to further public interest and for the benefit of national security.

586. The security environment, not only in our country, but throughout the world makes the safety of persons and the State a matter to be balanced against this right to privacy.

587. The capacity of non-State actors to invade the home and privacy has also been enhanced. Technological development has facilitated journalism that is more intrusive than ever before.

588. Further, in this digital age, individuals are constantly generating valuable data which can be used by non-State actors to track their moves, choices and preferences. Data is generated not just by active sharing of information, but also passively, with every click on the "world wide web". We are stated to be creating an equal amount of information every other day, as humanity created from the beginning of recorded history to the year 2003 - enabled by the "world wide web". [ Michael L. Rustad, SannaKulevska, "Reconceptualizing the right to be forgotten to enable transatlantic data flow", (2015) 28 Harv JL & Tech 349.]

589. Recently, it was pointed out that " "Uber", the world's largest taxi company, owns no vehicles. "Facebook", the world's most popular media owner, creates no content. "Alibaba", the most valuable retailer, has no inventory. And "Airbnb", the world's largest accommodation provider, owns no real estate.

Something interesting is happening." [ Tom Goodwin "The Battle is for Customer Interface", <https://techcrunch.com/2015/03/03/in-the-age-ofdisintermediation- the-battle-is-all-for-the-customerinterface/>.] "Uber" knows our whereabouts and the places we frequent. "Facebook" at the least, knows who we are friends with. "Alibaba" knows our shopping habits. "Airbnb" knows where we are travelling to. Social network providers, search engines, e-mail service providers, messaging applications are all further examples of non-State actors that have extensive knowledge of our movements, financial transactions, conversations - both personal and professional, health, mental state, interest, travel locations, fares and shopping habits. As we move towards becoming a digital economy and increase our reliance on internetbased services, we are creating deeper and deeper digital footprints - passively and actively.

590. These digital footprints and extensive data can be analysed computationally to reveal patterns, trends, and associations, especially relating to human behaviour and interactions and hence, is valuable information. This is the age of "big data". The advancement in technology has created not just new forms of data, but also new methods of analysing the data and has led to the discovery of new uses for data. The algorithms are more effective and the computational power has magnified exponentially. A large number of people would like to keep such search history private, but it rarely remains private, and is collected, sold and analysed for purposes such as targeted advertising. of course, "big data" can also be used to further public interest. There may be cases where collection and processing of big data is legitimate and proportionate, despite being invasive of privacy otherwise.

591. Knowledge about a person gives a power over that person. The personal data collected is capable of effecting representations, influencing decision-making processes and shaping behaviour. It can be used as a tool to exercise control over us like the "big brother" State exercised. This can have a stultifying effect on the expression of dissent and difference of opinion, which no democracy can afford.

592. Thus, there is an unprecedented need for regulation regarding the extent to which such information can be stored, processed and used by non-State actors. There is also a need for protection of such information from the State. Our Government was successful in compelling Blackberry to give to it the ability to intercept data sent over Blackberry devices. While such interception may be desirable and permissible in order to ensure national security, it cannot be unregulated. [ Kadhim Shubber, "Blackberry gives Indian Government ability to intercept messages" published by Wired on 11-7-2013 <http://www.wired.co.uk/article/blackberry-india>.]

593. The concept of "invasion of privacy" is not the early conventional thought process of "poking ones nose in another person's affairs". It is not so simplistic. In today's world, privacy is a limit on the Government's power as well as the power of private sector entities. [ Daniel Solove, "10 Reasons Why Privacy Matters" published on 20-1-2014 <https://www.teachprivacy.com/10-reasons-privacymatters/>.]

594. George Orwell created a fictional State in Nineteen Eighty-Four. Today, it can be a reality. The technological development today can enable not only the State, but also big corporations and private entities to be the "big brother".

xx xx xx

629. The right of an individual to exercise control over his personal data and to be able to control his/her own life would also encompass his right to control his existence on the internet. Needless to say that this would not be an absolute right. The existence of such a right does not imply that a criminal can obliterate his past, but that there are variant degrees of mistakes, small and big, and it cannot be said that a person should be profiled to the nth extent for all and sundry to know.

630. A high school teacher was fired after posting on her Facebook page that she was "so not looking forward to another [school] year" since the school district's residents were "arrogant and snobby".

A flight attendant was fired for posting suggestive photos of herself in the company's uniform. [ Patricia Sánchez Abril, "Blurred Boundaries: Social Media Privacy and the Twenty-First-Century Employee", 49 Am Bus LJ 63 at p. 69 (2012).] In the predigital era, such incidents would have never occurred. People could then make mistakes and embarrass themselves, with the comfort that the information will be typically forgotten over time.

631. The impact of the digital age results in information on the internet being permanent. Humans forget, but the internet does not forget and does not let humans forget. Any endeavour to remove information from the internet does not result in its absolute obliteration.

The footprints remain. It is thus, said that in the digital world preservation is the norm and forgetting a struggle [ Ravi Antani,

"THE RESISTANCE of MEMORY : COULD THE EUROPEAN UNION'S RIGHT TO BE FORGOTTEN EXIST IN THE UNITED STATES?", 30 Berkeley Tech LJ 1173 (2015).] .

632. The technology results almost in a sort of a permanent storage in some way or the other making it difficult to begin life again giving up past mistakes. People are not static, they change and grow through their lives. They evolve. They make mistakes. But they are entitled to re-invent themselves and reform and correct their mistakes. It is privacy which nurtures this ability and removes the shackles of unadvisable things which may have been done in the past.

633. Children around the world create perpetual digital footprints on social network websites on a 24/7 basis as they learn their "ABCs": Apple, Bluetooth and chat followed by download, e-mail, Facebook, Google, Hotmail and Instagram. [ Michael L. Rustad, SannaKulevska, "Reconceptualizing the right to be forgotten to enable transatlantic data flow", (2015) 28 Harv JL & Tech 349.] They should not be subjected to the consequences of their childish mistakes and naivety, their entire life. Privacy of children will require special protection not just in the context of the virtual world, but also the real world.

634. People change and an individual should be able to determine the path of his life and not be stuck only on a path of which he/she treaded initially. An individual should have the capacity to change his/her beliefs and evolve as a person. Individuals should not live in fear that the views they expressed will forever be associated with them and thus refrain from expressing themselves.

635. Whereas this right to control dissemination of personal information in the physical and virtual space should not amount to a right of total eraser of history, this right, as a part of the larger right to privacy, has to be balanced against other fundamental rights like the freedom of expression, or freedom of media, fundamental to a democratic society.

636. Thus, the European Union Regulation of 2016 [Regulation No. (EU) 2016/679 of the European Parliament and of the Council of 27-4-2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive No. 95/46/EC (General Data Protection Regulation).] has recognised what has been termed as "the right to be forgotten". This does not mean that all aspects of earlier existence are to be obliterated, as some may have a social ramification. If we were to recognise a similar right, it would only mean that an individual who is no longer desirous of his personal data to be processed or stored, should be able to remove it from the system where the personal data/information is no longer necessary, relevant, or is incorrect and serves no legitimate interest.

Such a right cannot be exercised where the information/data is necessary, for exercising the right of freedom of expression and information, for compliance with legal obligations, for the performance of a task carried out in public interest, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims. Such justifications would be valid in all cases of breach of privacy, including breaches of data privacy."

(vi) Right to privacy cannot be impinged without a just, fair and reasonable law: It has to fulfill the test of proportionality i.e. (i) existence of a law; (ii) must serve a legitimate State aim; and (iii) proportionality.

"Dr. D.Y. Chandrachud, J. :

310. While it intervenes to protect legitimate State interests, the State must nevertheless put into place a robust regime that ensures the fulfilment of a threefold requirement. These three requirements apply to all restraints on privacy (not just informational privacy). They emanate from the procedural and content-based mandate of Article 21. The first requirement that there must be a law in existence to justify an encroachment on privacy is an express requirement of Article 21. For, no person can be deprived of his life or personal liberty except in accordance with the procedure established by law.

The existence of law is an essential requirement. Second, the requirement of a need, in terms of a legitimate State aim, ensures that the nature and content of the law which imposes the restriction falls within the zone of reasonableness mandated by Article 14, which is a guarantee against arbitrary State action. The pursuit of a legitimate State aim ensures that the law does not suffer from manifest arbitrariness. Legitimacy, as a postulate, involves a value judgment. Judicial review does not reappreciate or second guess the value judgment of the legislature but is for deciding whether the aim which is sought to be pursued suffers from palpable or manifest arbitrariness.

The third requirement ensures that the means which are adopted by the legislature are proportional to the object and needs sought to be fulfilled by the law. Proportionality is an essential facet of the guarantee against arbitrary State action because it ensures that the nature and quality of the encroachment on the right is not disproportionate to the purpose of the law. Hence, the threefold requirement for a valid law arises out of the mutual interdependence between the fundamental guarantees against arbitrariness on the one hand and the protection of life and personal liberty, on the other. The right to privacy, which is an intrinsic part of the right to life and liberty, and the freedoms embodied in Part III is subject to the same restraints which apply to those freedoms.

311. Apart from national security, the State may have justifiable reasons for the collection and storage of data. In a social welfare State, the Government embarks upon programmes which provide benefits to impoverished and marginalised sections of society. There is a vital State interest in ensuring that scarce public resources are not dissipated by the diversion of resources to persons who do not qualify as recipients. Allocation of resources for human development is coupled with a legitimate concern that the utilisation of resources should not be siphoned away for extraneous purposes.

Data mining with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the State to insist on the collection of authentic data. But, the data which the State has collected has to be utilised for legitimate purposes of the State and ought not to be utilised unauthorisedly for extraneous purposes. This will ensure that the legitimate concerns of the State are duly safeguarded while, at the same time, protecting privacy concerns. Prevention and investigation of crime and protection of the revenue are among the legitimate aims of the State. Digital platforms are a vital tool of ensuring good governance in a social welfare State. Information technology-legitimately deployed is a powerful enabler in the spread of innovation and knowledge.

312. A distinction has been made in contemporary literature between anonymity on one hand and privacy on the other. [See in this connection, Jeffrey M. Skopek, "Reasonable Expectations of Anonymity", Virginia Law Review (2015), Vol. 101, at pp. 691-762.] Both anonymity and privacy prevent others from gaining access to pieces of personal information yet they do so in opposite ways. Privacy involves hiding information whereas anonymity involves hiding what makes it personal. An unauthorised parting of the medical records of an individual which have been furnished to a hospital will amount to an invasion of privacy. On the other hand, the State may assert a legitimate interest in analysing data borne from hospital records to understand and deal with a public health epidemic such as malaria or dengue to obviate a serious impact on the population. If the State preserves the anonymity of the individual it could legitimately assert a valid State interest in the preservation of public health to design appropriate policy interventions on the basis of the data available to it.

313. Privacy has been held to be an intrinsic element of the right to life and personal liberty under Article 21 and as a constitutional value which is embodied in the fundamental freedoms embedded in Part III of the Constitution. Like the right to life and liberty, privacy is not absolute. The limitations which operate on the right to life and personal liberty would operate on the right to privacy. Any curtailment or deprivation of that right would have to take place under a regime of law. The procedure established by law must be fair, just and reasonable. The law which provides for the curtailment of the right must also be subject to constitutional safeguards.

xx xx xx

325. Like other rights which form part of the fundamental freedoms protected by Part III, including the right to life and personal liberty under Article 21, privacy is not an absolute right. A law which encroaches upon privacy will have to withstand the touchstone of permissible restrictions on fundamental rights. In the context of Article 21 an invasion of privacy must be justified on the basis of a law which stipulates a procedure which is fair, just and reasonable. The law must also be valid with reference to the encroachment on life and personal liberty under Article 21.

An invasion of life or personal liberty must meet the threefold requirement of

(i) legality, which postulates the existence of law;

(ii) need, defined in terms of a legitimate State aim; and

(iii) proportionality which ensures a rational nexus between the objects and the means adopted to achieve them.

S.A. Bobde, J. :

426. There is no doubt that privacy is integral to the several fundamental rights recognised by Part III of the Constitution and must be regarded as a fundamental right itself. The relationship between the right to privacy and the particular fundamental right (or rights) involved would depend on the action interdicted by a particular law. At a minimum, since privacy is always integrated with personal liberty, the constitutionality of the law which is alleged to have invaded into a rights bearer's privacy must be tested by the same standards by which a law which invades personal liberty under Article 21 is liable to be tested. Under Article 21, the standard test at present is the rationality review expressed in Maneka Gandhi case [Maneka Gandhi v. Union of India, (1978) 1 SCC 248] .

This requires that any procedure by which the State interferes with an Article 21 right to be "fair, just and reasonable, not fanciful, oppressive or arbitrary" [Maneka Gandhi v. Union of India, (1978) 1 SCC 248 at p. 323, para 48].

R.F. Nariman, J. :

526. But this is not to say that such a right is absolute. This right is subject to reasonable regulations made by the State to protect legitimate State interests or public interest. However, when it comes to restrictions on this right, the drill of various articles to which the right relates must be scrupulously followed.

For example, if the restraint on privacy is over fundamental personal choices that an individual is to make, State action can be restrained under Article 21 read with Article 14 if it is arbitrary and unreasonable; and under Article 21 read with Article 19(1) (a) only if it relates to the subjects mentioned in Article 19(2) and the tests laid down by this Court for such legislation or subordinate legislation to pass muster under the said article. Each of the tests evolved by this Court, qua legislation or executive action, under Article 21 read with Article 14; or Article 21 read with Article 19(1)(a) in the aforesaid examples must be met in order that State action pass muster. In the ultimate analysis, the balancing act that is to be carried out between individual, societal and State interests must be left to the training and expertise of the judicial mind.

S.K. Kaul, J. :

638. The concerns expressed on behalf of the petitioners arising from the possibility of the State infringing the right to privacy can be met by the test suggested for limiting the discretion of the State:

"(i) The action must be sanctioned by law;

(ii) The proposed action must be necessary in a democratic society for a legitimate aim;

(iii) The extent of such interference must be proportionate to the need for such interference;

(iv) There must be procedural guarantees against abuse of such interference."

Chelameswar, J.:

377. It goes without saying that no legal right can be absolute. Every right has limitations. This aspect of the matter is conceded at the Bar. Therefore, even a fundamental right to privacy has limitations. The limitations are to be identified on case-to-case basis depending upon the nature of the privacy interest claimed. There are different standards of review to test infractions of fundamental rights. While the concept of reasonableness overarches Part III, it operates differently across Articles (even if only slightly differently across some of them).

Having emphatically interpreted the Constitution's liberty guarantee to contain a fundamental right to privacy, it is necessary for me to outline the manner in which such a right to privacy can be limited. I only do this to indicate the direction of the debate as the nature of limitation is not at issue here.

378. To begin with, the options canvassed for limiting the right to privacy include an Article 14 type reasonableness enquiry [A challenge under Article 14 can be made if there is an unreasonable classification and/or if the impugned measure is arbitrary.

The classification is unreasonable if there is no intelligible differentia justifying the classification and if the classification has no rational nexus with the objective sought to be achieved. Arbitrariness, which was first explained at para 85 of E.P. Royappa v. State of T.N., (1974) 4 SCC 3 : 1974 SCC (L&S) 165 : AIR 1974 SC 555, is very simply the lack of any reasoning.] ; limitation as per the express provisions of Article 19; a just, fair and reasonable basis (that is, substantive due process) for limitation per Article 21; and finally, a just, fair and reasonable standard per Article 21 plus the amorphous standard of "compelling State interest".

The last of these four options is the highest standard of scrutiny [ A tiered level of scrutiny was indicated in what came to be known as the most famous footnote in constitutional law, that is, fn 4 in United States v. Carolene Products Co., 1938 SCC OnLine US SC 93 : 82 L Ed 1234 : 304 US 144 (1938). Depending on the graveness of the right at stake, the court adopts a correspondingly rigorous standard of scrutiny.] that a court can adopt. It is from this menu that a standard of review for limiting the right to privacy needs to be chosen.

379. At the very outset, if a privacy claim specifically flows only from one of the expressly enumerated provisions under Article 19, then the standard of review would be as expressly provided under Article 19. However, the possibility of a privacy claim being entirely traceable to rights other than Article 21 is bleak. Without discounting that possibility, it needs to be noted that Article 21 is the bedrock of the privacy guarantee. If the spirit of liberty permeates every claim of privacy, it is difficult, if not impossible, to imagine that any standard of limitation other than the one under Article 21 applies. It is for this reason that I will restrict the available options to the latter two from the above described four.

380. The just, fair and reasonable standard of review under Article 21 needs no elaboration. It has also most commonly been used in cases dealing with a privacy claim hitherto. [District Registrar and Collector v. Canara Bank, (2005) 1 SCC 496 : AIR 2005 SC 186] , [State of Maharashtra v. Bharat Shanti Lal Shah, (2008) 13 SCC 5] Gobind [Gobind v. State of M.P., (1975) 2 SCC 148 : 1975 SCC (Cri) 468] resorted to the compelling State interest standard in addition to the Article 21 reasonableness enquiry. From the United States, where the terminology of "compelling State interest" originated, a strict standard of scrutiny comprises two things-a "compelling State interest" and a requirement of "narrow tailoring" (narrow tailoring means that the law must be narrowly framed to achieve the objective).

As a term, "compelling State interest" does not have definite contours in the US. Hence, it is critical that this standard be adopted with some clarity as to when and in what types of privacy claimsit is to be used. Only in privacy claims which deserve the strictest scrutiny is the standard of compelling State interest to be used. As for others, the just, fair and reasonable standard under Article 21 will apply. When the compelling State interest standard is to be employed, must depend upon the context of concrete cases. However, this discussion sets the ground rules within which a limitation for the right to privacy is to be found."

82) In view of the aforesaid detailed discussion in all the opinions penned by six Hon'ble Judges, it stands established, without any pale of doubt, that privacy has now been treated as part of fundamental rights. The Court has held, in no uncertain terms, that privacy has always been a natural right which gives an individual freedom to exercise control over his or her personality. The judgment further affirms three aspects of the fundamental right to privacy, namely:

(i) intrusion with an individual's physical body;

(ii) informational privacy; and

(iii) privacy of choice.

83) As succinctly put by Nariman, J. first aspect involves the person himself/herself and guards a person's rights relatable to his/her physical body thereby controlling the uncalled invasion by the State. Insofar as the second aspect, namely, informational privacy is concerned, it does not deal with a person's body but deals with a person's mind. In this manner, it protects a person by giving her control over the dissemination of material that is personal to her and disallowing unauthorised use of such information by the State.

Third aspect of privacy relates to individual's autonomy by protecting her fundamental personal choices. These aspects have functional connection and relationship with dignity. In this sense, privacy is a postulate of human dignity itself. Human dignity has a constitutional value and its significance is acknowledged by the Preamble. Further, by catena of judgments, human dignity is treated as a fundamental right and as a facet not only of Article 21 but that of right to equality (Article 14) and also part of bouquet of freedoms stipulated in Article 19.

Therefore, privacy as a right is intrinsic of freedom, liberty and dignity. Viewed in this manner, one can trace positive and negative contents of privacy. The negative content restricts the State from committing an intrusion upon the life and personal liberty of a citizen. Its positive content imposes an obligation on the State to take all necessary measures to protect the privacy of the individual. 84) A brief summation of the judgment on privacy would indicate that privacy is treated as fundamental right. It is predicated on the basis that privacy is a postulate of dignity and the concept of dignity can be traced to the preamble of the Constitution as well as Article 21 thereof.

Further, privacy is considered as a subset of personal liberty thereby accepting the minority opinion in Kharak Singh v. State of U.P. & Ors.29 Another significant jurisprudential development of this judgment is that right to privacy as a fundamental right is not limited to Article 21. On the contrary, privacy resonates through the entirety of Part III of the Constitution which pertains to fundamental rights and, in particular, Articles 14, 19 and 21. Privacy is also recognised as a natural right which inheres in individuals and is, thus, inalienable. In developing the aforesaid concepts, the Court has been receptive to the principles in international law and international instruments.

It is a recognition of the fact that certain human rights cannot be confined within the bounds of geographical location of a nation but have universal application. In the process, the Court accepts the concept of universalisation of human rights, including the right to privacy as a human right and the good practices in developing and understanding such rights in other countries have been welcomed. In this hue, it can also be remarked that comparative law has played a very significant role in shaping the aforesaid judgment on privacy in Indian context, notwithstanding the fact that such comparative law has only a persuasive value.

85) The whole process of reasoning contained in different opinions of the Hon'ble Judges would, thus, reflect that the argument that it is difficult to precisely define the common denominator of privacy, was rejected. While doing so, the Court referred to various approaches in formulating privacy30. An astute and sagacious analysis of the judgment by the Centre for Internet and Society brings about the following approaches which contributed to formulating the following right to privacy:

(a) Classifying privacy on the basis of 'harms', thereby adopting the approach conceptualised by Daniel Solove. In his book, Understanding Privacy31, Daniel Solove makes a case for privacy being a family resemblance concept.

(b) Classifying privacy on the basis of 'interests': Gary Bostwick's taxonomy of privacy is among the most prominent amongst the scholarship that sub-areas within the right to privacy protect different 'interests' or 'justifications'. This taxonomy is adopted in Chelameswar, J.'s definition of 'privacy' and includes the three interests of privacy of repose, privacy of sanctuary and privacy of intimate decision. Repose is the 'right to be let alone', sanctuary is the interest which prevents others from knowing, seeing and hearing thus keeping information within the private zone, and finally, privacy of intimate decision protects the freedom to act autonomously.

(c) Classifying privacy as an 'aggregation of rights': This approach in classifying privacy as a right, as highlighted above, is not limited to one particular provision in the Chapter of Fundamental Rights under the Constitution but is associated with amalgam of different but connected rights. In formulating this principle, the Court has referred to scholars like Roger Clarke, Anita Allen etc. It has led to the recognition of private spaces or zones as protected under the right to privacy (thereby extending the ambit and scope of spatial privacy), informational privacy and decisional autonomy.

86) The important question that arises, which is directly involved in these cases, is: What is the scope of the right to privacy and in what circumstances such a right can be limited?

87) Concededly, fundamental rights are not absolute. The Constitution itself permits State to impose reasonable restrictions on these rights under certain circumstances. Thus, extent and scope of the right to privacy and how and when it can be limited by the State actions is also to be discerned. As noted above, Nariman, J. has led the path by observing that "when it comes to restrictions on this right, the drill of various Articles to which the right relates must be scrupulously followed".

Therefore, examination has to be from the point of view of Articles 14, 19 and 21 for the reason that right to privacy is treated as having intimate connection to various rights in Part III and is not merely related to Article 21. Looked from this angle, the action of the State will have to be tested on the touchstone of Article 14. This judgment clarifies that the 'classification' test adopted earlier has to be expanded and instead the law/action is to be tested on the ground of 'manifest arbitrariness'. This aspect has already been discussed in detail under the caption 'Scope of Judicial Review' above. When it comes to examining the 'restrictions' as per the provisions of Article 19 of the Constitution, the judgment proceeds to clarify that a law which impacts dignity and liberty under Article 21, as well as having chilling effects on free speech which is protected by Article 19(1)(a), must satisfy the standards of judicial review under both provisions. Therefore, such restriction must satisfy the test of judicial review under:

(i) one of the eight grounds mentioned under Article 19(2); and

(ii) the restriction should be reasonable.

This Court has applied multiple standards to determine reasonableness, including proximity, arbitrariness, and proportionality. Further, the reasonable restrictions must be in the interests of:

(i) the sovereignty and integrity of India,

(ii) the security of the State,

(iii) friendly relations with foreign States,

(iv) public order,

(v) decency or morality or

(vi) in relation to contempt of court,

(vii) defamation or

(viii) incitement to an offence.

88) The judgment further lays down that in the context of Article 21, the test to be applied while examining a particular provision is the 'just, fair and reasonable test' thereby bringing notion of proportionality.

89) The petitioners have sought to build their case on the aforesaid parameters of privacy and have submitted that this right of privacy, which is now recognised as a fundamental right, stands violated by the very fabric contained in the scheme of Aadhaar.

It is sought to be highlighted that the data which is collected by the State, particularly with the authentication of each transaction entered into by an individual, can be assimilated to construct a profile of such an individual and it particularly violates informational privacy. No doubt, there can be reasonable restrictions on this right, which is conceded by the petitioners. It is, however, argued that right to privacy cannot be impinged without a just, fair and reasonable law. Therefore, in the first instance, any intrusion into the privacy of a person has to be backed by a law. Further, such a law, to be valid, has to pass the test of legitimate aim which it should serve and also proportionality i.e. proportionate to the need for such interference. Not only this, the law in question must also provide procedural guarantees against abuse of such interference.

90) At the same time, it can also be deduced from the reading of the aforesaid judgment that the reasonable expectation of privacy may vary from the intimate zone to the private zone and from the private zone to the public arena. Further, privacy is not lost or surrendered merely because the individual is in a public place. For example, if a person was to post on Facebook vital information about himself, the same being in public domain, he would not be entitled to claim privacy right. This aspect is highlighted by some of the Hon'ble Judges as under: Dr. D.Y. Chandrachud, J.:

"297. What, then, does privacy postulate? Privacy postulates the reservation of a private space for the individual, described as the right to be let alone. The concept is founded on the autonomy of the individual. The ability of an individual to make choices lies at the core of the human personality. The notion of privacy enables the individual to assert and control the human element which is inseparable from the personality of the individual. The inviolable nature of the human personality is manifested in the ability to make decisions on matters intimate to human life. The autonomy of the individual is associated over matters which can be kept private. These are concerns over which there is a legitimate expectation of privacy. The body and the mind are inseparable elements of the human personality.

The integrity of the body and the sanctity of the mind can exist on the foundation that each individual possesses an inalienable ability and right to preserve a private space in which the human personality can develop. Without the ability to make choices, the inviolability of the personality would be in doubt. Recognising a zone of privacy is but an acknowledgment that each individual must be entitled to chart and pursue the course of development of personality. Hence privacy is a postulate of human dignity itself. Thoughts and behavioural patterns which are intimate to an individual are entitled to a zone of privacy where one is free of social expectations. In that zone of privacy, an individual is not judged by others. Privacy enables each individual to take crucial decisions which find expression in the human personality.

It enables individuals to preserve their beliefs, thoughts, expressions, ideas, ideologies, preferences and choices against societal demands of homogeneity. Privacy is an intrinsic recognition of heterogeneity, of the right of the individual to be different and to stand against the tide of conformity in creating a zone of solitude. Privacy protects the individual from the searching glare of publicity in matters which are personal to his or her life. Privacy attaches to the person and not to the place where it is associated. Privacy constitutes the foundation of all liberty because it is in privacy that the individual can decide how liberty is best exercised. Individual dignity and privacy are inextricably linked in a pattern woven out of a thread of diversity into the fabric of a plural culture.

xx xx xx

299. Privacy represents the core of the human personality and recognises the ability of each individual to make choices and to take decisions governing matters intimate and personal. Yet, it is necessary to acknowledge that individuals live in communities and work in communities. Their personalities affect and, in turn are shaped by their social environment. The individual is not a hermit. The lives of individuals are as much a social phenomenon.

In their interactions with others, individuals are constantly engaged in behavioural patterns and in relationships impacting on the rest of society. Equally, the life of the individual is being consistently shaped by cultural and social values imbibed from living in the community. This state of flux which represents a constant evolution of individual personhood in the relationship with the rest of society provides the rationale for reserving to the individual a zone of repose. The lives which individuals lead as members of society engender a reasonable expectation of privacy.

The notion of a reasonable expectation of privacy has elements both of a subjective and objective nature. Privacy at a subjective level is a reflection of those areas where an individual desires to be left alone. On an objective plane, privacy is defined by those constitutional values which shape the content of the protected zone where the individual ought to be left alone. The notion that there must exist a reasonable expectation of privacy ensures that while on the one hand, the individual has a protected zone of privacy, yet on the other, the exercise of individual choices is subject to the rights of others to lead orderly lives.

For instance, an individual who possesses a plot of land may decide to build upon it subject to zoning regulations. If the building byelaws define the area upon which construction can be raised or the height of the boundary wall around the property, the right to privacy of the individual is conditioned by regulations designed to protect the interests of the community in planned spaces. Hence while the individual is entitled to a zone of privacy, its extent is based not only on the subjective expectation of the individual but on an objective principle which defines a reasonable expectation.

xx xx xx

307. The sphere of privacy stretches at one end to those intimate matters to which a reasonable expectation of privacy may attach. It expresses a right to be left alone. A broader connotation which has emerged in academic literature of a comparatively recent origin is related to the protection of one's identity. Data protection relates closely with the latter sphere. Data such as medical information would be a category to which a reasonable expectation of privacy attaches. There may be other data which falls outside the reasonable expectation paradigm. Apart from safeguarding privacy, data protection regimes seek to protect the autonomy of the individual.

This is evident from the emphasis in the European data protection regime on the centrality of consent. Related to the issue of consent is the requirement of transparency which requires a disclosure by the data recipient of information pertaining to data transfer and use." S.A. Bobde, J: "421. Shri Rakesh Dwivedi, appearing for the State of Gujarat, while referring to several judgments of the Supreme Court of the United States, submitted that only those privacy claims which involve a "reasonable expectation of privacy" be recognised as protected by the fundamental right. It is not necessary for the purpose of this case to deal with the particular instances of privacy claims which are to be recognised as implicating a fundamental right. Indeed, it would be premature to do so. The scope and ambit of a constitutional protection of privacy can only be revealed to us on a case-by-case basis."

91) Though Nariman, J. did not subscribe to the aforesaid view in totality, however, His Lordship has also given an example that if a person has to post on Facebook vital information, the same being in public domain, she would not be entitled to the claim of privacy right.

92) We would also like to reproduce following discussion, in the opinion authored by Nariman, J., giving the guidance as to how a law has to be tested when it is challenged on the ground that it violates the fundamental right to privacy: "...Statutory provisions that deal with aspects of privacy would continue to be tested on the ground that they would violate the fundamental right to privacy, and would not be struck down, if it is found on a balancing test that the social or public interest and the reasonableness of the restrictions would outweigh the particular aspect of privacy claimed. If this is so, then statutes which would enable the State to contractually obtain information about persons would pass muster in given circumstances, provided they safeguard the individual right to privacy as well.

A simple example would suffice. If a person was to paste on Facebook vital information about himself/herself, such information, being in the public domain, could not possibly be claimed as a privacy right after such disclosure. But, in pursuance of a statutory requirement, if certain details need to be given for the statutory purpose concerned, then such details would certainly affect the right to privacy, but would on a balance, pass muster as the State action concerned has sufficient inbuilt safeguards to protect this right- viz. the fact that such information cannot be disseminated to anyone else, save on compelling grounds of public interest."

93) One important comment which needs to be made at this stage relates to the standard of judicial review while examining the validity of a particular law that allegedly infringes right to privacy. The question is as to whether the Court is to apply 'strict scrutiny' standard or the 'just, fair and reasonableness' standard. In the privacy judgment, different observations are made by different Hon'ble Judges and the aforesaid aspect is not determined authoritatively, may be for the reason that the Bench was deciding the reference on the issue as to whether right to privacy is a fundamental right or not and, in the process, it was called upon to decide the specific questions referred to it. We have dealt with this aspect at the appropriate stage.

Principles of Human Dignity:

94) While undertaking the analysis of the judgment in K.S. Puttaswamy, we have mentioned that one of the attributes laid down therein is that the sanctity of privacy lies in its functional relationship with dignity. Privacy is the constitutional core of human dignity. In the context of Aadhaar scheme how the concept of human dignity is to be applied assumes significance.

95) In Common Cause v. Union of India32, the concept of human dignity has been explained in much detail33. The concept of human dignity developed in the said judgment was general in nature which is based on right to autonomy and right of choice and it has become a constitutional value. In the last 40 years or so, this Court has given many landmark judgments wherein concept of human dignity is recognised as an attribute of fundamental rights. In the earlier years, though the meaning and scope of human dignity by itself was not expanded, this exercise has been undertaken in last few years. Earlier judgments have mentioned that human dignity is the intrinsic value of every human being and, in the process, a person's autonomy as an attribute of dignity stands recognised. The judgments rendered in the last few years have attempted to provide jurisprudential basis to the concept of human dignity itself.

96) In National Legal Services Authority v. Union of India & Ors.34 while recognising the right of transgenders of self determination of their sex, the Court explained the contours of human dignity in the following words:

"106. The basic principle of the dignity and freedom of the individual is common to all nations, particularly those having democratic set up. Democracy requires us to respect and develop the free spirit of human being which is responsible for all progress in human history. Democracy is also a method by which we attempt to raise the living standard of the people and to give opportunities to every person to develop his/her personality.

It is founded on peaceful co-existence and cooperative living. If democracy is based on the recognition of the individuality and dignity of man, as a fortiori we have to recognize the right of a human being to choose his sex/gender identity which is integral to his/her personality and is one of the most basic aspect of self-determination, dignity and freedom. In fact, there is a growing recognition that the true measure of development of a nation is not economic growth; it is human dignity.

107. More than 225 years ago, Immanuel Kant propounded the doctrine of free will, namely, the free willing individual as a natural law ideal. Without going into the detailed analysis of his aforesaid theory of justice (as we are not concerned with the analysis of his jurisprudence) what we want to point out is his emphasis on the "freedom" of human volition. The concepts of volition and freedom are "pure", that is not drawn from experience. They are independent of any particular body of moral or legal rules. They are presuppositions of all such rules, valid and necessary for all of them.

108. Over a period of time, two divergent interpretations of the Kantian criterion of justice came to be discussed. One trend was an increasing stress on the maximum of individual freedom of action as the end of law. This may not be accepted and was criticised by the protagonist of "hedonist utilitarianism", notably Bentham. This school of thought laid emphasis on the welfare of the society rather than an individual by propounding the principle of maximum of happiness to most of the people. Fortunately, in the instant case, there is no such dichotomy between the individual freedom/liberty we are discussing, as against public good. On the contrary, granting the right to choose gender leads to public good.

The second tendency of the Kantian criterion of justice was found in reinterpreting "freedom" in terms not merely of absence of restraint but in terms of attainment of individual perfection. It is this latter trend with which we are concerned in the present case and this holds good even today. As pointed out above, after the Second World War, in the form of the UN Charter and thereafter there is more emphasis on the attainment of individual perfection. In that united sense at least there is a revival of the natural law theory of justice. Blackstone, in the opening pages in his "Vattelian Fashion" said that the principal aim of society "is to protect individuals in the enjoyment of those absolute rights which were vested in them by the immutable laws of nature...."

97) Thus, right of choice and right of self determination were accepted as facets of human dignity. It was also emphasised that in certain cases, like the case at hand (that of transgenders), recognition of this aspect of human dignity would yield happiness to the individuals and, at the same time, also be in public good.

98) Advancement in conceptualising the doctrine of human dignity took place in the case of Shabnam v. Union of India & Ors.35 wherein this Court has gone to the extent of protecting certain rights of death convicts by holding that they cannot be executed till they exhaust all available constitutional and statutory remedies. In the process, the Court held as under: "

"15. This right to human dignity has many elements. First and foremost, human dignity is the dignity of each human being 'as a human being'. Another element, which needs to be highlighted, in the context of the present case, is that human dignity is infringed if a person's life, physical or mental welfare is harmed. It is in this sense torture, humiliation, forced labour, etc. all infringe on human dignity. It is in this context many rights of the accused derive from his dignity as a human being.

These may include the presumption that every person is innocent until proven guilty; the right of the accused to a fair trial as well as speedy trial; right of legal aid, all part of human dignity. Even after conviction, when a person is spending prison life, allowing humane conditions in jail is part of human dignity. Prisons reforms or Jail reforms measures to make convicts a reformed person so that they are able to lead normal life and assimilate in the society, after serving the jail term, are motivated by human dignity jurisprudence.

16. In fact, this principle of human dignity has been used frequently by Courts in the context of considering the death penalty itself. Way back in the year 1972, the United States Supreme Court kept in mind this aspect in the case of Furman v. Georgia 408 US 238 (1972). The Court, speaking through Brennan, J., while considering the application of Eighth Amendment's prohibition on cruel and unusual punishments, summed up the previous jurisprudence on the Amendment as 'prohibit(ing) the infliction of uncivilized and inhuman punishments. The State, even as it punishes, must treat its members with respect for their intrinsic worth as human beings. A punishment is 'cruel and unusual', therefore, if it does not comport with human dignity'.

In Gregg v. Georgia 428 US 153 (1976), that very Court, again through Brennan, J., considered that 'the fatal constitutional infirmity in the punishment of death is that it treats "members of the human race as non-humans, as objects to be toyed with an discarded. (It is), thus, inconsistent with the fundamental premise of the clause that even the vilest criminal remains a human being possessed of common human dignity'. The Canadian Supreme Court, the Hungarian Constitutional Court and the South African Supreme Court have gone to the extent of holding that capital punishment constitutes a serious impairment of human dignity and imposes a limitation on the essential content of the fundamental rights to life and human dignity and on that touchstone declaring that dignity as unconstitutional."

99) Next judgment in this line of cases would be that of Jeeja Ghosh & Another v. Union of India & Ors.36 wherein the Court, while expanding the jurisprudential basis, outlined three models of dignity which have been discussed by us above. These were referred to while explaining the normative role of human dignity, alongside, in the following manner:

"37. The rights that are guaranteed to differently-abled persons under the 1995 Act, are founded on the sound principle of human dignity which is the core value of human right and is treated as a significant facet of right to life and liberty. Such a right, now treated as human right of the persons who are disabled, has it roots in Article 21 of the Constitution. Jurisprudentially, three types of models for determining the content of the constitutional value of human dignity are recognised.

These are:

(i) Theological Models,

(ii) Philosophical Models, and

(iii) Constitutional Models. Legal scholars were called upon to determine the theological basis of human dignity as a constitutional value and as a constitutional right. Philosophers also came out with their views justifying human dignity as core human value. Legal understanding is influenced by theological and philosophical views, though these two are not identical. Aquinas and Kant discussed the jurisprudential aspects of human dignity based on the aforesaid philosophies. Over a period of time, human dignity has found its way through constitutionalism, whether written or unwritten.

Even right to equality is interpreted based on the value of human dignity. Insofar as India is concerned, we are not even required to take shelter under theological or philosophical theories. We have a written Constitution which guarantees human rights that are contained in Part III with the caption "Fundamental Rights". One such right enshrined in Article 21 is right to life and liberty. Right to life is given a purposeful meaning by this Court to include right to live with dignity. It is the purposive interpretation which has been adopted by this Court to give a content of the right to human dignity as the fulfilment of the constitutional value enshrined in Article 21. Thus, human dignity is a constitutional value and a constitutional goal. What are the dimensions of constitutional value of human dignity?

It is beautifully illustrated by Aharon Barak (former Chief Justice of the Supreme Court of Israel) in the following manner: "The constitutional value of human dignity has a central normative role. Human dignity as a constitutional value is the factor that unites the human rights into one whole. It ensures the normative unity of human rights. This normative unity is expressed in the three ways: first, the value of human dignity serves as a normative basis for constitutional rights set out in the Constitution; second, it serves as an interpretative principle for determining the scope of constitutional rights, including the right to human dignity; third, the value of human dignity has an important role in determining the proportionality of a statute limiting a constitutional right."

38. All the three goals of human dignity as a constitutional value are expanded by the author in a scholarly manner. Some of the excerpts thereof, are reproduced below which give a glimpse of these goals: "The first role of human dignity as a constitutional value is expressed in the approach that it comprises the foundation for all of the constitutional rights. Human dignity is the central argument for the existence of human rights.

It is the rationale for them all. It is the justification for the existence of rights. According to Christoph Enders, it is the constitutional value that determines that every person has the right to have rights... The second role of human dignity as a constitutional value is to provide meaning to the norms of the legal system. According to purposive interpretation, all of the provisions of the Constitution, and particularly all of the rights in the constitutional bill of rights, are interpreted in light of human dignity... Lastly, human dignity as a constitutional value influences the development of the common law. Indeed, where common law is recognised, Judges have the duty to develop it, and if necessary, modify it, so that it expresses constitutional values, including the constitutional value of human dignity.

To the extent that common law determines rights and duties between individuals, it might limit the human dignity of one individual and protect the human dignity of the other." 100) The concept was developed and expanded further in K.S. Puttaswamy. The Court held that privacy postulates the reservation of a private space for an individual, described as the right to be let alone, as a concept founded on autonomy of the individual. In this way, right to privacy has been treated as a postulate of human dignity itself. While defining so, the Court also remarked as under:

"298. Privacy of the individual is an essential aspect of dignity. Dignity has both an intrinsic and instrumental value. As an intrinsic value, human dignity is an entitlement or a constitutionally protected interest in itself. In its instrumental facet, dignity and freedom are inseparably intertwined, each being a facilitative tool to achieve the other. The ability of the individual to protect a zone of privacy enables the realisation of the full value of life and liberty... The family, marriage, procreation and sexual orientation are all integral to the dignity of the individual. Above all, the privacy of the individual recognises an inviolable right to determine how freedom shall be exercised..."

101) This concept of dignity took a leap forwarded in the case of Common Cause v. Union of India37 pertaining to passive euthanasia. Though this right was earlier recognised in Aruna Ramachandra Shanbaug v. Union of India & Ors.38, a totally new dimension was given to this right, based on freedom of choice which is to be given to an individual accepting his dignity. There were four concurring opinions. In one of the opinions39, the aspects of dignity are succinctly brought out in the following manner: "154. Dignity of an individual has been internationally recognised as an important facet of human rights in the year 1948 itself with the enactment of the Universal Declaration of Human Rights. Human dignity not only finds place in the Preamble of this important document but also in Article 1 of the same. It is well known that the principles set out in UDHR are of paramount importance and are given utmost weightage while interpreting human rights all over the world. The first and foremost responsibility fixed upon the State is the protection of human dignity without which any other right would fall apart. Justice Brennan in his book The Constitution of the United States: Contemporary Ratification has referred to the Constitution as "a sparkling vision of the supremacy of the human dignity of every individual". 155. In fact, in Christine Goodwin v. United Kingdom the European Court of Human Rights, speaking in the context of the Convention for the Protection of Human Rights and Fundamental Freedoms, has gone to the extent of stating that "the very essence of the Convention is respect for human dignity and human freedom". In the South African case of S. v. Makwanyane, O'Regan, J. stated in the Constitutional Court that "without dignity, human life is substantially diminished".

xx xx xx

157. The concept and value of dignity requires further elaboration since we are treating it as an inextricable facet of right to life that respects all human rights that a person enjoys. Life is basically self-assertion. In the life of a person, conflict and dilemma are expected to be normal phenomena. Oliver Wendell Holmes, in one of his addresses, quoted a line from a Latin poet who had uttered the message, "Death plucks my ear and says, Live- I am coming". That is the significance of living. But when a patient really does not know if he/she is living till death visits him/her and there is constant suffering without any hope of living, should one be allowed to wait?

Should she/he be cursed to die as life gradually ebbs out from her/his being? Should she/he live because of innovative medical technology or, for that matter, should he/she continue to live with the support system as people around him/her think that science in its progressive invention may bring about an innovative method of cure? To put it differently, should he/she be "Guinea pig" for some kind of experiment? The answer has to be an emphatic "No" because such futile waiting mars the pristine concept of life, corrodes the essence of dignity and erodes the fact of eventual choice which is pivotal to privacy.

xx xx xx

159. In Mehmood Nayyar Azam v. State of Chhattisgarh, a two-Judge Bench held thus: (SCC p. 6, para 1) "1. ... Albert Schweitzer, highlighting on Glory of Life, pronounced with conviction and humility, "the reverence of life offers me my fundamental principle on morality". The aforesaid expression may appear to be an individualistic expression of a great personality, but, when it is understood in the complete sense, it really denotes, in its conceptual essentiality, and connotes, in its macrocosm, the fundamental perception of a thinker about the respect that life commands.

The reverence of life is insegregably associated with the dignity of a human being who is basically divine, not servile. A human personality is endowed with potential infinity and it blossoms when dignity is sustained. The sustenance of such dignity has to be the superlative concern of every sensitive soul. The essence of dignity can never be treated as a momentary spark of light or, for that matter, "a brief candle", or "a hollow bubble". The spark of life gets more resplendent when man is treated with dignity sans humiliation, for every man is expected to lead an honourable life which is a splendid gift of "creative intelligence"."

xx xx xx

166. The purpose of saying so is only to highlight that the law must take cognizance of the changing society and march in consonance with the developing concepts. The need of the present has to be served with the interpretative process of law. However, it is to be seen how much strength and sanction can be drawn from the Constitution to consummate the changing ideology and convert it into a reality. The immediate needs are required to be addressed through the process of interpretation by the Court unless the same totally falls outside the constitutional framework or the constitutional interpretation fails to recognise such dynamism.

The Constitution Bench in Gian Kaur [Gian Kaur v. State of Punjab, (1996) 2 SCC 648 : 1996 SCC (Cri) 374] , as stated earlier, distinguishes attempt to suicide and abetment of suicide from acceleration of the process of natural death which has commenced. The authorities, we have noted from other jurisdictions, have observed the distinctions between the administration of lethal injection or certain medicines to cause painless death and non-administration of certain treatment which can prolong the life in cases where the process of dying that has commenced is not reversible or withdrawal of the treatment that has been given to the patient because of the absolute absence of possibility of saving the life.

To explicate, the first part relates to an overt act whereas the second one would come within the sphere of informed consent and authorised omission. The omission of such a nature will not invite any criminal liability if such action is guided by certain safeguards. The concept is based on non-prolongation of life where there is no cure for the state the patient is in and he, under no circumstances, would have liked to have such a degrading state. The words "no cure" have to be understood to convey that the patient remains in the same state of pain and suffering or the dying process is delayed by means of taking recourse to modern medical technology.

It is a state where the treating physicians and the family members know fully well that the treatment is administered only to procrastinate the continuum of breath of the individual and the patient is not even aware that he is breathing. Life is measured by artificial heartbeats and the patient has to go through this undignified state which is imposed on him. The dignity of life is denied to him as there is no other choice but to suffer an avoidable protracted treatment thereby thus indubitably casting a cloud and creating a dent in his right to live with dignity and face death with dignity, which is a preserved concept of bodily autonomy and right to privacy. In such a stage, he has no old memories or any future hopes but he is in a state of misery which nobody ever desires to have.

Some may also silently think that death, the inevitable factum of life, cannot be invited. To meet such situations, the Court has a duty to interpret Article 21 in a further dynamic manner and it has to be stated without any trace of doubt that the right to life with dignity has to include the smoothening of the process of dying when the person is in a vegetative state or is living exclusively by the administration of artificial aid that prolongs the life by arresting the dignified and inevitable process of dying. Here, the issue of choice also comes in. Thus analysed, we are disposed to think that such a right would come within the ambit of Article 21 of the Constitution." 102) In the other opinion40, four facets of euthanasia were discussed, namely:

(i) philosophy of euthanasia,

(ii) morality of euthanasia,

(iii) dignity in euthanasia, and

(iv) economics of euthanasia.

While discussing dignity in euthanasia, the three models of dignity, namely, theological, philosophical and constitutional model, were highlighted. Thereafter, postulates of dignity have been explained in the following manner:

"292. Aharon Barak, former Chief Justice of the Supreme Court of Israel, attributes two roles to the concept of human dignity as a constitutional value, which are:

292.1. Human dignity lays a foundation for all the human rights as it is the central argument for the existence of human rights.

292.2. Human dignity as a constitutional value provides meaning to the norms of the legal system. In the process, one can discern that the principle of purposive interpretation exhorts us to interpret all the rights given by the Constitution, in the light of the human dignity. In this sense, human dignity influences the purposive interpretation of the Constitution. Not only this, it also influences the interpretation of every sub-constitutional norm in the legal system. Moreover, human dignity as a constitutional value also influences the development of the common law.

xx xx xx

295. Dworkin, being a philosopher-jurist, was aware of the idea of a Constitution and of a constitutional right to human dignity. In his book, Taking Rights Seriously, he noted that everyone who takes rights seriously must give an answer to the question why human rights vis-ŕ-vis the State exist. According to him, in order to give such an answer one must accept, as a minimum, the idea of human dignity. As he writes: "Human dignity ... associated with Kant, but defended by philosophers of different schools, supposes that there are ways of treating a man that are inconsistent with recognising him as a full member of the human community, and holds that such treatment is profoundly unjust."

296. In his Book, Is Democracy Possible Here?42 Dworkin develops two principles about the concept of human dignity. First principle regards the intrinsic value of every person viz. every person has a special objective value which value is not only important to that person alone but success or failure of the lives of every person is important to all of us. The second principle, according to Dworkin, is that of personal responsibility. According to this principle, every person has the responsibility for success in his own life and, therefore, he must use his discretion regarding the way of life that will be successful from his point of view. Thus, Dworkin's jurisprudence of human dignity is founded on the aforesaid two principles which, together, not only define the basis but the conditions for human dignity. Dworkin went on to develop and expand these principles in his book, Justice for Hedgehogs (2011)43.

297. When speaking of rights, it is impossible to envisage it without dignity. In his pioneering and all-inclusive Justice for Hedgehogs, he proffered an approach where respect for human dignity, entails two requirements; first, selfrespect i.e. taking the objective importance of one's own life seriously; this represents the free will of the person, his capacity to think for himself and to control his own life and second, authenticity i.e. accepting a "special, personal responsibility for identifying what counts as success" in one's own life and for creating that life "through a coherent narrative" that one has chosen44. According to Dworkin, these principles form the fundamental criteria supervising what we should do in order to live well.45

They further explicate the rights that individuals have against their political community,46 and they provide a rationale for the moral duties we owe to others. This notion of dignity, which Dworkin gives utmost importance to, is indispensable to any civilised society. It is what is constitutionally recognised in our country and for good reason. Living well is a moral responsibility of individuals; it is a continuing process that is not a static condition of character but a mode that an individual constantly endeavours to imbibe. A life lived without dignity, is not a life lived at all for living well implies a conception of human dignity which Dworkin interprets includes ideals of self-respect and authenticity."

103) In summation, it can be said that the concept of human dignity dates back to thousands of years. Historically, human dignity, as a concept, found its origin in different religions which is held to be an important component of their theological approach. Jurists have given this approach as 'theological model' of dignity. It is primarily based on the premise that human beings are the creation of God and cannot be treated as mere material beings. Human identity is more ethical than spiritual because man is creation of God; harm to a human being is harm to God. God, thus, wishes to grant human being recognition, dignity and authority. It is also religious belief that God is rational and determines his goals for himself. Likewise, human being created by God too is rational and determines his own goal. Therefore, man has freedom of will. A couple of centuries ago, philosophical approach was given to the conception of human dignity. This sphere was headed by German Philosopher Immanuel Kant whose moral theory is divided into two parts: ethics and right. According to Kant, a person acts ethically when he acts by force of a duty that a rational agent self-legislates onto his own will. Thus, he talked of free will of the human being.

For Kant, ethics include duties of oneself (for example - to develop one's talents) and to others (for example - to contribute to their happiness). This ability is the human dignity of man. Philosophical approach, thus, is metaethical one, which is a journey from 'human being' and 'remaining human'. This is explained by Professor Upendra Baxi as the relationship between 'self', 'others' and 'society'. In this philosophical sense, dignity is 'respect' for an individual person based on the principle of freedom and capacity of making choices and a good or just social order is one which respects dignity via assuring 'contexts' and 'conditions' as the 'source of free and informed choice'.

To put it philosophically, each individual has a right to live her life the way she wants, without any subjugation. One can rule others, but then it is never noble. It is immoral because the other is not a means to you, the other is an end to herself. Kant also maintains that to use the other as a means is the basic immoral act. Everything else that is immoral is immoral because of this, so this should be the criterion: Are you using the other as a means? Someone has put this remarkably in the following words: "Alexander the Great is not noble, only Gautam the Buddha is noble, for the simple reason that Buddha has no rule over others but he is a matter of himself. There is no part of his being which is not in tune with him. He has come to attain absolute harmony. There is no conflict in him, there is a reign of absolute peace. And his consciousness is supreme, nothing is above it - no instinct, no intellect, nothing is higher than his consciousness."

104) Historically, a transition has taken place into the idea of dignity by transforming the amalgam of theological approach (man as creation of God deserving dignity) and philosophical approach based on morality, by elevating human dignity as a constitutional norm attaching constitutional value to it. It is a transition from 'respect' to 'right' by making respect as enforceable right. The manner in which it has happened in India has been traced above.

105) From the aforesaid discussion, it follows that dignity as a jurisprudential concept has now been well defined by this Court. Its essential ingredients can be summarised as under: The basic principle of dignity and freedom of the individual is an attribute of natural law which becomes the right of all individuals in a constitutional democracy. Dignity has a central normative role as well as constitutional value. This normative role is performed in three ways:

First, it becomes basis for constitutional rights;

Second, it serves as an interpretative principle for determining the scope of constitutional rights; and,

Third, it determines the proportionality of a statute limiting a constitutional right. Thus, if an enactment puts limitation on a constitutional right and such limitation is disproportionate, such a statute can be held to be unconstitutional by applying the doctrine of proportionality.

106) As per Dworkin, there are two principles about the concept of human dignity. First principle regards an 'intrinsic value' of every person, namely, every person has a special objective value, which value is not only important to that person alone but success or failure of the lives of every person is important to all of us. It can also be described as self respect which represents the free will of the person, her capacity to think for herself and to control her own life. The second principle is that of 'personal responsibility', which means every person has the responsibility for success in her own life and, therefore, she must use her discretion regarding the way of life that will be successful from her point of view.

107) Sum total of this exposition is well defined by Professor Baxi by explaining that as per the aforesaid view, dignity is to be treated as 'empowerment' which makes a triple demand in the name of 'respect' for human dignity, namely:

(i) respect for one's capacity as an agent to make one's own free choices;

(ii) respect for the choices so made; and

(iii) respect for one's need to have a context and conditions in which one can operate as a source of free and informed choice.

108) In this entire formulation, 'respect' for an individual is the fulcrum, which is based on the principle of freedom and capacity to make choices and a good or just social order is one which respects dignity via assuring 'contexts' and 'conditions' as the 'source of free and informed choice'.

109) The aforesaid discourse on the concept of human dignity is from an individual point of view. That is the emphasis of the petitioners as well. That would be one side of the coin. A very important feature which the present case has brought into focus is another dimension of human dignity, namely, in the form of 'common good' or 'public good'. Thus, our endeavour here is to give richer and more nuanced understanding to the concept of human dignity. Here, dignity is not limited to an individual and is to be seen in an individualistic way. A reflection on this facet of human dignity was stated in National Legal Services Authority (Transgenders' case), which can be discerned from the following discussion:

"103. A corollary of this development is that while so long the negative language of Article 21 and use of the word "deprived" was supposed to impose upon the State the negative duty not to interfere with the life or liberty of an individual without the sanction of law, the width and amplitude of this provision has now imposed a positive obligation (Vincent Panikurlangara v. Union of India) upon the State to take steps for ensuring to the individual a better enjoyment of his life and dignity e.g.:

(i) Maintenance and improvement of public health (Vincent Panikurlangara v. Union of India).

(ii) Elimination of water and air pollution (M.C. Mehta v. Union of India).

(iii) Improvement of means of communication (State of H.P. v. Umed Ram Sharma).

(iv) Rehabilitation of bonded labourers (Bandhua Mukti Morcha v. Union of India).

(v) Providing human conditions in prisons (Sher Singh v. State of Punjab) and protective homes (Sheela Barse v. Union of India).

(vi) Providing hygienic condition in a slaughterhouse (Buffalo Traders Welfare Assn. v. Maneka Gandhi). 104. The common golden thread which passes through all these pronouncements is that Article 21 guarantees enjoyment of life by all citizens of this country with dignity, viewing this human right in terms of human development. 105. The concepts of justice social, economic and political, equality of status and of opportunity and of assuring dignity of the individual incorporated in the Preamble, clearly recognise the right of one and all amongst the citizens of these basic essentials designed to flower the citizen's personality to its fullest. The concept of equality helps the citizens in reaching their highest potential. Thus, the emphasis is on the development of an individual in all respects."

110) Christopher McCrudden, an Oxford Academic, in his article 'Human Dignity and Judicial Interpretation of Human Rights' traces the evolution of concept of human dignity. In substance, his analysis is that in the early stages of social evolution, human dignity was understood as a concept associated with 'status'. Only those individuals were considered worthy of respect who enjoyed a certain status within the social construct.

Though one finds statements about dignity of humans as human beings on account of the human being the highest creation of God and his possession of mind and the power of reason in the Oration of Marcus Tullius Cicero, a Roman Politician and Philosopher (63 BC), and in the works of Pico della 47 Published in the European Journal of International Law on September 01, 2008 Mirandola, a Reformation Humanist (1486) 'On the dignity of man', yet there existed human beings who were not considered as human beings. There were slaves who were treated at par with animals.

111) Kant expounded the theory that humans should be treated as an end in themselves and not merely as a means to an end with ability to choose their destiny. Emphasis was laid on the intrinsic worth of the human being. Based on this philosophy emerged the initial declaration of rights. Kant wrote thus: "Humanity itself is a dignity; for a human being cannot be used merely as a means by any human being (...) but must always be used at the same time as an end. It is just in this that his dignity (personality) consists, by which he raises himself above all other beings in the world that are not human beings and yet can be used, and so overall things."

112) Charles Bernard Renouvier, a French Philosopher, said:

"Republic is a State which best reconciles dignity of individual with dignity of everyone."

113) Dignity extended to all citizens involves the idea of communitarism. A little earlier in 1798, Friedrich Schiller, a German poet of freedom and philosophy, brought out the connection between dignity and social condition in his work "Wurde des Menschen". He said "(g)ive him food and shelter; when you have covered his nakedness, dignity will follow by itself." It was during the period that abolition of slavery became an important political agenda. Slavery was considered as an affront to human dignity.

114) The Universal Declaration of Human Rights (UDHR) recorded in the Preamble recognition of the inherent dignity and of the equal and inalienable rights of all members of the human family as the foundation of freedom, justice and peace. It included freedom from fear and want as amongst the highest aspirations of the common people.

This is of course subject to resources of each State. But the realisation is contemplated through national effort and international cooperation. Evidently, the UDHR adopts a substantive or communitarian concept of human dignity. The realisation of intrinsic worth of every human being, as a member of society through national efforts as an indispensable condition has been recognised as an important human right. Truly speaking, this is directed towards the deprived, downtrodden and have nots.

115) We, therefore, have to keep in mind humanistic concept of human dignity which is to be accorded to a particular segment of the society and, in fact, a large segment. Their human dignity is based on the socio-economic rights that are read in to the fundamental rights, as already discussed above.

116) When we read socio-economic rights into human dignity, the community approach also assumes importance along with individualistic approach to human dignity. It has now been well recognised that at its core, human dignity contains three elements, namely, intrinsic value, autonomy and community value. These are known as core values of human dignity. These three elements can assist in structuring legal reasoning and justifying judicial choices in 'hard cases'. It has to be borne in mind that human dignity is a constitutional principle, rather than free standing fundamental rights. Insofar as intrinsic value is concerned, here human dignity is linked to the nature of being. We may give brief description of these three contents of the idea of human dignity as below:

(I) Intrinsic Value:

The uniqueness of human kind is the product of a combination of inherent traits and features - including intelligence, sensibility, and the ability to communicate - that give humans a special status in the world, distinct from other species.48 The intrinsic value of all individuals results in two basic postulates: anti-utilitarian and anti-authoritarian. The former consists of the formulation of Kant's categorical imperative that every individual is an end in him or herself, not a means for collective goals or the purposes of others. The latter is synthesized in the idea that the State exists for the individual, not the other way around. As for its legal implications, intrinsic value is the origin of a set of fundamental rights. The first of these rights is the right to life, a basic precondition for the enjoyment of any other right.

A second right directly related to the intrinsic value of each and every individual is equality before and under the law. All individuals are of equal value and, therefore, deserve equal respect and concern. This means not being discriminated against due to race, colour, ethnic or national origin, sex, age or mental capacity (the right to non-discrimination), as well as respect for cultural, religious, or linguistic diversity (the right to recognition). Human dignity fulfills only part of the content of the idea of equality, and in many situations it may be acceptable to differentiate among people. In the contemporary world, this is particularly at issue in cases involving affirmative action and the rights of religious minorities. Intrinsic value also leads to the right to integrity, both physical and mental.

The right to physical integrity includes the prohibition of torture, slave labour, and degrading treatment or punishment. Discussions on life imprisonment, interrogation techniques, and prison conditions take place within the scope of this right. The right to mental integrity comprises the right to personal honour and image and includes the right to privacy.

(II) Autonomy:

Autonomy is the ethical element of human dignity. It is the foundation of the free will of individuals, which entitles them to pursue the ideals of living well and having a good life in their own ways. The central notion is that of self-determination: An autonomous person establishes the rules that will govern his or her life. Kantian conception of autonomy is the will governed by the moral law (moral autonomy). Here, we are concerned with personal autonomy, which is value neutral and means the free exercise of the will according to one's own values, interests, and desires. Autonomy requires the fulfillment of certain conditions, such as reason (the mental capacity to make informed decisions), independence (the absence of coercion, manipulation and severe want), and choice (the actual existence of alternatives).

Autonomy, thus, is the ability to make personal decisions and choices in life based on one's conception of the good, without ndue external influences. As for its legal implications, autonomy underlies a set of fundamental rights associated with democratic constitutionalism, including basic freedoms (private autonomy) and the right of political participation (public autonomy). It would be pertinent to emphasise here that with the rise of the welfare state, many countries in the world (and that includes India) also consider a fundamental right to minimum living conditions (the existential minimum) in the balancing that results into effective autonomy. Thus, there are three facets of autonomy, namely: private autonomy, public autonomy and the existential minimum. Insofar as the last component is concerned, it is also referred to as social minimum or the basic right to the provision of adequate living conditions has its roots in right to equality as well. In fact, equality, in a substantive sense, and especially autonomy (both private and public), are dependent on the fact that individuals are "free from want," meaning that their essential needs are satisfied.

To be free, equal, and capable of exercising responsible citizenship, individuals must pass minimum thresholds of well-being, without which autonomy is a mere fiction. This requires access to some essential utilities, such as basic education and health care services, as well as some elementary necessities, such as food, water, clothing, and shelter. The existential minimum, therefore, is the core content of social and economic rights. This concept of minimum social right is protected by the Court, time and again.

(III) Community Value:

This element of human dignity as community value relates to the social dimension of dignity. The contours of human dignity are shaped by the relationship of the individual with others, as well as with the world around him. English poet John Donne expresses the same sentiments when he says 'no man is an island, entire of itself'49.

The individual, thus, lives within himself, within a community, and within a state. His personal autonomy is constrained by the values, rights, and morals of people who are just as free and equal as him, as well as by coercive regulation. Robert Post identified three distinct forms of social order: community (a "shared world of common faith and fate"), management (the instrumental organization of social life through law to achieve specific objectives), and democracy (an arrangement that embodies the purpose of individual and collective self-determination. These three forms of social order presuppose and depend on each other, but are also in constant tension. Dignity as a community value, therefore, emphasises the role of the state and community in establishing collective goals and restrictions on individual freedoms and rights on behalf of a certain idea of the good life. The relevant question here is in what circumstances and to what degree should these actions be regarded as legitimate in a constitutional democracy?

The liberal predicament that the state must be neutral with regard to different conceptions of the good in a plural society is not incompatible, of course, with limitation resulting from the necessary coexistence of different views and potentially conflicting rights. Such interferences, however, must be justified on grounds of a legitimate idea of justice, an "overlapping consensus"50 that can be shared by most individuals and groups. Whenever such tension arises, the task of balancing is to be achieved by the Courts. We would like to highlight one more significant feature which the issues involved in the present case bring about. It is the balancing of two facets of dignity of the same individual.

Whereas, on the one hand, right of personal autonomy is a part of dignity (and right to privacy), another part of dignity of the same individual is to lead a dignified life as well (which is again a facet of Article 21 of the Constitution). Therefore, in a scenario where the State is coming out with welfare schemes, which strive at giving dignified life in harmony with human dignity and in the process some aspect of autonomy is sacrificed, the balancing of the two becomes an important task which is to be achieved by the Courts. For, there cannot be undue intrusion into the autonomy on the pretext of conferment of economic benefits.

Precisely, this very exercise of balancing is undertaken by the Court in resolving the complex issues raised in the petitions.

Doctrine of Proportionality:

117) As noted above, whenever challenge is laid to an action of the State on the ground that it violates the right to privacy, the action of the State is to be tested on the following parameters:

(a) the action must be sanctioned by law;

(b) the proposed action must be necessary in a democratic society for a legitimate aim; and

(c) the extent of such interference must be proportionate to the need for such interference. 118) Doctrine of proportionality was explained by the Constitution Bench judgment of this Court in Modern Dental College and Research Centre & Ors. v. State of Madhya Pradesh & Ors.51. In the first instance, therefore, it would be apt to reproduce the said discussion:

"60. ...Thus, while examining as to whether the impugned provisions of the statute and rules amount to reasonable restrictions and are brought out in the interest of the general public, the exercise that is required to be undertaken is the balancing of fundamental right to carry on occupation on the one hand and the restrictions imposed on the other hand. This is what is known as "doctrine of proportionality". Jurisprudentially, "proportionality" can be defined as the set of rules determining the necessary and sufficient conditions for limitation of a constitutionally protected right by a law to be constitutionally permissible. According to Aharon Barak (former Chief Justice, Supreme Court of Israel), there are four sub-components of proportionality which need to be satisfied [Aharon Barak, Proportionality: Constitutional Rights and Their Limitation (Cambridge University Press 2012)], a limitation of a constitutional right will be constitutionally permissible if:

(i) it is designated for a proper purpose;

(ii) the measures undertaken to effectuate such a limitation are rationally connected to the fulfilment of that purpose;

(iii) the measures undertaken are necessary in that there are no alternative measures that may similarly achieve that same purpose with a lesser degree of limitation; and finally

(iv) there needs to be a proper relation ("proportionality stricto sensu" or "balancing") between the importance of achieving the proper purpose and the social importance of preventing the limitation on the constitutional right.

61. Modern theory of constitutional rights draws a fundamental distinction between the scope of the constitutional rights, and the extent of its protection. Insofar as the scope of constitutional rights is concerned, it marks the outer boundaries of the said rights and defines its contents. The extent of its protection prescribes the limitations on the exercises of the rights within its scope.

In that sense, it defines the justification for limitations that can be imposed on such a right.

62. It is now almost accepted that there are no absolute constitutional rights [ Though, debate on this vexed issue still continues and some constitutional experts claim that there are certain rights, albeit very few, which can still be treated as "absolute".

Examples given are:(a) Right to human dignity which is inviolable,(b) Right not to be subjected to torture or to inhuman or degrading treatment or punishment. Even in respect of such rights, there is a thinking that in larger public interest, the extent of their protection can be diminished. However, so far such attempts of the States have been thwarted by the judiciary.] and all such rights are related. As per the analysis of Aharon Barak [Aharon Barak, Proportionality: Constitutional Rights and Their Limitation (Cambridge University Press 2012).] , two key elements in developing the modern constitutional theory of recognising positive constitutional rights along with its limitations are the notions of democracy and the rule of law.

Thus, the requirement of proportional limitations of constitutional rights by a subconstitutional law i.e. the statute, is derived from an interpretation of the notion of democracy itself. Insofar as the Indian Constitution is concerned, democracy is treated as the basic feature of the Constitution and is specifically accorded a constitutional status that is recognised in the Preamble of the Constitution itself. It is also unerringly accepted that this notion of democracy includes human rights which is the cornerstone of Indian democracy. Once we accept the aforesaid theory (and there cannot be any denial thereof), as a fortiori, it has also to be accepted that democracy is based on a balance between constitutional rights and the public interests. In fact, such a provision in Article 19 itself on the one hand guarantees some certain freedoms in clause (1) of Article 19 and at the same time empowers the State to impose reasonable restrictions on those freedoms in public interest. This notion accepts the modern constitutional theory that the constitutional rights are related.

This relativity means that a constitutional licence to limit those rights is granted where such a limitation will be justified to protect public interest or the rights of others. This phenomenon- of both the right and its limitation in the Constitution- exemplifies the inherent tension between democracy's two fundamental elements. On the one hand is the right's element, which constitutes a fundamental component of substantive democracy; on the other hand is the people element, limiting those very rights through their representatives. These two constitute a fundamental component of the notion of democracy, though this time in its formal aspect. How can this tension be resolved? The answer is that this tension is not resolved by eliminating the "losing" facet from the Constitution. Rather, the tension is resolved by way of a proper balancing of the competing principles. This is one of the expressions of the multi-faceted nature of democracy. Indeed, the inherent tension between democracy's different facets is a "constructive tension".

It enables each facet to develop while harmoniously coexisting with the others. The best way to achieve this peaceful coexistence is through balancing between the competing interests. Such balancing enables each facet to develop alongside the other facets, not in their place. This tension between the two fundamental aspects- rights on the one hand and its limitation on the other hand- is to be resolved by balancing the two so that they harmoniously coexist with each other. This balancing is to be done keeping in mind the relative social values of each competitive aspects when considered in proper context.

63. In this direction, the next question that arises is as to what criteria is to be adopted for a proper balance between the two facets viz. the rights and limitations imposed upon it by a statute.

Here comes the concept of "proportionality", which is a proper criterion. To put it pithily, when a law limits a constitutional right, such a limitation is constitutional if it is proportional. The law imposing restrictions will be treated as proportional if it is meant to achieve a proper purpose, and if the measures taken to achieve such a purpose are rationally connected to the purpose, and such measures are necessary. This essence of doctrine of proportionality is beautifully captured by Dickson, C.J. of Canada in R. v. Oakes [R. v. Oakes, (1986) 1 SCR 103 (Can SC)] , in the following words (at p. 138): 'To establish that a limit is reasonable and demonstrably justified in a free and democratic society, two central criteria must be satisfied.

First, the objective, which the measures, responsible for a limit on a Charter right or freedom are designed to serve, must be "of" sufficient importance to warrant overriding a constitutional protected right or freedom ... Second ... the party invoking Section 1 must show that the means chosen are reasonable and demonstrably justified. This involves "a form of proportionality test..." Although the nature of the proportionality test will vary depending on the circumstances, in each case courts will be required to balance the interests of society with those of individuals and groups.

There are, in my view, three important components of a proportionality test. First, the measures adopted must be ... rationally connected to the objective. Second, the means ... should impair "as little as possible" the right or freedom in question ... Third, there must be a proportionality between the effects of the measures which are responsible for limiting the Charter right or freedom, and the objective which has been identified as of "sufficient importance". The more severe the deleterious effects of a measure, the more important the objective must be if the measure is to be reasonable and demonstrably justified in a free and democratic society.'

64. The exercise which, therefore, is to be taken is to find out as to whether the limitation of constitutional rights is for a purpose that is reasonable and necessary in a democratic society and such an exercise involves the weighing up of competitive values, and ultimately an assessment based on proportionality i.e. balancing of different interests.

65. We may unhesitatingly remark that this doctrine of proportionality, explained hereinabove in brief, is enshrined in Article 19 itself when we read clause (1) along with clause (6) thereof. While defining as to what constitutes a reasonable restriction, this Court in a plethora of judgments has held that the expression "reasonable restriction" seeks to strike a balance between the freedom guaranteed by any of the sub-clauses of clause (1) of Article 19 and the social control permitted by any of the clauses (2) to (6).

It is held that the expression "reasonable" connotes that the limitation imposed on a person in the enjoyment of the right should not be arbitrary or of an excessive nature beyond what is required in the interests of public. Further, in order to be reasonable, the restriction must have a reasonable relation to the object which the legislation seeks to achieve, and must not go in excess of that object (see P.P. Enterprises v. Union of India).

At the same time, reasonableness of a restriction has to be determined in an objective manner and from the standpoint of the interests of the general public and not from the point of view of the persons upon whom the restrictions are imposed or upon abstract considerations (see Mohd. Hanif Quareshi v. State of Bihar). In M.R.F. Ltd. v. State of Kerala, this Court held that in examining the reasonableness of a statutory provision one has to keep in mind the following factors:

(1) The directive principles of State policy.

(2) Restrictions must not be arbitrary or of an excessive nature so as to go beyond the requirement of the interest of the general public.

(3) In order to judge the reasonableness of the restrictions, no abstract or general pattern or a fixed principle can be laid down so as to be of universal application and the same will vary from case to case as also with regard to changing conditions, values of human life, social philosophy of the Constitution, prevailing conditions and the surrounding circumstances.

(4) A just balance has to be struck between the restrictions imposed and the social control envisaged by Article 19(6).

(5) Prevailing social values as also social needs which are intended to be satisfied by the restrictions.

(6) There must be a direct and proximate nexus or reasonable connection between the restrictions imposed and the object sought to be achieved. If there is a direct nexus between the restrictions, and the object of the Act, then a strong presumption in favour of the constitutionality of the Act will naturally arise."

(emphasis in original)

119) We may note at this stage that there is a growing awareness of the practical importance of the principle of proportionality for rights adjudication and it has sparked a wave of academic scholarship as well. The first integrates the doctrine of proportionality into a broader theoretical framework. It is propounded by Robert Alexy, premised on the theory of rights as principles and optimisation requirements52. For Alexy, all norms are either rules or principles.

Constitutional rights are principles, which means that they must be realised to the greatest extent factually and legally possible. For Alexy, the principle of proportionality follows logically from the nature of constitutional rights as principles. On the other hand, Mattias Kumm presented his theory of rights adjudication as Socratic contestation, with proportionality principle at its centre. As per Kumm, proportionality is the doctrinal tool which allows Judges to assess the reasonableness or plausibility, of a policy and thus to determine whether it survives Socratic contestation53. Recently, Kai Moller has proposed another theory, which is an autonomybased theory of what he calls 'the global model of constitutional rights', at the core of which lies the obligation of the State to take the autonomy interests of every person adequately into account54. In this process, his understanding of autonomy leads to one consequence, viz., there will often be conflicts of autonomy interests, which have to be resolved in line with each agent's status as an equal. Here, the proportionality principle becomes the doctrinal tool which guides Judges through the process of resolving those conflicts. One thing is clear from the above, i.e. jurisprudential explanations of proportionality principle. There may be some differences about the approach on the application of proportionality doctrine, it is certain that proportionality has become the lingua franca of judicial systems across borders, concerning the circumstances under which it is appropriate to limit fundamental rights.

120) The proportionality test which is stated in the aforesaid judgment, accepting Justice Barak's conceptualisation, essentially takes the version which is used by the German Federal Constitutional Court and is also accepted by most theorists of proportionality. According to this test, a measure restricting a right must, first, serve a legitimate goal (legitimate goal stage); it must, secondly, be a suitable means of furthering this goal (suitability or rational connection stage); thirdly, there must not be any less restrictive but equally effective alternative (necessity stage); and fourthly, the measure must not have a disproportionate impact on the right-holder (balancing stage).

121) Many issues arise while undertaking the exercise of proportionality inquiry. At legitimate goal stage, question arises as to what does it mean to speak of the goal of a policy, and what does it mean to require a goal to be legitimate?55 With regard to the suitability and necessity stages, some of the open issues are how to deal with empirical uncertainty: should this lead to wideranging deference to the elected branches?56 At the balancing stage, we have to ask the question of what it means to say that a right is 'balanced' against a competing right or public interest. One remarkable feature of the German test is that it tends to push most of the important issues into the last stage, viz., the balancing stage. At the legitimate goal stage, any goal that is legitimate will be accepted. At the suitability stage, even a marginal contribution to the achievement of the goal will suffice. At the necessity stage, it is very rare for a policy to fail because less restrictive alternatives normally come with some disadvantage and cannot, therefore, be considered equally effective. Thus, the balancing stage dominates the legal analysis and is usually determinative of the outcome.

122) In contrast, Canadian Supreme Court has chartered different course while using proportionality test. R. v. Oakes57 (popularly known as Oakes test), has held that the objective must be 'of sufficient importance to warrant overriding a constitutionally protected right or freedom'; there must be a rational connection between measure and objective; the means must 'impair "as little as possible" the right or freedom in question'; and finally, 'there must be a proportionality between the effects of the measures which are responsible for limiting the Charter right or freedom, and the objective which has been identified as of "sufficient importance"'.

Under this test, arguably more issues are addressed at the earlier stages. Instead of accepting any legitimate goal, Oakes requires a goal 'of sufficient importance to warrant overriding a constitutionally protected right or freedom'. And the minimal impairment test is different from the German necessity test both in the way in which it is formulated (there is no requirement that the less restrictive measure be equally effective) and in the way it is applied in practice: the Canadian Supreme Court tends to resolve cases at that stage and not, as the German Federal Constitutional Court, at the balancing stage.

123) There is a great debate as to which out of the aforesaid two approaches is a better approach. Some jurists are of the view that the proper application of the German test leads to a practice of constitutional review with two connected problems: first, as pointed about above, usually almost all the moral work is done at the balancing stage, arguably rendering the earlier stages largely useless and throwing doubt on the truth of the popular argument that proportionality is a valuable doctrine partly because it structures the analysis of rights issues in a meaningful way.

Secondly, the balancing act at the final stage is often carried out in an impressionistic fashion which seems to be largely unguided by principle and thus opens the door for subjective, arbitrary and unpredictable judgments encroaching on what ought to be the proper domain of the democratic legislature.

These concerns can, however, be addressed. According to Bilchitz58, first concern can be addressed by focusing on the necessity stage of the test. He takes issue with both the German test - according to which almost all policies are necessary because any alternative policy will usually have some disadvantage which means that it cannot be considered equally effective - and the Canadian minimal impairment test - which, taken seriously, narrows down the range of constitutionally acceptable policies far too much: 'minimal Writ impairment' can be read as insisting that only one measure could pass constitutional scrutiny, namely the measure which impairs the right least.59

So the alternatives seem to be either to construct the necessity (minimal impairment) test as filtering out almost nothing or to allow only one policy, thus rendering the elected branches partly superfluous. In order to preserve a meaningful but not unduly strict role for the necessity stage, Bilchitz proposes the following inquiry. First, a range of possible alternatives to the measure employed by the Government must be identified. Secondly, the effectiveness of these measures must be determined individually; the test here is not whether each respective measure realises the governmental objective to the same extent, but rather whether it realises it in a 'real and substantial manner'.

Thirdly, the impact of the respective measures on the right at stake must be determined. Finally, an overall judgment must be made as to whether in light of the findings of the previous steps, there exists an alternative which is preferable; and this judgment will go beyond the strict meansends assessment favoured by Grimm and the German version of the proportionality test; it will also require a form of balancing to be carried out at the necessity stage.

124) Insofar as second problem in German test is concerned, it can be taken care of by avoiding 'ad-hoc balancing' and instead proceeding on some 'bright-line rules' i.e. by doing the act of balancing on the basis of some established rule or by creating a sound rule. We may point out that whereas Chandrachud, J. has formulated the test of 'legitimate state interest', other two of the Judges, namely, Chelameswar and Sapre, JJ. have used the test of 'compelling state interest' and not 'legitimate state interest'. On the other hand, S.K. Kaul, J. has held that the test to be applied is whether the law satisfies 'public interest'. Nariman, J., on the other hand, pointed out that the Right to Information Act, 2005 has provided for personal information being disclosed to third parties subject to 'larger public interest' being satisfied.

If this test is applied, the result is that one would be entitled to invoke 'large public interest' in lieu of 'legitimate state aim' or 'legitimate state interest', as a permissible restriction on a claim to privacy of an individual - a more lenient test. However, since judgment of Chandrachud, J. is on behalf of himself and three other Judges and S.K. Kaul, J. has also virtually adopted the same test, we can safely adopt the test of 'legitimate state interest' as the majority opinion, instead of applying the test of 'compelling state interest'.

125) In Modern Dental College & Research Centre, four sub components or proportionality which need to be satisfied were taken note of.

These are:

(a) A measure restricting a right must have a legitimate goal (legitimate goal stage).

(b) It must be a suitable means of furthering this goal (suitability or rationale connection stage).

(c) There must not be any less restrictive but equally effective alternative (necessity stage). (d) The measure must not have a disproportionate impact on the right holder (balancing stage). 126) This has been approved in K.S. Puttaswamy as well. Therefore, the aforesaid stages of proportionality can be looked into and discussed. of course, while undertaking this exercise it has also to be seen that the legitimate goal must be of sufficient importance to warrant overriding a constitutionally protected right or freedom and also that such a right impairs freedom as little as possible.

This Court, in its earlier judgments, applied German approach while applying proportionality test to the case at hand. We would like to proceed on that very basis which, however, is tempered with more nuanced approach as suggested by Bilchitz. This, in fact, is the amalgam of German and Canadian approach. We feel that the stages, as mentioned in Modern Dental College & Research Centre and recapitulated above, would be the safe method in undertaking this exercise, with focus on the parameters as suggested by Bilchitz, as this projects an ideal approach that need to be adopted. Issues:

127) After setting the tone of the case, it is now time to specify the precise issues which are involved that need to be decided in these matters:

(1) Whether the Aadhaar Project creates or has tendency to create surveillance state and is, thus, unconstitutional on this ground?

(a) What is the magnitude of protection that needs to be accorded to collection, storage and usage of biometric data?

(b) Whether the Aadhaar Act and Rules provide such protection, including in respect of data minimisation, purpose limitation, time period for data retention and data protection and security?

(2) Whether the Aadhaar Act violates right to privacy and is unconstitutional on this ground? {This issue is considered in the context of Sections 7 and 8 of the Aadhaar Act. Incidental issue of 'Exclusion' is also considered here}

(3) Whether children can be brought within the sweep of Sections 7 and 8 of the Aadhaar Act?

(4) Whether the following provisions of the Aadhaar Act and Regulations suffer from the vice of unconstitutionality:

(i) Sections 2(c) and 2(d) read with Section 32

(ii) Section 2(h) read with Section 10 of CIDR

(iii) Section 2(l) read with Regulation 23

(iv) Section 2(v)

(v) Section 3

(vi) Section 5

(vii) Section 6

(viii) Section 8 (ix) Section 9

(x) Sections 11 to 23

(xi) Sections 23 and 54

(xii) Section 23(2)(g) read with Chapter VI & VII - Regulations 27 to 32

(xiii) Section 29

(xiv) Section 33

(xv) Section 47

(xvi) Section 48

(xvii) Section 57

(xviii) Section 59

(5) Whether the Aadhaar Act defies the concept of Limited Government, Good Governance and Constitutional Trust?

(6) Whether the Aadhaar Act could be passed as 'Money Bill' within the meaning of Article 110 of the Constitution?

(7) Whether Section 139AA of the Income Tax Act, 1961 is violative of right to privacy and is, therefore, unconstitutional?

(8) Whether Rule 9(a)(17) of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 and the notifications issued thereunder, which mandate linking of Aadhaar with bank accounts, are unconstitutional?

(9) Whether Circular dated March 23, 2017 issued by the Department of Telecommunications mandating linking of mobile number with Aadhaar is illegal and unconstitutional?

(10) Whether certain actions of the respondents are in contravention of the interim orders passed by the Court, if so, the effect thereof?

128) We now proceed to discuss the arguments on these grounds, as advanced by the petitioners, reply thereto and our conclusions thereupon. Surveillance: Whether the Aadhaar Project creates or has tendency to create surveillance state and is, thus, unconstitutional on this ground? Education took us from thumb impression to signature Technology has taken us from signature to thumb impression, again

129) It may be remarked at the outset that the argument of surveillance draws sustenance, to a larger extent, from privacy rights as well. Therefore, the arguments which were addressed under this caption have traces of privacy also. However, these are discussed in the context of surveillance state argument.

130) It was submitted that Aadhaar project creates the architecture of a 'cradle to grave' surveillance state and society. This means that it enables the State to profile citizens, track their movements, assess their habits and silently influence their behaviour throughout their lives.

Over time, the profiling enables the State to stifle dissent and influence political decision making. The architecture of the project comprises a Central Identities Data Repository which stores and maintains authentication transaction data. The authentication record comprises the time of authentication and the identity of the requesting entity. The UIDAI and the Authentication Service Agency (ASA) is permitted to store this authentication record for 2 + 5 years (as per Regulations 20 and 26/27 of the Authentication Regulations). Based on this architecture it is possible for the State to track down the location of the person seeking authentication. Since the requesting entity is also identified, the activity that the citizen is engaging in is also known. (Sections 2(d), 2(h), 8, 10, 32 of the Act read with Regulations 18, 20, 26 of the Aadhaar (Authentication) Regulation, 2016).

131) According to the petitioners, the Authority has the following information (according to the document on technical specification of Aadhaar registered devices published by the Authority in February 2017) - Aadhaar number, name of Aadhaar holder, whether authentication failed or was successful, reason for such failure, requesting entities' Internet Protocol (IP) address, date and time of authentication, device ID and its unique ID of authentication device which can be used to locate the individual.

132) Authentication of Aadhaar number enables tracking, tagging and profiling of individuals as the IP Address of the authentication device gives an idea of its geographical location (determinable within the range of 2 kilometres), country, city, region, pin code/zip code). Mr. Divan submits that an individual is on an electronic leash, tethered to a central data repository that has the architecture to track all activities of an individual.

The Aadhaar Act creates a database of all Indian residents and citizens with their core biometric information, demographic information and meta data. In light of the enormous potential of information, concentration of information in a single entity, i.e., the Authority, enabling easier access to aggregated information puts the State in a position to wield enormous power. Given that with advancements in technology, such information can affect every aspect of an individual's personal, professional, religious and social life, such power is a threat to individual freedoms guaranteed under Articles 19(1)(a) to 19(1)(g) of the Constitution and other fundamental rights guaranteed under Article 21 (Right to informational privacy) and Article 25 of the Constitution.

It was submitted that the Aadhaar Act treats the entire populace of the country as potential criminals ignoring the necessity to balance the State's mandate of protection against crime with the right to personal bodily integrity which is envisaged under Article 21 read with Article 20(3) of the Constitution. It does not require the collection of data to have a nexus with a crime. Mr. Sibal submits that in the decision in Selvi & Ors. v. State of Karnataka60, this Court has held: "The theory of interrelationship of rights mandates that the right against self-incrimination should also be read as a component of "personal liberty" under Article 21. Hence, our understanding of the "right to privacy" should account for its intersection with Article 20(3)"

133) It is argued that the Aadhaar Act, therefore, violates the right to protection from self-incrimination, and the right to privacy and personal dignity/bodily integrity under Article 20(3) and Article 21.

134) It was argued that the Constitution of India repudiates mass surveillance as enabled by Aadhaar and the project ought to be struck down on this ground alone. There is no question of balancing or justification in case of a surveillance architecture.

135) Passages from various judgments were quoted in an attempt to establish that surveillance causes interference with right to privacy, life and liberty. From Kharak Singh v. State of U.P.61, dissenting opinion of Subba Rao, J. (which has been upheld in K.S. Puttaswamy) was relied upon. With respect to how surveillance constricts right to life and liberty, His Lordship held that: "Now let us consider the scope of Article 21. The expression "life" used in that Article cannot be confined only to the taking away of life, i.e., causing death. In Munn v. Illinois (1), Field, J., defined "life" in the following words:

"Something more than mere animal existence. The inhibition against its deprivation extends to all those limbs and faculties by which life is enjoyed. The provision equally prohibits the mutilation of the body by the amputation of an arm or leg, or the putting out of an eye, or the destruction of any other organ of the body through which the soul communicates with the outer world. The expression "'liberty" is given a very wide meaning in America. It takes in all the freedoms. In Bolling v. Sharpe (2), the Supreme Court of America observed that the said expression was not confined to mere freedom from bodily restraint and that liberty under law extended to the full range of conduct which the individual was free to pursue.

But this absolute right to liberty was regulated to protect other social interests by the State exercising its powers such as police power, the power of eminent domain, the power of taxation etc. The proper exercise of the power which is called the due process of law is controlled by the Supreme Court of America. In India the word "liberty" has been qualified by the word "Personal", indicating thereby that it is confined only to the liberty of the person. The other aspects of the liberty have been provided for in other Articles of the Constitution

xx xx xx

It is true our Constitution does not expressly declare a right to privacy as a fundamental right, but the said right is an essential ingredient of personal liberty. Every democratic country sanctifies domestic life; it is expected to give him rest, physical happiness, peace of mind and security. In the last resort, a person's house, where he lives with his family, is his "castle"; it is his rampart against encroachment on his personal liberty. The pregnant words of that famous Judge, Frankfurter J., in Wolf v. Colorado [[1949] 238 US 25] pointing out the importance of the security of one's privacy against arbitrary intrusion by the police, could have no less application to an Indian home as to an American one.

If physical restraints on a person's movements affect his personal liberty, physical encroachments on his private life would affect it in a larger degree. Indeed, nothing is more deleterious to a man's physical happiness and health than a calculated interference with his privacy. We would, therefore, define the right of personal liberty in Article 21 as a right of an individual to be free from restrictions or encroachments on his person, whether those restrictions or encroachments are directly imposed or indirectly brought about by calculated measures.

xx xx xx

The freedom of movement in clause (d) of Article 19 therefore must be a movement in a free country i.e. in a country where he can do whatever he likes, speak to whomsoever he wants, meet people of his own choice without any apprehension, subject of course to the law of social control. The petitioner under the shadow of surveillance is certainly deprived of this freedom. He can move physically, but he cannot do so freely, for all his activities are watched and noted. The shroud of surveillance cast upon him perforce engender inhibitions in him and he cannot act freely as he would like to do. "

136) In the case of District Registrar and Collector, Hyderabad and Anr. v. Canara Bank and Ors.62, this Court struck down provisions of a legislation on grounds that it was too intrusive of citizens' right to privacy. The case involved an evaluation of the Andhra Pradesh Stamp Act which authorized the collector to delegate "any person" to enter any premises in order to search for and impound any document that was found to be improperly stamped. After an exhaustive analysis of privacy laws across the world, and in India, the Court held that in the absence of any safeguards as to probable or reasonable cause or reasonable basis, this provision was violative of the constitutionally guaranteed right to privacy "both of the house and of the person".

The Court held: "The A.P. amendment permits inspection being carried out by the Collector by having access to the documents which are in private custody i.e. custody other than that of a public officer. It is clear that this provision empowers invasion of the home of the person in whose possession the documents 'tending' to or leading to the various facts stated in sec. 73 are in existence and sec. 73 being one without any safeguards as to probable or reasonable cause or reasonable basis or materials violates the right to privacy both of the house and of the person. We have already referred to R. Rajagopal's case wherein the learned judges have held that the right to personal liberty also means the life free from encroachments unsustainable in law and such right flowing from Article 21 of the Constitution."

137) Reference was made to the U.S Supreme Court case of U.S. v. Jones63 where the court held that installing a Global Positioning System (GPS) tracking device on a vehicle and using the device to monitor the vehicle's movements constitutes an unlawful search under the Fourth Amendment. Sotomayor, J. in her concurring judgment observed that Fourth Amendment search and seizure is not only concerned with physical trespassory intrusions on property but also non-physical violation of privacy that society recognizes as reasonable. She notes that GPS data can reveal an entire profile of a person simply by knowing the places she visits and that the Government can mine this data in the future:

"With increasing regularity, the Government will be capable of duplicating the monitoring undertaken in this case by enlisting factory or owner-installed vehicle tracking devises or GPS enabled smart-phones ... In cases of electronic or other novel modes of surveillance that do not depend upon a physical invasion on property, the trespassory test may provide little guidance.

xx xx xx

GPS monitoring generates a precise, comprehensive record of a person's public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations ... disclosed GPS data will be trips to the psychiatrist, plastic surgeon, abortion clinic, AIDS treatment centre, strip club, criminal defence attorney ... Government can store such records and efficiently mine them for information years into the future... awareness that the government may be watching chills associational and expressive freedom ... it may alter the relationship between citizen and government in a way that is inimical to democratic society.

xx xx xx

I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection ... ("Privacy is not a discrete commodity, possessed absolutely or not at all. Those who disclose certain facts to a bank or phone company for a limited business purpose need not assume that this information will be released to other persons for other purposes") ... ("[W]hat [a person] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected")."

138) The judgment of the ECtHR in Zakharov v. Russia64 was also referred to where the ECtHR examined an application claiming violation of Article 8 of the Convention (right to respect for private and family life) alleging that the mobile operators had permitted unrestricted interception of all telephone communications by the security services without prior judicial authorisation, under the prevailing national law. The Court observed that:

"Mr Zakharov was entitled to claim to be a victim of a violation of the European Convention, even though he was unable to allege that he had been the subject of a concrete measure of surveillance. Given the secret nature of the surveillance measures provided for by the legislation, their broad scope (affecting all users of mobile telephone communications) and the lack of effective means to challenge them at national level... Russian law did not meet the "quality of law" requirement and was incapable of keeping the interception of communications to what was "necessary in a democratic society". There had accordingly been a violation of Article 8 of the Convention... existence of arbitrary and abusive surveillance practices, which appear to be due to inadequate safeguards provided by law".

139) The Court held that any interference with the right to privacy under Article 8 can only be justified under Article 8(2) if it is in accordance with law, pursues one or more legitimate aims and is necessary in a democratic society to achieve such aim. "In accordance with the law" requires the impugned measure both to have some basis in domestic law and to be compatible with the rule of law, which is expressly mentioned in the Preamble to the Convention and inherent in the object and purpose of Article 8.

The law must, thus, meet quality requirements: it must be accessible to the person concerned and foreseeable as to its effects. With respect to foreseeability of surveillance, the court held: "Foreseeability in the special context of secret measures of surveillance, such as the interception of communications, cannot mean that an individual should be able to foresee when the authorities are likely to intercept his communications so that he can adapt his conduct accordingly. However, especially where a power vested in the executive is exercised in secret, the risks of arbitrariness are evident. It is therefore essential to have clear, detailed rules on interception of telephone conversations, especially as the technology available for use is continually becoming more sophisticated.

The domestic law must be sufficiently clear to give citizens an adequate indication as to the circumstances in which and the conditions on which public authorities are empowered to resort to any such measures.

xx xx xx

Since the implementation in practice of measures of secret surveillance of communications is not open to scrutiny by the individuals concerned or the public at large, it would be contrary to the rule of law for the discretion granted to the executive or to a judge to be expressed in terms of an unfettered power. Consequently, the law must indicate the scope of any such discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity to give the individual adequate protection against arbitrary interference."

140) The Court observed that the following minimum safeguards that should be set out in law in order to avoid abuses of power for surveillance are: the nature of offences which may give rise to an interception order; a definition of the categories of people liable to have their telephones tapped; a limit on the duration of telephone tapping; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which recordings may or must be erased or destroyed.

141) For establishing if the measures were "necessary in a democratic society" in pursuit of a legitimate aim, the Court observed: "When balancing the interest of the respondent State in protecting its national security through secret surveillance measures against the seriousness of the interference with an applicant's right to respect for his or her private life, the national authorities enjoy a certain margin of appreciation in choosing the means for achieving the legitimate aim of protecting national security. However, this margin is subject to European supervision embracing both legislation and decisions applying it.

In view of the risk that a system of secret surveillance set up to protect national security may undermine or even destroy democracy under the cloak of defending it, the Court must be satisfied that there are adequate and effective guarantees against abuse. The assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law. The Court has to determine whether the procedures for supervising the ordering and implementation of the restrictive measures are such as to keep the "interference" to what is "necessary in a democratic society"."

142) Two other cases of violation of Article of the European Convention of Human Rights were cited, namely Digital Rights Ireland Ltd. v. Minister for Communication, Marine and Natural Resources65 and S and Marper v. United Kingdom66. In Digital Ireland, the European Parliament and the Council of the European Union adopted Directive 2006/24/EC (Directive), which regulated Internet Service Providers' storage of telecommunications data. It could be used to retain data generated or processed in connection with the provision of publicly available electronic communications services or of public communications network for the purpose of fighting serious crime in the European Union (EU).

The data included data necessary to trace and identify the source of communication and its destination, to identify the date, time duration, type of communication, IP address, telephone number and other fields. The European Court of Justice (ECJ) evaluated the compatibility of the Directive with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and declared the Directive to be invalid. According to the ECJ, the Directive interfered with the right to respect for private life under Article 7 and with the right to the protection of personal data under Article 8. It allowed very precise conclusion to be drawn concerning the private lives of the persons whose data had been retained, such as habits of everyday life, permanent or temporary places of residence, daily and other movements, activities carried out, social relationships and so on. The invasion of right was not proportionate to the legitimate aim pursued.

143) In S and Marper, the storing of DNA profiles and cellular samples of any person arrested in the United Kingdom was challenged before the ECtHR. Even if the individual was never charged, if criminal proceedings were discontinued, or if the person was later acquitted of any crime, their DNA profile could nevertheless be kept permanently on record. It held that there had been a violation of Article 8 of the ECHR. Fingerprints, DNA profiles and cellular samples, constituted personal data and their retention was capable of affecting private life of an individual. Retention of such data without consent, thus, constitutes violation of Article 8 as they relate to identified and identifiable individuals.

The Court held that invasion of privacy was not "necessary in a democratic society as it did not fulfill any pressing social need. The blanket and indiscriminate nature of retention of data was excessive and did not strike a balance between private and public interest.

144) The respondents, on the other hand, rebutted the arguments of the petitioners that the architecture of the Aadhaar Act enables State surveillance. It was submitted that bare minimal information was obtained from the individual who enrolled for Aadhaar. Insofar as demographic information is concerned, it included name, date of birth, address, gender, mobile number and email address. The latter two are optional and meant for transmitting relevant information to the AMH and for One Time Password (OTP) based authentication. This information was in respect of an individual and is always in public domain. Section 2(k) of the Aadhaar Act specifically provides that regulations cannot include race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Therefore, sensitive information specifically stands excluded.

This specific exclusion, in the context, ensures that the scope of including additional demographic information is very narrow and limited. It was also argued that even the biometric information was limited to the fingerprints and iris scan, which is considered to be the core biometric information. Such information is, again, frequently utilised globally to ascertain the identity of a person. The argument was, thus, that the information gathered was noninvasive and non-intrusive identity information.

145) It was also argued that the very scheme of the Aadhaar and the manner in which it operates excludes every possibility of data profiling and, therefore, the question of State surveillance would not arise. The powerpoint presentation which was given by Dr. Pandey, as has been stated above, was referred to, on the basis of which it was argued that the Aadhaar design takes full care of security of persons.

146) It was also argued by the respondents that identity information data resides in the CIDR which is not in the control of the Government or the police force. The Authority is a body constituted as a body corporate having perpetual succession and a common seal. It is regulated by substantive and procedural checks to protect the identity information and authentication record. This information cannot be published, displayed or posted publicly. It does not have the authority to carry out surveillance. The State Governments and the police forces cannot obtain the information contained in the CIDR or the authentication records except in two situations contemplated by Section 33 - (i) When the District Judge orders so after giving an opportunity of hearing to the authority (even in this situation core biometric information will not be shared; and (ii) in the interest of National Security where a Joint Secretary or a superior officer of the Government of India specially authorizes in this behalf, and in this case every direction is reviewed by an oversight committee chaired by the Cabinet Secretary. Further, this direction is limited for three months and extendable by a further period of 3 months.

147) It was submitted that surveillance, if at all, can only be carried out by unauthorised use of CIDR information, despite its statutory prohibition and punitive injunctions or by other means such as physical surveillance. That is, however, an illegal surveillance. The architecture of the Act does not allow surveillance. It was submitted that the petitioners have not made out a case of surveillance by the Authority but points out a mere possibility of surveillance.

148) We may reiterate that the argument of surveillance also has the reflections of privacy and in fact the argument is structured on the basis that the vital information which would be available with the Government can be utilised to create the profiling of individuals and retention of such information in the hands of the respondents is a risky affair which may enable the State to do the surveillance of any individual it wants.

149) Insofar as the aspect of privacy of individual is concerned, that would be dealt with in detail while addressing that issue. To segregate issue of surveillance from privacy, we are focusing the discussion to the aspect whether there is sufficient data available with the respondents which may facilitate the profiling and misuse thereof or whether there are sufficient safeguards to ward off the same. In the process, we would be discussing the issues pertaining to data protection as well. At the same time, there would be some overlapping of discussion inasmuch as it will have to be seen as to the collection, storage and use of biometric data satisfies the proportionality principle.

150) It is clear that the argument of the petitioners is that on the basis of the data available with the Authority, there can be a profiling of an individual which may make the surveillance state. And such a mass surveillance is not permitted by the Constitution of India. The entire foofaraw about the Aadhaar architecture is the socalled enormous information that would be available to the Government on using Aadhaar card by residents. Two issues arise from the respective arguments of the parties:

(a) whether the architecture of the Aadhaar project enables the Sate to create a regime of surveillance?; and

(b) whether there are adequate provisions for data protection?

151) Insofar as issue (a) above is concerned, after going through the various aspects of the Aadhaar project, the provisions of the Aadhaar Act and the manner in which it operates, it is difficult to accept the argument of the petitioners. The respondents have explained that the enrolment and authentication processes are strongly regulated so that data is secure. The enrolment agency, which collects the biometric and demographic of the individuals during enrolment, is appointed either by UIDAI or by a Registrar [Section 2(s)]. The Registrars are appointed through MoUs or agreements for enrolment and are to abide by a code of conduct and processes, policies and guidelines issued by the Authority.

They are responsible for the process of enrolment. Categories of persons eligible for appointment are limited by the Regulations. The agency employs a certified supervisor, an operator and a verifier under Enrolment and Update Regulations. Registrars and the enrolling agencies are obliged to use the software provided or authorized by UIDAI for enrolment purpose. The standard software has security features as specified by the Authority. All equipment used is as per the specification issued by the Authority. The Registrars are prohibited from using the information collected for any purpose other than uploading the information to CIDR. Sub-contracting of enrolment function is not allowed.

The Code of Conduct contains specific directions for following the confidentiality, privacy and security protocols and submission of periodic reports of enrolment. Not only there are directions prohibiting manipulation and fraudulent practices but the Act contains penal provisions for such violations in Chapter VII of the Regulations. The enrolment agencies are empanelled by the Authority. They are given an enrolling agency code using which the Registrar can onboard such agency to the CIDR. The enrolment data is uploaded to the Central Identities Data Repository (CIDR) certified equipment and software with a digital signature of the Registrar/enrolling agency. The data is encrypted immediately upon capture.

The decryption key is with the UIDAI solely. Section 2(ze) of the Information Technology Act, 2000 (hereinafter referred to as the 'IT Act') which defines 'secure systems' and Section 2(w) of the Act, which defines 'intermediaries' apply to the process. Authentication only becomes available through the Authentication Service Agency (ASA). They are regulated by the Aadhaar (Authentication) Regulations, 2016. Their role and responsibilities are provided by Regulation 19 of the Authentication Regulations. They are to use certified devices. The equipment or software has to be duly registered with or approved or certified by the Authority/agency. The systems and operations are audited by information system auditor.

The requesting entities pass the encrypted data to the CIDR through the ASA and the response (Yes/No authentication or e-KYC information) also takes the same route back. The server of the ASA has to perform basic compliance and completeness checks on the authentication data packet before forwarding it to the CIDR. The Act prohibits sharing and disclosure of core biometric data under Section 8 and 29. Other identity information is shared with requesting entity (AUAs and KUAs) only for the limited purpose of authentication. The data is transferred from the requesting entity to the ASA to the CIDR in an encrypted manner through a leased line circuitry using secure Protocols (Regulation 9 of the Authentication Regulations).

The storage of data templates is in safely located servers with no public internet inlet/outlet, and offline storage of original encrypted data (PID blocks). There are safety and security provisions such as audit by Information Systems Auditor. Requesting entities are appointed through agreement. They can enter into agreement with sub-AUA or sub-KUA with permission of the UIDAI. Whatever identity information is obtained by the requesting entity is based on a specific consent of the Aadhaar number holder. The e-KYC data shared with the requesting entity can only be after prior consent of the Aadhaar holder. Such data cannot be shared and has to be stored in encrypted form.

The biometric information used is not permitted to be stored. Only the logs of authentication transactions are maintained for a short period. Full identity information is never transmitted back to the requesting entity. There is a statutory bar from sharing biometric information (Section 29(1)(a)/Section 29(4)). Data centres of ASA, requesting entities and CIDR should be within the territory of India. There are various other provisions for monitoring, auditing, inspection, limits on data sharing, data protection, punishments etc., grievance redressal mechanism, suspension and termination of services, etc. so that all actions the entities involved in the process are regulated. Regulation 3(i) & (j) of Aadhaar (Data Security) Regulation, 2016 enables partitioning of CIDR network into zones based on risk and trust and other security measures. CIDR being a computer resource is notified to be a "Protected System" under Section 70 of the IT Act by the Central Government on December 11, 2015.

Anyone trying to unlawfully gain access into this system is liable to be punished with 10 years imprisonment and fine. The storage involves end to end encryption, logical partitioning, firewalling and anonymisation of decrypted biometric data. Breaches of penalty are made punitive by Chapter VII of the Act. Biometric information is deemed to be an "electronic record", and "Sensitive personal data or information" under the IT Act. There are further guards under the Aadhaar (Data Security) Regulations, 2016.

152) That apart, we have recorded in detail the powerpoint presentation that was given by Dr. Ajay Bhushan Pandey, CEO of the Authority, which brings out the following salient features:

(a) During the enrolment process, minimal biometric data in the form of iris and fingerprints is collected. The Authority does not collect purpose, location or details of transaction. Thus, it is purpose blind. The information collected, as aforesaid, remains in silos. Merging of silos is prohibited. The requesting agency is provided answer only in 'Yes' or 'No' about the authentication of the person concerned. The authentication process is not exposed to the Internet world. Security measures, as per the provisions of Section 29(3) read with Section 38(g) as well as Regulation 17(1)(d) of the Authentication Regulations are strictly followed and adhered to.

(b) There are sufficient authentication security measures taken as well, as demonstrated in Slides 14, 28 and 29 of the presentation.

(c) The Authority has sufficient defence mechanism, as explained in Slide 30. It has even taken appropriate protection measures as demonstrated in Slide 31.

(d) There is an oversight by Technology and Architecture Review Board (TARB) and Security Review Committee.

(e) During authentication no information about the nature of transaction etc. is obtained.

(f) The Authority has mandated use of Registered Devices (RD) for all authentication requests. With these, biometric data is signed within the device/RD service using the provider key to ensure it is indeed captured live. The device provider RD service encrypts the PID block before returning to the host application. This RD service encapsulates the biometric capture, signing and encryption of biometrics all within it. Therefore, introduction of RD in Aadhaar authentication system rules out any possibility of use of stored biometric and replay of biometrics captured from other source. Requesting entities are not legally allowed to store biometrics captured for Aadhaar authentication under Regulation 17(1)(a) of the Authentication Regulations.

(g) The Authority gets the AUA code, ASA code, unique device code, registered device code used for authentication. It does not get any information related to the IP address or the GPS location from where authentication is performed as these parameters are not part of authentication (v2.0) and e-KYC (v2.1) API. The Authority would only know from which device the authentication has happened, through which AUA/ASA etc. It does not receive any information about at what location the authentication device is deployed, its IP address and its operator and the purpose of authentication. Further, the authority or any entity under its control is statutorily barred from collecting, keeping or maintaining any information about the purpose of authentication under Section 32(3) of the Aadhaar Act.

153) After going through the Aadhaar structure, as demonstrated by the respondents in the powerpoint presentation from the provisions of the Aadhaar Act and the machinery which the Authority has created for data protection, we are of the view that it is very difficult to create profile of a person simply on the basis of biometric and demographic information stored in CIDR. Insofar as authentication is concerned, the respondents rightly pointed out that there are sufficient safeguard mechanisms. To recapitulate, it was specifically submitted that there were security technologies in place (slide 28 of Dr. Pandey's presentation), 24/7 security monitoring, data leak prevention, vulnerability management programme and independent audits (slide 29) as well as the Authority's defence mechanism (slide 30). It was further pointed out that the Authority has taken appropriate proactive protection measures, which included disaster recovery plan, data backup and availability and media response plan (slide 31).

The respondents also pointed out that all security principles are followed inasmuch as: (a) there is PKI-2048 encryption from the time of capture, meaning thereby, as soon as data is given at the time of enrolment, there is an end to end encryption thereof and it is transmitted to the Authority in encrypted form. The said encryption is almost foolproof and it is virtually impossible to decipher the same; (b) adoption of best-in-class security standards and practices; and (c) strong audit and traceability as well as fraud detection. Above all, there is an oversight of Technology and Architecture Review Board (TARB) and Security Review Committee. This Board and Committee consist of very high profiled officers. Therefore, the Act has endeavoured to provide safeguards67.

154) Issue (b) relates to data protection. According to the petitioners there is no data protection and there is a likelihood of misuse of data/personal information of the individuals.

155) The question to be determined is whether the safeguards provided for the protection of personal biometric data in the Aadhaar Act and Rules are sufficient. The crucial tasks that the Court needs to undertake are -

(i) to discuss the significance of data in the world of technology and its impact;

(ii) to determine the magnitude of protection that should be accorded to collection, storage and use of sensitive biometric data, so that they can qualify as proportionate; and

(iii) to determine whether the Aadhaar Act and Rules provide such data protection, thereby obviating any possibility of surveillance.

(i) Significance of Data:

156) Alvin Toffler in his illuminating article titled 'What will our future be like?' has presented mind boggling ideas. Toffler traces the transition - from agriculture society to industry society to knowledge based society. If we go back to the beginnings of time, agriculture was the prime source and the entire mankind was based on agriculture. 350 years later with the invention of steam engines came the industrialized age and now what we are living through is the third gigantic wave, which is way more powerful than industrialized age. An age that is based on knowledge. Toffler emphasises that in today's society the only thing that leads to creation of wealth is knowledge.

Unlike the past wherein economics was described as the science of the allocation of scarce resources, today we are primarily dependent on knowledge and that is not a scarce resource. Times are changing, we can no longer trust the straight line projection. His view is that we are going from a society which is more and more uniform to a highly de-massified society. Knowledge is power. We are in the era of information. Probably what Toffler is hinting is that access to this vast reservoir of information is available in digital world. Information is available online, at the touch of a button. With this, however, we usher into the regime of data.

157) In a recent speech by Mr. Benjamin Netanyahu, Prime Minister of Israel, while talking about innovation and entrepreneurship, he brought out an interesting phenomena in the world of free market principles, i.e. in the era of globalisation, in the following words: "Look at the ten leading companies in 2006, five energy companies, one IT company Microsoft and a mere ten years later, in 2016, a blink of an eye, in historical terms, its completely reversed, five IT companies one energy company left. The true wealth is in innovation - you know these companies - Apple, Google, Microsoft, Amazon, Facebook."

158) He adds by making a significant statement as the reason behind this change: "...there is a reason something is going on, it's a great change - you want to hear a jargan - it's a one sentence, this is a terrible sentence, but I have no other way to say, it's a confluence of big data, connectivity and artificial intelligence. Ok, you get that? You know what that does - it revolutionises old industries and it creates entirely new industries, so here is an old industry that Israel was always great in - Agriculture. We are always good in agriculture but now we have precision agriculture. You know what that is? See that drone in the sky is connected to a big database and there is sensor at the field and in the field there is drip irrigation and drip fertilization and now we can target with this technology the water that we give, the fertilizer that we give down to the individual plant that needs it. That's precision agriculture, that's Israel. Unbelievable."

159) This brings us to the world of data - big data. It has its own advantages of tremendous nature. It is making life of people easier. People can connect with each other even when they are located at places far away from each other. Not only they can converse with each other but can even see each other while talking. There is a wealth of information available on different networks to which they can easily access and satisfy their quest for knowledge within seconds by getting an answer. People can move from one place to the other with the aid of Global Positioning System (GPS).

They can hear music and watch movies on their handy gadgets, including smart cellphones. We are in the age of digital economy which has enabled multiple avenues for a common man. Internet access is becoming cheaper by the day, which can be accessed not only through the medium of desktop computers or laptops and even other handy gadgets like smart phones. Electronic transactions like online shopping, bill payments, movie/train/air ticket bookings, funds transfer, e-wallet payments, online banking and online insurance etc. are happening with extreme ease at the touch of a finger. Such tasks can be undertaken sitting in drawing rooms. Even while travelling from one place to the other in their car, they can indulge in all the aforesaid activities. In that sense, technology has made their life so easy.

160) However, there is another side to do as well, like any coin which has two sides. The use of such technologies is at the cost of giving away personal information, which is in the realm of privacy. In order to connect with such technologies and avail their benefits, the users are parting with their biometric information like fingerprints and iris as well as demographic information like their names, parentage, family members, their age, even personal information like their sex, blood group or even the ailments they are suffering from. Not only this, use of aforesaid facilities on net or any portal like Apple, Google, Facebook etc. involves tracking their movements, including the nature of activities, like the kind of shopping, the places from where shopping is done, the actual money spent thereon, the nature of movies watched etc.

All this data is there with the companies in respect of its users which may even turn into metadata. In fact, cases after cases are reported where such data of users is parted with various purposes. Interestingly, for using such facilities, people knowingly and willingly, are ready to part with their vital personal information. Every transaction on a digital platform is linked with some form of sensitive personal information. It can be an individual's user name, password, account number, PAN number, biometric details, e-mail ID, debit/credit card number, CVV number and transaction OTP etc.

161) These have raised concerns about the privacy and protection of data, which has become a matter of great concern. Problem is not limited to data localisation but has become extra-territorial. There are issues of cross-border transfers of personal data, regulation whereof is again a big challenge with which various opinions are grappling. There are even talks of convergence of regulatory regime in this behalf so that uniform approach is adopted in providing a legal ecosystem to regulate cross-border data transfer. Asian Business Law Institute (ABLI), in collaboration with Singapore Academy of Law (SAL) has, after undertaking in-depth study, compiled 14 country reports in their respective jurisdictions on the regulation of cross-border data transfer and data localisation in Asia.

162) In the aforesaid scenario, interesting issue is posed by the respondents, viz., when so much personal information about people is already available in public domain, how can there be an expectancy of data privacy. That aspect is dealt with while discussing the issue of privacy. Here, we are concerned with data protection under Aadhaar that is available with the State. As pointed out above, even in respect of private players, the data protection has become a matter of serious concern. When it comes to the State or the instrumentality of the State, the matter has to be taken with all seriousness, on the touchstone of constitutionalism and the concept of limited Government.

(ii) Law on Data Protection:

163) In order to determine this aspect, i.e. the nature and magnitude of data protection that is required to enable legal collection and use of biometric data, reliance can be placed on -

(a) various existing legislations - both in India and across the world; and

(b) case law including the judgment in K.S. Puttaswamy.

(a) Legislation in India:

(i) Information Technology Act, 2000 The only existing legislation covering data protection related to biometric information are Section 43A and Section 72A of the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (hereinafter "Sensitive Personal Data Rules"). Although the IT Act and Rules do not determine the constitutionality of use of biometric data and information by the Aadhaar Act and Rules, they are instructive in determining the safeguards that must be taken to collect biometric information68.

164) Following are the provisions which cover biometric information under the IT Act: Section 43A of the IT Act attaches liability to a body corporate, which is possessing, handling and dealing with any 'sensitive personal information or data' and is negligent in implementing and maintaining reasonable security practices resulting in wrongful loss or wrongful gain to any person. 'Sensitive personal information or data' is defined under Rule 3 of the Sensitive Personal Data Rules to include information relating to biometric data. Section 43A reads as follows:

"43A. Compensation for failure to protect data. -Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.

Explanation. -For the purposes of this section,-

(i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;

(ii) "reasonable security practices and procedures" means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit;

(iii) "sensitive personal data or information" means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.]"

165) Similarly, Section 72A of the IT Act makes intentional disclosure of 'personal information' obtained under a contract, without consent of the parties concerned and in breach of a lawful contract, punishable with imprisonment and fine. Rule 2(i) of the Sensitive Personal Data Rules define "personal information" to mean any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person. Thus, biometrics will form a part of "personal information".

The Section reads as under- "72A. Punishment for disclosure of information in breach of lawful contract - Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person, shall be punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both."

166) The Sensitive Personal Data Rules provide for additional requirements on commercial and business entities (body corporates as defined under Section 43A of the IT Act) relating to the collection and disclosure of sensitive personal data (including biometric information). The crucial requirements, which are 567 indicative of the principles for data protection that India adheres to, inter alia include:

(i) The body corporate or any person who on behalf of body corporate collects, receives, possesses, stores, deals or handle information of provider of information, shall provide a privacy policy for handling of or dealing in personal information including sensitive personal data or information and ensure that the same are available for view.

(ii) Body corporate or any person on its behalf shall obtain consent in writing from the provider of the sensitive personal data or information regarding purpose of usage before collection of such information.

(iii) Body corporate or any person on its behalf shall not collect sensitive personal data or information unless -

(a) the information is collected for a lawful purpose connected with a function or activity of the body corporate or any person on its behalf; and

(b) the collection of the sensitive personal data or information is considered necessary for that purpose (iv) The person concerned has the knowledge of -

(a) the fact that the information is being collected;

(b) the purpose for which the information is being collected;

(c) the intended recipients of the information; and

(d) name and address of the agency collecting and retaining the information.

(v) Body corporate or any person on its behalf holding sensitive personal data or information shall not retain that information for longer than is required for the purposes for which the information may lawfully be used or is otherwise required under any other law for the time being in force.

(vi) Information collected shall be used for the purpose for which it has been collected.

(vii) Body corporate or any person on its behalf shall, prior to the collection of information, including sensitive personal data or information, provide an option to the provider of the information to not to provide the data or information sought to be collected.

(viii) Body corporate shall address any discrepancies and grievances of their provider of the information with respect to processing of information in a time bound manner.

(ix) Disclosure of sensitive personal data or information by body corporate to any third party shall require prior permission from the provider of such information, who has provided such information under lawful contract or otherwise, unless such disclosure has been agreed to in the contract between the body corporate and provider of information, or where the disclosure is necessary for compliance of a legal obligation.

(x) A body corporate or a person on its behalf shall comply with reasonable security practices and procedure i.e. implement such security practices and standards and have a comprehensive documented information security programme and information security policies that contain managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected with the nature of business.

In the event of an information security breach, the body corporate or a person on its behalf shall be required to demonstrate, as and when called upon to do so by the agency mandated under the law, that they have implemented security control measures as per their documented information security programme and information security policies. The above substantive and procedural safeguards are required for legal collection, storage and use of biometric information under the IT Act. They indicate the rigour with which such processes need to be carried out.

Continued to Page 2


Latest Supreme Court Judgments Back



Client Area | Advocate Area | Blogs | About Us | User Agreement | Privacy Policy | Advertise | Media Coverage | Contact Us | Site Map
powered by nubia  |  driven by neosys