How to delink Aadhaar from phone numbers? Telecom firms have until October 15 to explain

The Supreme Court’s judgement last week upholding the constitutional validity of Aadhaar came with directions to make a number of significant changes in how the biometric identity project works. Crucially, the court prohibited the use of Aadhaar by private entities as well as its linking with phone numbers and bank accounts. On Monday, the Unique Identification Authority of India, the government body which oversees Aadhaar, issued a circular asking telecom companies to submit plans on how they intend to comply.

It directs telecom service providers to submit an “exit plan” by October 15. “All TSPs are called upon to immediately take actions in order to comply with the judgement,” the circular reads. “In this regard, TSPs are hereby directed to submit by 15th October 2018 an action plan/exit plan to the authority for closure of the use of Aadhaar-based authentication systems.”

Pointing out that telecom companies can no longer use Aadhaar to issue new SIM cards or reverify existing ones, the circular orders them to take cognisance of any requests for delinking Aadhaar with mobile numbers. Post delinking, the service providers must complete a fresh KYC process within six months using other approved identification documents. It does not, however, mandate the deletion of Aadhaar data from the databases of the phone companies.

Telecom companies spent much of the past year pushing their customers to link SIM cards with Aadhaar, ostensibly to comply with a Supreme Court order mandating KYC, or Know Your Customer, verification for all phone numbers. Although the court never ordered the KYC process to be done through Aadhaar, the government decided it was reason enough to make the biometric identity mandatory for this purpose, and pushed telecom companies to complete the linking. In April, though, the government admitted it had been lying about the court having made it mandatory to link Aadhaar with phone numbers.

In last week’s judgement, the Supreme Court reaffirmed that the government order mandating the linking of Aadhaar with phone numbers was “disproportionate and unreasonable state compulsion”. “There can be other appropriate laws and less intrusive alternatives,” it added. “For the misuse of such SIM cards by a handful of persons, the entire population cannot be subjected to intrusion into their private lives.”

The court, in fact, found the circular mandating such linking to be unconstitutional. Even Justice DY Chandrachud, who delivered a dissenting opinion, concurred with the main judgement on this count and directed phone companies to delete all their Aadhaar data within two weeks.

Complicated situation

Yet, the Unique Identification Authority has given telecom companies until October 15 to submit their action plans. “They have to explain what kind of data is stored in the repositories and how are they planning to get rid of it, but the important question is by when they plan to do it,” said Vrinda Bhandari, a senior lawyer who represented one of the petitioners challenging Aadhaar in the Supreme Court.

There has been some debate about whether Chandrachud’s order for the deletion of the data is binding given that it is part of the minority opinion. “According to all the judges on the bench, the directions are clear,” said S Prasanna, who represented the petitioners in the matter. “TRAI or the government will have to jointly or separately issue directives to delete the data and certify the deletion.”

It’s a complicated situation, however, not least because TRAI, the Telecom Regulatory Authority of India, had told telecom companies to delete data collected through other forms of KYC and rely on Aadhaar alone. So, if they do delete the Aadhaar data now, phone companies will have to undertake afresh the expensive KYC process for every customer and complete it within a stipulated time period.

Ajay Bhushan Pandey, chief executive officer of the Unique Identification Authority, has suggested some alternatives for telecom companies, including using the Aadhaar QR codes, which only show the name, address and photograph, not Aadhaar number or biometric data. But even this process is unlikely to be simple in a country as large as India.

The government has also suggested that it may bring in legislation to allow private companies to use Aadhaar even though its circulars making the biometric identity mandatory for a host of services have been held unconstitutional.

Clearly, the Aadhaar saga is not yet over.