Protection of Individual Information in UIDAI System

Following are the criminal offences and penalties provided in the Aadhaar Act, 2016 (as amended):

1. Impersonation by providing false demographic or biometric information, at the time of enrolment, is an offence – imprisonment up to 3 years or a fine of upto Rs. 10,000/- or with both.

2. Appropriating the identity of an Aadhaar number holder by changing or attempting to change the demographic and biometric information of an Aadhaar number holder is an offence - imprisonment upto 3 years and a fine of upto Rs. 10,000/-.

3. Pretending to be an agency authorized to collect Identity information of a individual is an offence – imprisonment up to 3 years or with a fine of upto Rs. 10,000 for a person, or up to Rs. 1 lakh for a company, or with both.

4. Intentionally transmitting/ disclosing information collected during enrolment/ authentication to an unauthorized person or in contravention of any agreement or arrangement under this Act is an offence – imprisonment upto 3 years or with a fine of            up to Rs. 10,000/- for a person, or of up to Rs. 1 lakh for a company, or with both.

5. Unauthorized access to the central identities data repository (CIDR) and hacking is an offence – imprisonment upto 10 years and a fine of minimum Rs. 10 Lakhs.

6. Tampering with data in the central identities data repository is an offence – imprisonment upto 10 years and a fine up to Rs. 10,000/-.

7. Unauthorized use of identity information of an individual by an requesting entity or Offline Verification Seeking Entity – imprisonment up to 3 years or fine up to Rs.10,000/- in case of a individual, or of upto Rs.1 Lakh in case of a company or with            both.

8. Penalty for an offence, for which no specific penalty is provided elsewhere - imprisonment upto 3 years or fine up to Rs.25,000/- in case of a individual, or of up to Rs.1 Lakh in case of a company or with both.

The UIDAI ensures the security and confidentiality of the data collected. The enrolment data is collected on client application  provided by the UIDAI, which is encrypted at source and the packet is transmitted in a secure manner. UIDAI has published guidelines in this regard which is available on its website. UIDAI has security policy in place for data security in motion and at rest.

Penalty for unauthorized access to Central Identities Data Repository have been detailed in Aadhaar (Targeted delivery of financial and other subsidies , benefits and services) Act, 2016  - Chapter VII under Offences and Penalties, Section 38.

Protection of the individual and the safeguarding their information is inherent in the design of the UID project. From having a random number which does not reveal anything about the individual to other features listed below, the UID project keeps the interest of the individual at the core of its purpose and objectives.

• Collecting limited information
  The UIDAI is collecting only basic data fields - Name, Date of Birth, Gender, Address, Parent/ Guardian’s (name essential for children but not for others) photo, 10 finger prints and iris scan.
• No profiling and tracking information collected
  The UIDAI policy bars it from collecting sensitive personal information such as religion, caste, community, class, ethnicity, income and health. The profiling of individuals is therefore not possible through the UID system.
• Release of information – yes or no response
  The UIDAI will not reveal personal information in the Aadhaar database – the only response will be a ‘yes’ or ‘no’ to requests to verify an identity
• Convergence and linking of UIDAI information to other databases
  The UID database is not linked to any other databases, or to information held in other databases. Its only purpose will be to verify a person’s identity at the point of receiving a service, and that too with the consent of the aadhaar number holder
  The UID database will be guarded both physically and electronically by a few select individuals with high clearance. The data will be secured with the best encryption, and in a highly secure data vault. All access details will be properly logged.