Disposing of the matters, the Court v. An individual can manipulate the system by having more than

Judgment

) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.2(g) – Requirement under the Aadhaar Act to give one’s biometric information – Whether violative of fundamental right of privacy – Held: Biometric information means photographs, fingerprints, iris scan and other such biometric attributes of an individual as may be specified by the regulations – A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Biometric information is of physical characteristics of a person – A person has full bodily autonomy and any intrusion in the bodily autonomy of a person can be readily accepted as breach of his privacy – The biometric data as referred to in s.2(g) may contain biological attributes of an individual with regard to which a person can very well claim a reasonable expectation of privacy but whether privacy rights have been breached or not needs to be examined in the subject context under which the information was obtained. (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.2(g) – Whether obtaining biometric information in context of enrolment breaches the right of privacy of individual or not – Held: The provisions of Aadhaar Act are to be tested in light of three-fold test laid in Puttaswamy case – The First requirement to be fulfilled is existence of law – Admittedly, Aadhaar Act is a Parliamentary law, hence the existence of law is satisfied – The Aadhaar Act has been enacted with an object of providing Aadhaar number to individuals for identifying an individual for delivery of benefits, subsidies and services – Aadhaar Act, which was enacted to provide for unique identity for delivery of subsidies, benefits or services was a dire necessity, which decision was arrived at after several reports and studies – Aadhaar Act was, thus, enacted for a legitimate State aim and fulfills the criteria of a law being fair and reasonable – While examining the third requirement, that is, proportionality of the statute, it has to be kept in mind that the state is neither arbitrary nor of an excessive nature beyond what is required in the interest of public – The object of the Aadhaar Act was to provide for unique identity for purposes of delivery of benefits, subsidies and services to the eligible beneficiaries and to ward of misappropriation of benefits and subsidies, ward of deprivation of eligible beneficiaries – Biometric information, thus, which is to be obtained for enrolment is not disproportionate nor the provisions of Aadhaar Act requiring demographic and biometric information can be said to be not passing three-fold test as laid down in Puttaswamy case – Thus, requirement under Aadhaar Act to give one’s demographic and biometric information does not violate fundamental right of privacy and, therefore, is not unconstitutional – Constitution of India – 12 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 13 Biometric information – Right to privacy. (Per Ashok Bhushan, J.) A Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Whether proportionality test as envisaged in Puttaswamy case is not fulfilled in the instant case since State did not adopt an alternative and more suitable and least intrusive method of identification – Held: The biometric information which are obtained for Aadhaar enrolment are photographs, fingerprints and iris scan, which are least intrusion in physical autonomy of an individual – The physical process by which the fingerprints are taken does not require information beyond the object and purpose – Therefore, it does not readily offend those principles of dignity and privacy, which are fundamental to each legislation of due process. (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: ss.29, 30, 33 – Whether collection of data of residents, its storage, retention and use violates fundamental right of privacy – Held: The Act contains specific provision providing that no core biometric information collected under the Act is shared to anyone for any reason whatsoever or use for any purpose other than generation of Aadhaar number or authentication under this Act – The statute creates injunction for requesting entity to use identity information data for any purpose other than that specified to the individual at the time for submitting any identification – Statute also provides for offences and penalties for impersonation at the time of enrolment and penalty for disclosing identity information – An overview of the entire scheme of functions under the Aadhaar Act and Regulations made thereunder indicate that after enrolment of resident, his informations including biometric information are retained in CIDR though in encrypted form – The major function of the authority under Aadhaar Act is authentication of identity of Aadhaar number holder as and when requests are made by requesting agency, retention of authentication data of requesting agencies are retained for limited period – Requesting entity as well as authority are required to retain authentication data for a particular period and thereafter it will be archived for five years and thereafter authentication data transaction shall be deleted except such data which is required by the Court in connection with any pending dispute – The data which is retained by the entity and B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. authority for certain period is minimal information pertaining to identity authentication only no other personal data is retained – Thus, provisions of Aadhaar Act and Regulations made thereunder fulfill three fold test as laid down in Puttaswamy case, hence, the storage and retention of data does not violate fundamental right of privacy. (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.7 – Whether s.7 is unconstitutional – Whether exclusion makes s.7 arbitrary and volative of Arts.14 and 21 – Held: s.7 is an enabling provision which empowers the State Government to require that such individual undergo authentication for receipt of a subsidy, benefit or service but neither s.7 nor orders issued by the Central Government and State Government can be read that in the event authentication of a person or beneficiary fails, he is not to be provided the subsidies and benefits or services – No doubt, there has been denial to few persons due to failure of authentication – Functioning of scheme formulated by the Government for delivery of benefits and subsidies to deserving persons is a large scale scheme running into every nook and corner of the country – When such scheme of Government is implemented, it is not uncommon that there may be shortcomings and some denial – There is no material on record to indicate that there is increase of failure to receive the benefits after the implementation of the Act –Therefore, few cases of exclusion would not make s.7 itself arbitrary and violative of Arts.14 and 21 – Constitution of India – Arts.14, 21. (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.29 – Constitutionality of , challenged on the ground that it permits sharing of identity information which amount to breach of Right of Privacy – Held: The provision of s.29 and the Sharing Regulations contain a restriction and cannot be in any manner be held to violate any of the constitutional rights of a person – Objective of the Act is to put restrictions on sharing information, which also is a legitimate State aim – The provision under s.29 which permits sharing of identity information except core biometric information in accordance with the Act and Regulations cannot be said to be disproportionate nor unreasonable – The provisions of s.29 is constitutional and does 14 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 15 not deserves to be struck down – Aadhaar (Sharing of Information) Regulations, 2016. (Per Ashok Bhushan, J.) A Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.33 – Constitutionality of – Whether s.33 is unconstitutional since it provides for the use of the Aadhaar data base for Police verification which violates the protection against self-incrimination as enshrined under Art.20(3) of the Constitution of India – Held: Sub-section (1) of s.33 contains an ample restriction in respect of any disclosure information which can be done only in pursuance of an order of the court not inferior to that of a District Judge – The restriction in disclosure of information is reasonable and has valid justification – s.33 sub- section (2) contains two safeguards – Firstly, disclosure of information is to be made in the interest of national security and secondly, in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government, who is specially authorised in this behalf by an order of the Central Government – National security, thus, is determined by a higher officer who is specifically authorised in this behalf – The power given under s.33 to disclose information cannot be said to be disproportionate – The basic information which are with the UIDAI are demographic and biometric information – The use of information retained by the UIDAI given by the order of the Court under s.33 cannot be said to be violating the protection as contained under Art.20(3) – Thus, Art.20(3) is not violated by disclosure of information under s.33 – In view of this, s.33 is constitutional – Constitution of India – Art.20(3). (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.47 – Constitutionality of, challenged on the ground that it does not allow an individual who is victim of violation of Aadhaar Act to initiate a criminal process – Held: Special Acts are enacted for serving special objects towards offences under the Act – The initiation and prosecution of offences under the Special Act are kept by the specified authority to keep the initiation and prosecution in the hands of the authorities under the Special Act which acts as deterrent and prosecutions are brought to its logical end – Objective of such provisions is to discourage frivolous and vexatious complaints – s.47 can be invoked by the B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. authority on its own motion or when it receives a complaint from a victim – With regard to an offence which falls within the definition of ‘offences’ a victim can always file complaint or lodge an F.I.R. – s.46 clearly provides that the penalties under the Aadhaar Act shall not interfere with other punishments – The limitation as contained in s.47 in permitting taking cognizance of any offence punishable under Aadhaar Act only on a complaint made by the authority or any officer or person authorised by it, has legislative purpose and objective – Thus, there is no unconstitutionality in s.47 of the Aadhaar Act. (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.57 – Constitutionality of, challenged on the ground that broad and unlimited scope of activities covered under s.57 and kinds of private entities permitted to use Aadhaar is entirely disproportionate beyond the means and objectives of the Act and without any compelling state interests – Held: s.57 makes use of Aadhaar on two basis – Firstly, “pursuant to any law, for the time being in force” and secondly “any contract to this effect” – When the legislature uses the phrase “pursuant to any law, for the time being in force”, obviously the word law used in s.57 is a law other than s.57 of Aadhaar Act and the Regulations framed thereunder – When any law permits user of Aadhaar, its validity is to be tested on the anvil of three-fold test as laid down in Puttaswamy case, but permitting use of Aadhaar on any contract to this effect, is clearly in violation of Right of Privacy – A contract entered between two parties, even if one party is a State, cannot be said to be a law – Thus, s.57 in so far as it permits use of Aadhaar on “any contract to this effect” is clearly unconstitutional and is struck down. (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.59 – Whether s.59 is void or unconstitutional – s.59 seeks to save and continue under the Act what was done under the executive scheme – Legislature often creates legal fiction to save several actions which had happened prior to enactment – Parliamentary legislative intent of s.59 is to save all actions taken by Central Government under the notification dtd. 28.01.2009 and notification dtd. 12.09.2015 deeming the same to have been validly done under the Aadhaar Act by creating a legal 16 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 17 fiction – The intention to save all actions taken under these two notifications and treat them to have done under that Act is the purpose and object of s.59 – Legislature by legislative device can cover actions taken earlier while creating any legal fiction which has actually been done by s.59 – Interpretation of statutes – Legal fiction. (Per Ashok Bhushan, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Circular dated 23.03.2017 issued by Ministry of Communications, Department of Telecommunications – Constitutionality of – Held: By circular dated 23.03.2017, all licensees were directed to re-verify all existing mobile subscribers (prepaid and postpaid) through Aadhaar based e- KYC process – The circular directing the licensees to mandatorily verify existing sim subscribers in turn resulted in mobile telephone service licensees directing the subscribers to get their sim seeded with Aadhaar – Compulsory seeding of Aadhaar with mobile numbers would be an intrusion in Privacy Right of a person – Any invasion on the Privacy Right of a person has to be backed by law as per the three-fold test enumerated in Puttaswamy case – Existence of a law is the foremost condition to be fulfilled for restricting any Privacy Right – The law as explained in Art.13(3) has to be applied for finding out as to what is law – Art.13(3)(a) gives an inclusive definition of law in following words:- (a) “law” includes any ordinance, order, bye- law, rule, regulation, notification, custom or usage having in the territory of India the force of law – The circular at best is only an executive instruction and cannot be held to be a law and direction to re-verification of all existing mobile subscribers through Aadhaar based e-KYC cannot be held to be backed by law, therefore, cannot be upheld – Administrative law – Executive instruction – Circular dated 23.03.2017 issued by Ministry of Communications, Department of Telecommunications. (Per Ashok Bhushan, J.) Aadhaar (Enrolment and Update) Regulations, 2016: Regn 5 – Whether collecting the identity information of children between 5 to 18 years is unconstitutional – Held: Regn 5 provides for information required for enrolment of children below five years of age – For children below five, no core biometric informations are captured and only biometric information of any one parent/guardian is captured – For enrolment of a children between 5 and 18 years, A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. there has to be consent of their parents or guardian because they themselves are unable to give any valid consent for enrolment – Thus, parental consent have to be read in Regn 4 in so far as children of 5 to 18 years are concerned so that the provision in reference to children between 5 to 18 years may not become unconstitutional – Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016 – s.5 – Interpretation of statutes. (Per Ashok Bhushan, J.) Aadhaar (Authentication) Regulations, 2016: Regn.27 – Time Period for Data Retention – Grievance of petitioners was that the data is allowed to be retained for an unreasonable long period of time – Held: Regn 27 of the Authentication Regulations requires the UIDAI to retain the “authentication transaction data” (which includes the meta data) for a period of 6 months and to archive the same for a period of 5 years thereafter – Requesting entities (RE) and Authentication Service Agencies are then allowed to retain the authentication logs for a period of 2 years and then archive them for 5 years – It is required to be deleted only after 7 years unless retained by a court – There is is no reason for archiving the authentication transaction data for a period of five years – Retention of this data for a period of six months is more than sufficient after which it needs to be deleted except when such authentication transaction data are required to be maintained by a Court or in connection with any pending dispute – Retention of data beyond the period of six months is impermissible – Therefore, Regn.27 which provides archiving a data for a period of five years is struck down. (Majority Opinion) Aadhaar Scheme: Whether Circular dtd. March 23, 2017 issued by the Department of Telecommunications mandating linking of mobile number with Aadhaar is illegal and unconstitutional – Held: The circular is illegal and unconstitutional as it is not backed by any law – The same is, therefore, quashed. (Majority Opinion) Constitutionalism: Aadhaar Act meets the concept of Limited Government, Good Governance and Constitutional Trust. (Majority Opinion) 18 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 19 Constitution of India: Art.14 and 21 – Whether right to food, shelter etc. envisaged under Art.21 shall take precedence on the right to privacy of the beneficiaries – Held: It cannot be accepted that while balancing the fundamental rights one right has to be given preference – State while enlivening right to food, right to shelter etc. envisaged under Art.21 cannot encroach upon the right of privacy of beneficiaries nor former can be given precedence over the latter. (Per Ashok Bhushan, J.) Constitution of India: Reasonable expectation of privacy – Held: It is well settled that breach of privacy right can be claimed only when claimant on the facts of the particular case and circumstances have “reasonable expectation of privacy”. (Per Ashok Bhushan, J.) Constitution of India: Art.243G – Whether Aadhaar scheme and its authentication for benefits, subsidies and services militate against Art.243G and hence are ultra vires to the Constitution – Held: Art.243G is an enabling provision, which enable the State Legislature, by law, to endow the Panchayats with such powers and authorities as may be necessary to enable them to function as institutions of self-government – State is fully competent to make laws to authorise the Panchayats to take over all the matters enumerated in Eleventh Schedule – The Aadhaar Act is an Act enacted by Parliament, which is referable to Entry 97 of List I – The Aadhaar Act has been enacted to provide for efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith – The Act, thus, has been enacted to regulate the expenditure, which is incurred from the Consolidated Fund of India – No conflict between the Aadhaar Act and any law, which may be enacted by State under List II is seen – Even if any conflict is supposed, the Doctrine of Pith and Substance has to be applied to find out nature of two legislations – In Pith and Substance, the Aadhaar Act cannot be said to be entrenching upon any law, which may be made by the State under Item No.5 of List II – Aadhaar Act is not ultra vires to Art.243G and Eleventh Schedule to the A B C D E F G H 20 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Constitution – Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016 – Doctrines/Principles. (Per Ashok Bhushan, J.) Constitution of India: Art.110 – Whether Speaker’s decision certifying the Aadhaar Bill as Money Bill contravenes any of the Constitutional provisions – A condition for receipt of a subsidy, benefit or service for which the expenditure is incurred from, or the receipt therefrom forms part of, the Consolidated Fund of India, has been provided by s.7 – The Preamble of the Act as well as objects and reasons also indicate that the Act has been enacted to provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto – Thus, the theme of the Act or main purpose and object of the Act is to bring in place efficient, transparent and targeted deliveries of subsidies, benefits and services, which expenditure is out from the Consolidated Fund of India – Thus, the above provisions of the Act is clearly covered by Art.110(1)(c) and (e) – Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016. (Per Ashok Bhushan, J.) Constitution of India: Art.110 – Whether Aadhaar Act is a Money Bill and decision of Speaker certifying it as Money Bill is not subject to Judicial Review of Supreme Court – Held: Aadhaar Bill has rightly been certified as the Money Bill by the Speaker, which decision does not violate any constitutional provision, hence does not call for any interference in this proceeding – The decision of Speaker certifying the Aadhaar Bill, 2016 as Money Bill is not immuned from Judicial Review. (Per Ashok Bhushan, J.) Doctrines/Principles: Doctrine of Proportionality – State’s action – When challenged on the ground that it violates the right to privacy – Held: The action of the State is to be tested on the following parameters: (a) the action must be sanctioned by law; (b) the proposed action must be necessary in a democratic society for a legitimate aim; and (c) the extent of such interference must be proportionate to the need for such interference – Constitution of India – Right to privacy. (Majority Opinion) JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 21 Income Tax Act, 1961: s.139AA – Constitutionality of – Whether s.139AA is violative of right to privacy and is, therefore, unconstitutional – Held: In Puttaswamy, the court laid down the triple test to be satisfied for judging the permissible limits for invasion of privacy while testing the validity of any legislation – These are: (a) existence of a law; (b) A legitimate State interest; and (c) Such law should pass the “test of proportionality” – There is no dispute that the first requirement stood satisfied as s.139AA is a statutory provision and, there is a backing of law – Insofar as requirement of ‘legitimate State interest’ is concerned, s.139AA is enacted to link PAN number with Aadhaar number which is issued under the Act for the purpose of eliminating duplicate PANs from the system with the help of robust technology solution – Therefore, those who have PAN number and have already provided the information required to get PAN number cannot claim to have any legitimate expectation of withholding any data required for Aadhaar under the ground of privacy – Also, there was justifiable reason with the State for collection and storage of data in the form of Aadhaar and linking it with PAN insofar as s.139AA of the 1961 Act is concerned – The provisions of s.139AA meet the triple test of right to privacy, contained in Puttaswamy. (Majority Opinion) Income Tax Act, 1961: s.139AA – Whether s.139-AA of the IT Act, 1961 is unconstitutional in view of the Privacy judgment in Puttaswamy case – Held: s.139-A provide for Permanent Account Number (PAN) and the provision also provided that statutory mandatory provisions as to when “every person” shall quote such number (PAN number) for various purposes as enumerated in s.139A – Introduction of s.139-AA is an extension and implication of s.139A – The introduction of s.139-AA was for the purpose of eliminating duplicate PANs from the system with the help of a robust technology solution – s.139-AA seeks to remove bogus PAN cards by linking with Aadhaar, expose shell companies and thereby curb the menace of black money, money laundering and tax evasion – Linking of PAN with Aadhaar will at least ensure that duplicate and fake PAN cards which are used for the purpose of tax evasion will be eliminated and is one of the many fiscal measures to eliminate black money from the system – s.139-AA also cannot be said to be disproportionate – The section has been enacted to achieve the legitimate State aim – A B C D E F G H 22 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. s.139-AA is a law framed by Parliament, which require linking of the Aadhaar with PAN – s.139-AA is a required first step to weed out fake PANs for individuals; it is perfectly acceptable for the legislature to weed out fake PANs for other tax-paying entities at a later stage – Inclusion of Aadhaar into PAN eliminates the inequality between honest tax payers and non-compliant, dishonest ones who get away without paying taxes – Inclusion of Aadhaar into PAN bolsters equality and is consistent with Art.14 – In result, s.139-AA is fully compliant of three-fold test as laid down in Puttaswamy’s case – s.139-AA, thus does not breach fundamental Right of Privacy down. (Per Ashok Bhushan, J.) individual cannot struck Interim Orders: As per the petitioners, the Central Government and the State Government have issued certain notifications requiring Aadhaar authentication for benefits, subsidies and schemes mandatory and, therefore, the respondents have violated the orders of this court – Held: The said interim orders were passed by the court when the Aadhaar Act had not come into force – After the enactment, s.7 had altered the position statutorily – The notifications and circulars are issued under this provision – Therefore, it cannot be held that these circulars are issued in contravention of the orders passed by this court – Aadhaar (Targeted Delivery of Financial and other subsidies, benefits and services) Act, 2016. (Majority Opinion) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: The entire Aadhaar programme, since 2009, suffers from constitutional infirmities and violations of fundamental rights – The enactment of the Aadhaar Act does not save the Aadhaar project – The Aadhaar Act, the Rules and Regulations framed under it, and the framework prior to the enactment unconstitutional. the Act (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.7 – Aadhaar Act challenged on the ground that it could not have been passed as a Money Bill – Held: To be certified a Money Bill, a Bill must contain “only provisions” dealing with every or any one of the matters set out in sub-clauses (a) to (g) of Art.110(1) – A Bill, which has both JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 23 provisions which fall within sub-clauses (a) to (g) of Art.110(1) and provisions which fall outside their scope, will not qualify to be a Money Bill – Thus, when a Bill which has been passed as a Money Bill has certain provisions which fall beyond the scope of sub-clauses (a) to (g) of Art.110(1), these provisions cannot be severed – The Aadhaar Act creates a statutory framework for obtaining a unique identity number, which is capable of being used for “any” purpose, among which availing benefits, subsidies and services, for which expenses are incurred from the Consolidated Fund of India, is just one purpose provided under s.7 – Clause (e) of Art.110(1) requires that a Money Bill must deal with the declaring of any expenditure to be expenditure charged on the Consolidated Fund of India (or increasing the amount of the expenditure) – s.7 fails to fulfil this requirement – s.7 does not declare the expenditure incurred to be a charge on the Consolidated Fund – It only provides that in the case of such services, benefits or subsidies, Aadhaar can be made mandatory to avail them – Moreover, provisions other than s.7 of the Act deal with several aspects relating to the Aadhaar numbers: enrolment on the basis of demographic and biometric information, generation of Aadhaar numbers, obtaining the consent of individuals before collecting their individual information, creation of a statutory authority to implement and supervise the process, protection of information collected during the process, disclosure of information in certain circumstances, creation of offences and penalties for disclosure or loss of information, and the use of the Aadhaar number for “any purpose” – All these provisions of the Aadhaar Act do not lie within the scope of sub-clauses (a) to (g) of Art.110(1) – Thus, the Aadhaar Act is declared unconstitutional for failing to meet the necessary requirements to have been certified as a Money Bill under Art.110(1) – Constitution of India – Art.110. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Legitimate State aim, insufficient to hold validity of law – Held: The architecture of the Aadhaar Act seeks to create a unique identity for residents on the basis of their demographic and biometric information – The Act sets up a process of identification by which the unique identity assigned to each individual is verified with the demographic and biometric A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. information pertaining to that individual which is stored in a centralised repository of data – Identification of beneficiaries is integral and essential to the fulfilment of social welfare schemes and programmes, which are a part of the State’s attempts to ensure that its citizens have access to basic human facilities – The contention of the Union of India that there is a legitimate state aim in maintaining a system of identification to ensure that the welfare benefits provided by the State reach the beneficiaries who are entitled, without diversion, is accepted – The decision in Puttaswamy recognised that revenue constitutes a legitimate state aim in the three- pronged test of proportionality – However, the existence of a legitimate aim is insufficient to uphold the validity of the law, which must also meet the other parameters of proportionality spelt out in Puttaswamy. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Collection of biometric data and its retention – The Aadhaar programme involves application of biometric technology, which uses an individual’s biometric data as the basis of authentication or identification and is therefore intimately connected to the individual – While citizens have privacy interests in personal or private information collected about them, the unique nature of biometric data distinguishes it from other personal data, compounding concerns regarding privacy protections safeguarding biometric information – Once a biometric system is compromised, it is compromised forever – Therefore, it is imperative that concerns about protecting privacy must be addressed while developing a biometric system – Adequate norms must be laid down for each step from the collection to retention of biometric data – At the time of collection, individuals must be informed about the collection procedure, the intended purpose of the collection, the reason why the particular data set is requested and who will have access to their data – Additionally, the retention period must be justified and individuals must be given the right to access, correct and delete their data at any point in time, a procedure familiar to an opt-out option.(Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: The Aadhaar Act and Regulations are bereft of the procedure through which an individual can access 24 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 25 information related to his or her authentication record – The Aadhaar Act clearly has no defined options that should be made available to the Aadhaar number holders in case they do not wish to submit identity information during authentication, nor do the regulations specify the procedure to be followed in case the Aadhaar number holder does not provide consent for authentication – To enable the government to initiate steps for ensuring conformity with this judgment, it is directed under Art.142 that the existing data which has been collected shall not be destroyed for a period of one year – During this period, the data shall not be used for any purpose whatsoever – At the end of one year, if no fresh legislation has been enacted by the Union government in conformity with the principles which have been enunciated in this judgment, the data shall be Art.142. – destroyed (Per Dr. D Y Chandrachud, J.) Constitution India – Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: ss.2(g), (j), (k) and (t), 29(1) and (2) – Constitutionality of – Invasion in privacy of an individual – ss.29(1) and (2) of the Act create a distinction between two classes of information (core biometric information and identity information), which are integral to individual identity and require equal protection – s.29(4) suffers from overbreadth as it gives wide discretionary power to UIDAI to publish, display or post core biometric information of an individual for purposes specified by the regulations – ss.2(g), (j), (k) and (t) suffer from overbreadth, as these can lead to an invasive collection of biological attributes – These provisions give discretionary power to UIDAI to define the scope of biometric and demographic information and empower it to expand on the nature of information already collected at the time of enrollment, to the extent of also collecting any “such other biological fit. (Per Dr. D Y Chandrachud, J.) attributes” Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.28(5) – Violation of informational privacy – The proviso to s.28(5) of the Aadhaar Act, which disallows an individual access to the biometric information that forms the core of his or her unique ID, is violative of a fundamental principle that ownership of an individual’s data must at all times vest with the A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. individual – UIDAI is also provided wide powers in relation to removing the biometric locking of residents – The analysis of the measures taken by the Government of India prior to the enactment of the Aadhaar Act as well as a detailed analysis of the provisions under the Aadhaar Act, 2016 and supporting Regulations made under it clearly show that the Aadhaar programme violates essential norms pertaining to informational privacy, self-determination and data protection. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Dignity of an individual – Biometric technology which is the core of the Aadhaar programme is probabilistic in nature, leading to authentication failures – The Aadhaar project has failed to account for and remedy the flaws in its framework and design which has led to serious instances of exclusion of eligible beneficiaries as demonstrated by the official figures from Government records including the Economic Survey of India 2016-17 and research studies – Dignity and the rights of individuals cannot be made to depend on algorithms or probabilities – Constitutional guarantees cannot be subject to the vicissitudes of technology – Denial of benefits arising out of any social security scheme which promotes socio-economic rights of citizens is violative of human dignity and impermissible under our constitutional scheme. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Test of necessity and proportionality – Violation of data minimisation principles – Under the Aadhaar project, requesting entities can hold the identity information of individuals, for a temporary period – It was admitted by UIDAI that AUAs may store additional information according to their requirement to secure their system – ASAs have also been permitted to store logs of authentication transactions for a specific time period – It has been admitted by UIDAI that it gets the AUA code, ASA code, unique device code and the registered device code used for authentication, and that UIDAI would know from which device the authentication took place and through which AUA/ASA – Under the Regulations, UIDAI further stores the authentication transaction data – This is in violation of widely recognized data minimisation principles which mandate that data collectors and 26 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 27 processors delete personal data records when the purpose for which it has been collected is fulfilled – Moreover, using the meta-data related to the transaction, the location of the authentication can easily be traced using the IP address, which impacts upon the privacy of the individual. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Risk of potential surveillance – When Aadhaar is seeded into every database, it becomes a bridge across discreet data silos, which allows anyone with access to this information to re-construct a profile of an individual’s life – This is contrary to the right to privacy and poses severe threats due to potential surveillance – From the verification log, it is possible to locate the places of transactions by an individual in the past five years – It is also possible through the Aadhaar database to track the current location of an individual, even without the verification log – The architecture of Aadhaar poses a risk of potential surveillance activities through the Aadhaar database – Any leakage in the verification log poses an additional risk of an individual’s biometric data being vulnerable to unauthorised exploitation by third parties – The biometric database in the CIDR is accessible to third-party vendors providing biometric search and de-duplication algorithms, since neither the Central Government nor UIDAI have the source code for the de-duplication technology which is at the heart of the programme – The source code belongs to a foreign corporation – UIDAI is merely a licensee – Prior to the enactment of the Aadhaar Act, without the consent of individual citizens, UIDAI contracted with L-1 Identity Solutions (the foreign entity which provided the source code for biometric storage) to provide to it any personal information related to any resident of India – This is contrary to the basic requirement that an individual has the right to protect herself by maintaining control over personal information – The protection of the data of 1.2 billion citizens is a question of national security and cannot be subjected to the mere terms and conditions of a normal contract. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Enrolment by private parties – Before the enactment of the Aadhaar Act, MOUs between UIDI and Registrars were not contracts within the purview of Art.299 of the A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Constitution, and therefore, do not cover the acts done by the private entities engaged by the Registrars for enrolment – Since there is no privity of contract between UIDAI and the Enrolling agencies, the activities of the private parties engaged in the process of enrolment before the enactment of the Aadhaar Act have no statutory or legal backing Art.299. (Per Dr. D Y Chandrachud, J.) Constitution India – – Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Aadhaar Act silent on the liability of UIDAI – Under the Aadhaar architecture, UIDAI is the sole authority which carries out all administrative, adjudicatory, investigative, and monitoring functions of the project – While the Act confers these functions on UIDAI, it does not place any institutional accountability upon UIDAI to protect the database of citizens’ personal information – UIDAI also takes no institutional responsibility for verifying whether the data entered and stored in the CIDR is correct and authentic – The task has been delegated to the enrolment agency or the Registrar – Verification of data being entered in the CIDR is a highly sensitive task for which the UIDAI ought to have taken responsibility – The Aadhaar Act is also silent on the liability of UIDAI and its personnel in case of their non- compliance of the provisions of the Act or the regulations. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.47 – Right of individual, victim of violation of Aadhaar Act to initiate a criminal process – Held: s.47 of the Act violates citizens’ right to seek remedies – Under s.47(1), a court can take cognizance of an offence punishable under the Act only on a complaint made by UIDAI or any officer or person authorised by it – s.47 is arbitrary as it fails to provide a mechanism to individuals to seek efficacious remedies for violation of their right to privacy – Further, s.23(2)(s) of the Act requires UIDAI to establish a grievance redressal mechanism – Making the authority which is administering a project, also responsible for providing a grievance redressal mechanism for grievances arising from the project severely compromises the independence of the grievance redressal body. (Per Dr. D Y Chandrachud, J.) 28 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 29 Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.59 – Validation of actions taken under the 2009 notification – Held: s.59 of the Aadhaar Act seeks to retrospectively validate the actions of the Central Government done prior to the Aadhaar Act pursuant to Notifications dated 28 January 2009. and 12 September 2015 – s.59 does not validate actions of the state governments or of private entities – Moreover, the notification of 2009 did not authorise the collection of biometric data – Consequently, the validation of actions taken under the 2009 notification by s.59 does not save the collection of biometric data prior to the enforcement of the Act – While Parliament possesses the competence to enact a validating law, it must cure the cause of infirmity or invalidity – s.59 fails to cure the cause of invalidity prior to the enactment of the Aadhaar Act – Absence of a legislative framework for the Aadhaar project between 2009 and 2016 left the biometric data of millions of Indian citizens bereft of the kind of protection which must be provided to comprehensively protect and enforce the right to privacy – s.59, therefore, fails to meet the test of a validating law since the complete absence of a regulatory framework and safeguards cannot be cured merely by validating what was done under the notifications of 2009 and 2016. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Absence of an independent regulatory and monitoring framework to provide safeguards for data protection – Held: Absence of an independent regulatory framework renders the Act largely ineffective in dealing with data violations – The architecture of Aadhaar ought to have, but has failed to embody within the law the establishment of an independent monitoring authority (with a hierarchy of regulators), along with the broad principles for data protection – This compromise in the independence of the grievance redressal body impacts upon the possibility and quality of justice being delivered to citizens – In the absence of an independent regulatory and monitoring framework which provides robust safeguards for data protection, the Aadhaar Act cannot pass muster against a challenge on the ground of reasonableness under Art.14. (Per Dr. D Y Chandrachud, J.) A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.57 – Allowing private entities to use Aadhaar numbers – Constitutionality of – Held: This will lead to commercial exploitation of the personal data of individuals without consent and could also lead to individual profiling – Profiling could be used to predict the emergence of future choices and preferences of individuals – These preferences could also be used to influence the decision making of the electorate in choosing candidates for electoral offices – This is contrary to privacy protection norms – Data cannot be used for any purpose other than those that have been approved – While developing an identification system of the magnitude of Aadhaar, security concerns relating to the data of 1.2 billion citizens ought to be addressed – These issues have not been dealt with by the Aadhaar Act – By failing to protect the constitutional rights of citizens, s.57 violates Arts.14 and 21 – s.57 is susceptible to be applied to permit commercial exploitation of the data of individuals or to affect their behavioural patterns – s.57 cannot pass constitutional muster – Since it is manifestly arbitrary, it suffers from overbreadth and violates Art.14 – Constitution of India – Arts.14, 21. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.7 – Constitutionality of – Held: s.7 suffers from overbreadth since the broad definitions of the expressions ‘services and ‘benefits’ enable the government to regulate almost every facet of its engagement with citizens under the Aadhaar platform – If the requirement of Aadhaar is made mandatory for every benefit or service which the government provides, it is impossible to live in contemporary India without Aadhaar – The inclusion of services and benefits in s.7 is a pre- cursor to the kind of function creep which is inconsistent with the right to informational self-determination – s.7 is, therefore, arbitrary and violative of Art.14 in relation to the inclusion of services and benefits as defined – Constitution of India – Art.14. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: s.7 – The legitimate aim of the State can be fulfilled by adopting less intrusive measures as opposed 30 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 31 to the mandatory enforcement of the Aadhaar scheme as the sole repository of identification – The State has failed to demonstrate that a less intrusive measure other than biometric authentication would not subserve its purposes. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Requirement of e-KYC authentication of mobile subscribers – Constitutionality of – Held: The conflation of biometric information with SIM cards poses grave threats to individual privacy, liberty and autonomy – Having due regard to the test of proportionality which has been propounded in Puttaswamy, the decision to link Aadhaar numbers with mobile SIM cards is neither valid nor constitutional – Mere existence of a legitimate state aim will not justify the disproportionate means which have been adopted in the instant case – The biometric information and Aadhaar details collected by Telecom Service Providers shall be deleted forthwith and no use of the said information or details shall be made by TSPs or any agency or person or their behalf. (Per Dr. D Y Chandrachud, J.) Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016: Interim orders – Defiance of judicial orders (both interim and final) be it by the government or by citizens negates the basis of the rule of law – Both propriety and constitutional duty required the Union government to move this Court after the enactment of the Aadhaar Act for variation of this Court’s interim orders – Institutions of governance are bound by a sense of constitutional morality which requires them to abide by judicial orders – Interlocutory orders. (Per Dr. D Y Chandrachud, J.) Constitution of India: Art.110 – Decision of Speaker under Art.110 – Whether immune from judicial review – Held: The decisions of the Speaker is subject to judicial review, if it suffers from illegality or from a violation of constitutional provisions – The power of the Speaker cannot be exercised arbitrarily in violation of constitutional norms and values, as it damages the essence of federal bicameralism, which is a part of the basic structure of the Constitution – Judicial review of the Speaker’s decision, on whether a Bill is a Money Bill is necessary to protect the basic structure of the Constitution – A constitutional trust has been vested in the office of the Speaker of the Lok Sabha – By declaring a Bill to be a Money A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Bill, the Speaker limits the role of the Rajya Sabha – This power cannot be unbridled or bereft of judicial scrutiny – If the power of the Speaker is exercised contrary to constitutional norms, it will not only limit the role of the Rajya Sabha, but denude the efficacy of a legislative body created by the Constitution – Such an outcome would be inconsistent with the scheme of the Indian Constitution – Judicial review is necessary to ensure that the federal features of the Constitution are not transgressed – Administrative law – Judicial review. (Per Dr. D Y Chandrachud, J.) Constitution of India: Art.110 – History of Art.110(3), comparative constitutional practices and other constitutional provisions using the phrase ‘shall be final’ – Examined. (Per Dr. D Y Chandrachud, J.) Constitution of India: Role of Rajya Sabha – The Rajya Sabha represents the constituent states of India – It legitimately holds itself as the guardian of the interest of the component states in a federal polity – It endeavours to remain concerned and sensitive to the aspirations of the states, thereby strengthening the country’s “federal fabric” and “promotes national integration” – The Rajya Sabha is a permanent body as it is not subject to dissolution – Being an indirectly elected House, it has no role in the making or unmaking of the Government and, therefore, it is comparatively “free from compulsions of competitive party politics” – As a revising chamber, the Constitution makers envisioned that it will protect the values of the Constitution, even if it is against the popular will – The Rajya Sabha is a symbol against majoritarianism – Participatory governance is the essence of democracy – It ensures responsiveness and transparency – An analysis of the Bills revised by the Rajya Sabha reveals that in a number of cases, the changes recommended by the Rajya Sabha in the Bills passed by the Lok Sabha were eventually carried out. (Per Dr. D Y Chandrachud, J.) Constitutionalism: Constitutional identity – Aadhaar scheme – Held: Identity is necessarily a plural concept – The Constitution also recognizes a multitude of identities through the plethora of rights that it safeguards – The technology deployed in the Aadhaar scheme reduces different constitutional identities into a single identity of a 12-digit number and infringes the right of an individual to 32 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 33 identify herself/himself through a chosen means – Aadhaar is about identification and is an instrument which facilitates a proof of identity – It must not be allowed to obliterate constitutional identity. (Per Dr. D Y Chandrachud, J.) Income Tax Act, 1961: s.139AA – Constitutionality of – Held: The seeding of Aadhaar with PAN cards depends on the constitutional validity of the Aadhaar legislation itself – s.139AA is based on the premise that the Aadhaar Act itself is a valid legislation – Since the Aadhaar Act itself is now held to be unconstitutional for having been enacted as a Money Bill and on the touchstone of proportionality, the seeding of Aadhaar to PAN under Art.139AA does not stand independently – Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016. (Per Dr. D Y Chandrachud, J.) Interpretation of Statutes: Deeming fiction – While a legislature has the power to legislate retrospectively, it cannot retrospectively create a deeming fiction about the existence of safeguards in the past to justify an encroachment on a fundamental right. (Per Dr. D Y Chandrachud, J.) Prevention of Money Laundering (Maintenance of Records) Rules, 2005: r.9 – Constitutionality of – Whether r.9 and the notifications issued thereunder which mandates linking of Aadhaar with bank accounts is unconstitutional – Held: The provision in the present form does not meet the test of proportionality and, therefore, violates the right to privacy of a person which extends to banking details – This linking is made compulsory not only for opening a new bank account but even for existing bank accounts with a stipulation that if the same is not done then the account would be deactivated, with the result that the holder of the account would not be entitled to operate the bank account till the time seeding of the bank account with Aadhaar is done – This amounts to depriving a person of his property – The test of proportionality requires that a limitation of the fundamental rights must satisfy the following to be proportionate: (i) it is designated for a proper purpose; (ii) measures are undertaken to effectuate the limitation are rationally connected to the fulfilment of the purpose; (iii) there are no alternative less invasive measures; and (iv) there is a proper relation between the importance of achieving the aim and the importance of limiting the A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. right – This move of mandatory linking of Aadhaar with bank account does not satisfy the test of proportionality – The Rules are held to be disproportionate. (Majority Opinion) Prevention of Money Laundering (Maintenance of Records) Rules, 2005: r.9 – Whether r.9 as amended by the Prevention of Money-Laundering (Second Amendment) Rules, 2017 unconstitutional – Held:r.9 as amended by PMLA (Second Amendment) Rules, 2017 is not unconstitutional and does not violate Arts.14, 19(1)(g), 21 & 300A of the Constitution and ss.3, 7 & 51 of the Aadhaar Act – Further r.9 as amended is not ultra vires to PMLA Act, 2002 – Amended Rules help all concerned to detect fictitious, ghost and benami accounts – The object of the PMLA and the definition of beneficial owner Act seeks to traverse behind the corporate veil of shell companies and spurious Directors in order to ascertain the real natural persons controlling the accounts in the reporting entities – The statutory rules cast an obligation on all account holders to get their identity verified by Aadhaar mechanism and those who are already holding account in the reporting entity they are required to submit the Aadhaar number or proof of their applied Aadhaar identity – When a statute puts obligation on account holder to get identity verification in a particular manner a person chose not to obtain Aadhaar number cannot complain his disentitlement of operating his account – The object of inserting the Rule is to make it possible to weed out fake and duplicate PANs and false bank accounts – The Second Amendment Rules are step in direction to cure the menace of fake bank accounts held by the shell companies in the name of dummy directors, money laundering, terror financing etc. – Aadhaar number is required to be given at the time of opening of the account based relationship and not for every transaction conducted by an account holder of the bank – Those who have already existing accounts are required to submit only once their Aadhaar number for verification – The requirement of Aadhaar number being given only for once is not any cumbersome or undue burden on an account holder and is a proportionate measure – For non-submission of Aadhaar number and PAN only consequence which is contemplated by sub-rule (c) is that account shall cease to be operational – The account will remain to belong to the account holder and the amount 34 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 35 in the account is only his amount and there is no deprivation of the property of account holder – Further, account is ceased operational only till the time Aadhaar number and PAN is submitted – The consequences provided is only to effectuate the purpose of the Act and the Rules i.e. account be verified by Aadhaar mechanism – Thus, r.9(17)(c) does not violate right under Art.300A – Aadhaar number providing for verification of an account also cannot be held to be violating right under Art.21 – The reporting entity i.e. banks and financial institutions under various statutes are required to provide information of a bank account to different authorities including income tax authority, account verification by Aadhaar is not for the purpose of keeping a track on the transaction done by an individual – Aadhaar number has to be given only once for opening of the account or for verification of the account and transactions are not to be made on the basis of Aadhaar verification each time – Rules cannot be held in any manner violating ss.3, 7 and 51 – The rules provide for use of Aadhaar for verification of bank account by law as contemplated by s.57 of the Aadhaar Act – Prevention of Money-Laundering (Second Amendment) Rules, 2017 – Constitution of India – Arts.14, 19(1)(g), 21 and 300A – Aadhaar (Targeted Delivery of Financial and other Subsidies, benefits and services) Act, 2016. (Per Ashok Bhushan, J.) Prevention of Money Laundering (Maintenance of Records) Rules, 2005: r.9 (as amended by PMLA (Second Amendment) Rules, 2017 ) – Constitutionality of – Held: The 2017 amendments to the PMLA Rules fail to satisfy the test of proportionality – The imposition of a uniform requirement of linking Aadhaar numbers with all account based relationships proceeds on the presumption that all existing account holders as well as every individual who seeks to open an account in future is a potential money-launderer – No distinction has been made in the degree of imposition based on the client, the nature of the business relationship, the nature and value of the transactions or the actual possibility of terrorism and money- laundering – The rules also fail to make a distinction between opening an account and operating an account – Moreover, the consequences of the failure to submit an Aadhaar number are draconian – In their present form, the rules are clearly disproportionate and excessive. (Per Dr. D Y Chandrachud, J.) A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Disposing of the matters, the Court HELD: Per A.K. Sikri, J. (for CJI, himself and A.M. Khanwilkar, J.) (Majority Opinion)

1.1 The whole architecture of Aadhaar is devised to give unique identity to the citizens of this country. No doubt, a person can have various documents on the basis of which that individual can establish her identify. It may be in the form of a passport, Permanent Account Number (PAN) card, ration card and so on. For the purpose of enrolment itself number of documents are prescribed which an individual can produce on the basis of which Aadhaar card can be issued. Thus, such documents, in a way, are also proof of identity. However, there is a fundamental difference between the Aadhaar card as a means of identity and other documents through which identity can be established. Enrolment for Aadhaar card also requires giving of demographic information as well as biometric information which is in the form of iris and fingerprints. This process eliminates any chance of duplication. An individual can manipulate the system by having more than one or even number of PAN cards, passports, ration cards etc. When it comes to obtaining Aadhaar card, there is no possibility of obtaining duplicate card. Once the biometric information is stored and on that basis Aadhaar card is issued, it remains in the system with the Authority. Wherever there would be a second attempt for enrolling for Aadhaar and for this purpose same person gives his biometric information, it would immediately get matched with the same biometric information already in the system and the second request would stand rejected. It is for this reason the Aadhaar card is known as Unique Identification (UID). Such an identity is unparalleled. In addition to enabling any resident to obtain such unique identification proof, it is also to empower marginalised section of the society, particularly those who are illiterate and living in abject poverty or without any shelter etc. It gives identity to such persons also. Moreover, with the aid of Aadhaar card, they can claim various privileges and benefits etc. which are actually meant for these people. [Paras 55, 56][188-C- G; 189-A-B] 36 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 37 Basheshar Nath v. Commissioner of Income Tax, Delhi and Rajasthan & Anr. [1959] Supp 1 SCR 528; Romesh Thappar v. State of Madras [1950] SCR 594; State of Karnataka & Anr. v. Shri Ranganatha Reddy & Anr. (1977) 4 SCC 471 : [1978] 1 SCR 641; Dattatraya Govind Mahajan v. State of Maharashtra (1977) 2 SCC 548 : [1977] 2 SCR 790; National Human Rights Commission v. State of Arunachal Pradesh (1996) 1 SCC 742 : [1996] 1 SCR 278 – relied on. Ex parte Jackson 96 US 727 (1878); Lovell v. City of Griffin 303 US 444 (1938); Bidie v. General Accident, Fire and Life Assurance Corporation (1948) 2 All ER 995, 998; Holmes in Towne v. Eisner Towne v. Eisner 245 US 418; James v. Commonwealth of Australia (1936) AC 578 – referred to. Thiruvengadam, The Use of Foreign Law in Constitutional Cases in India and Singapore (2010) – referred to.

1.2 When the judiciary is assigned the role of upholding the rule of law, the first function of the judiciary is to protect the democracy as well as the Constitution. At the same time, second role of the Court, which is equally important, is to bridge the gap between the law and the society. In the process of undertaking this role, a third role, which is of equal significance also springs up. Judiciary is also to ensure that social and economic justice is meted out to the deserving lot by affirmative action of the State. [Para 72][205-C-D] Binoy Viswam v. Union of India & Ors. (2017) 7 SCC 59 : [2017] 7 SCR 1 – relied on. State of M.P. v. Rakesh Kohli (2012) 6 SCC 312 : [2012] 6 SCR 661; Ashoka Kumar Thakur v. Union of India (2008) 6 SCC 1 : [2008] 4 SCR 1; A.P. & Ors. v. MCDOWELL & Co. & Ors. (1996) 3 SCC 709 : [1996] 3 SCR 721; Rajbala & Ors. v. State of Haryana & Ors. (2016) 2 SCC 445 : [2015] 12 SCR 1106 – referred to. A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R.

2. Scope of Judicial review: Judicial review means the Supremacy of law. It is the power of the court to review the actions of the Legislature, the Executive and the Judiciary itself and to scrutinize the validity of any law or action. It has emerged as one of the most effective instruments of protecting and preserving the cherished freedoms in a constitutional democracy and upholding principles such as separation of powers and rule of law. The Judiciary, through judicial review, prevents the decisions of other branches from impinging on the constitutional values. The fundamental nature of the Constitution is that of a limiting document, it curtails the powers of majoritarianism from hijacking the State. The power of review is the shield which is placed in the hands of the most judiciaries of constitutional democracies to enable the protection of the supreme document. [Para 74][205- C-D] Shayara Bano v Union of India (2017) 9 SCC 1 : [2017] 7 SCR 797; Dr. K.R. Lakshmanan v. State of T.N. & Anr. (1996) 2 SCC 226 : [1996] 1 SCR 395; Maneka Gandhi v. Union of India & Anr. (1978) 1 SCC 248 : [1978] 2 SCR 621 – relied on.

3. Contours of Right to Privacy:

3.1 It stands established, with conclusive determination of the nine Judge Bench judgment of this Court in K.S. Puttaswamy that right to privacy is a fundamental right. One of the feature of this judgment is that right to privacy cannot be impinged without a just, fair and reasonable law. It has to fulfill the test of proportionality i.e. (i) existence of a law; (ii) must serve a legitimate State aim; and (iii) proportionality. The Court has held that privacy has always been a natural right which gives an individual freedom to exercise control over his or her personality. The judgment further affirms three aspects of the fundamental right to privacy, namely: (i) intrusion with an individual’s physical body; (ii) informational privacy; and (iii) privacy of choice. Further, privacy is considered as a subset of personal liberty. Another significant jurisprudential development of this judgment is that right to privacy as a fundamental right is not limited to Article 21. On the contrary, privacy resonates through the entirety of Part III 38 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 39 of the Constitution which pertains to fundamental rights and, in particular, Articles 14, 19 and 21. [Paras 81, 82, 84][216-F; 254- F-G; 255-F]

3.2 The judgment clarifies that the ‘classification’ test adopted earlier has to be expanded and instead the law/action is to be tested on the ground of ‘manifest arbitrariness’. When it comes to examining the ‘restrictions’ as per the provisions of Article 19 of the Constitution, the judgment proceeds to clarify that a law which impacts dignity and liberty under Article 21, as well as having chilling effects on free speech which is protected by Article 19(1)(a), must satisfy the standards of judicial review under both provisions. Therefore, such restriction must satisfy the test of judicial review under: (i) one of the eight grounds mentioned under Article 19(2); and (ii) the restriction should be reasonable. This Court has applied multiple standards to determine reasonableness, including proximity, arbitrariness, and proportionality. Further, the reasonable restrictions must be in the interests of: (i) the sovereignty and integrity of India, (ii) the security of the State, (iii) friendly relations with foreign States, (iv) public order, (v) decency or morality or (vi) in relation to contempt of court, (vii) defamation or (viii) incitement to an offence. The judgment further laid down that in the context of Article 21, the test to be applied while examining a particular provision is the ‘just, fair and reasonable test’ thereby bringing notion of proportionality. The reasonable expectation of privacy may vary from the intimate zone to the private zone and from the private zone to the public arena. [Paras 87, 88 and 90][257-H; 258-A, E] K.S. Puttaswamy & Anr. v. Union of India & Ors. [2017] 10 SCR 569 : (2017) 10 SCC 1 – followed.

3.3 Principles of Human Dignity: Privacy is the constitutional core of human dignity. In the context of Aadhaar scheme how the concept of human dignity is to be applied assumes significance. The right of choice and right of self determination were accepted as facets of human dignity. The basic principle of dignity and freedom of the individual is an attribute of natural law which becomes the right of all individuals in a constitutional A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. democracy. Dignity has a central normative role as well as constitutional value. When reading socio-economic rights into human dignity, the community approach also assumes importance along with individualistic approach to human dignity. It has now been well recognised that at its core, human dignity contains three elements, namely, intrinsic value, autonomy and community value. These are known as core values of human dignity. These three elements can assist in structuring legal reasoning and justifying judicial choices in ‘hard cases’. Human dignity is a constitutional principle, rather than free standing fundamental rights. [Paras 94, 97, 105 and 116][262-E; 264-D-E; 275-C; 279-A-B] Common Cause v. Union of India (2018) 5 SCC 1; National Legal Services Authority v. Union of India (2014) 5 SCC 438; Shabnam v. Union of India & Ors. (2015) 6 SCC 702 : [2015] 8 SCR 289; Jeeja Ghosh & Another v. Union of India & Ors. (2016) 7 SCC 761 : [2016] 4 SCR 638; Aruna Ramachandra Shanbaug v. Union of India & Ors. (2011) 4 SCC 454 : [2011] 4 SCR 1057 – relied on. Gobind v. State of M.P. (1975) 2 SCC 148 : [1975] 3 SCR 946; Kharak Singh v. State of U.P. AIR 1963 SC 1295 : [1964] 1 SCR 332 – referred to. Daniel Solove, Understanding Privacy, Cambridge, Massachusetts: Harvard University Press, 2008; Ronald Dworkin, Taking Rights Seriously (A&C Black, 2013) 239; Ronald Dworkin, Is Democracy Possible Here? Principles for a New Political Debate (Princeton University Press, 2006); Justice for Hedgehogs (2011) Harvard University Press, 2011; Kenneth W. Simons, “Dworkin’s Two Principle of Dignity: An Unsatisfactory Non-Consequentialist Account of Interpersonal Moral Duties”, 90 Boston Law Rev. 715 (2010)]; ‘Human Dignity and Judicial Interpretation of Human Rights’ Published in the European Journal of International Law on September 01, 2008 – referred to. 40 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 41

4. Doctrine of Proportionality: Whenever challenge is laid to an action of the State on the ground that it violates the right to privacy, the action of the State is to be tested on the following parameters: (a) the action must be sanctioned by law; (b) the proposed action must be necessary in a democratic society for a legitimate aim; and (c) the extent of such interference must be proportionate to the need for such interference. [Para 117][282-D-E] Modern Dental College and Research Centre v. State of Madhya Pradesh (2016) 7 SCC 353 – relied on.

5. Surveillance:

5.1 Whether the architecture of the Aadhaar project enables the State to create a regime of surveillance?; and (b) whether there are adequate provisions for data protection? The provisions of the Aadhaar Act and the machinery which the Authority has created for data protection as demonstrated by the respondents in the powerpoint presentation showed that it is very difficult to create profile of a person simply on the basis of biometric and demographic information stored in CIDR. Insofar as authentication is concerned, the respondents rightly pointed out that there are sufficient safeguard mechanisms. It was specifically submitted that there were security technologies in place, 24/7 security monitoring, data leak prevention, vulnerability management programme and independent audits as well as the Authority’s defence mechanism. It was further pointed out that the Authority has taken appropriate pro-active protection measures, which included disaster recovery plan, data backup and availability and media response plan. The respondents also pointed out that all security principles are followed inasmuch as: (a) there is PKI-2048 encryption from the time of capture, meaning thereby, as soon as data is given at the time of enrolment, there is an end to end encryption thereof and it is transmitted to the Authority in encrypted form. The said encryption is almost foolproof and it is virtually impossible to decipher the same; (b) adoption of best-in-class security standards and practices; and (c) strong audit and traceability as well as fraud detection. Above A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. all, there is an oversight of Technology and Architecture Review Board (TARB) and Security Review Committee. This Board and Committee consist of very high profiled officers. Therefore, the Act has endeavoured to provide safeguards [Para 153][308-E- H; 309-A-B] Selvi & Ors. v. State of Karnataka (2010) 7 SCC 263 : [2010] 5 SCR 381; Kharak Singh v. State of U.P. AIR 1963 SC 1295 : (1964) 1 SCR 332; District Registrar and Collector, Hyderabad and Anr. v. Canara Bank and Ors. (2005) 1 SCC 496 : [2004] 5 Suppl. SCR 833 – referred to. R. v. Oakes [1986] 1 SCR 103; U.S. v. Jones 132 S.Ct. 945 (2012); Zakharov v. Russia (2015) Application No. 47143/2006; Digital Rights Ireland Ltd. v. Minister for Communication, Marine and Natural Resources [2014] All ER (D) 66 (Apr); S and Marper v. United Kingdom (2008) ECHR 1581 – referred to. Robert Alexy, A Theory of Constitutional Rights, (Oxford, Oxford University Press, 2002); John Donne, XVII. Mediation, in Devotions upon Emergent Occasions 107, 108-09 (Uyniv. Of Mich. Press 1959) (1624); M Kumm, ‘The Idea of Socratic Contestation and the Right to Justification: The Point and Purpose of Rights-Based Proportionality Review’ (2010) 4 Law & Ethics of Human Rights 141; M Kumm, ‘Institutionalising Socratic Contestation: The Rationalist Human Rights Paradigm, Legitimate Authority and the point of Judicial Review’ (2007) 1 European Journal of Legal Studies; K Moller, The Global Model of Constitutional Rights (Oxford, Oxford University Press, 2012); M Kumm, ‘Political Liberalism and the Structure of Rights: On the Place and Limits of the Proportionality Requirement’ in Pavlakos (ed), Law, Rights and Discourse: The Legal Philosophy of Robert Alexy (Oxford, Hart Publishing, 2007) 131; Moller, the Global Model of Constitutional Rights (Oxford, Oxford University Press, 2012) ch 42 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 43 7; Alexy’s ‘Second Law of Balancing’, which he proposes in the Postscript to A Theory of Constitutional Rights (Oxford, Oxford University Press, 2002); ‘Necessity and Proportionality: Towards A Balanced Approach?’, Hart Publishing, Oxford and Portland, Oregon, 2016; S Choudhry, ‘So What Is the Real Legacy of Oakes? Two Decades of Proportionality Analysis under the Canadian Charter’s Section 1’ (2006) 34 Supreme Court Law Review 501 – referred to.

5.2 Internet access is becoming cheaper by the day, which can be accessed not only through the medium of desktop computers or laptops and even other handy gadgets like smart phones. However, the use of such technologies is at the cost of giving away personal information, which is in the realm of privacy. In order to connect with such technologies and avail their benefits, the users are parting with their biometric information like fingerprints and iris as well as demographic information like their names, parentage, family members, their age, even personal information like their sex, blood group or even the ailments they are suffering from. Not only this, use of said facilities on net or any portal like Apple, Google, Facebook etc. involves tracking their movements, including the nature of activities, like the kind of shopping, the places from where shopping is done, the actual money spent thereon, the nature of movies watched etc. All this data is there with the companies in respect of its users which may even turn into metadata. In fact, cases after cases are reported where such data of users is parted with various purposes. These have raised concerns about the privacy and protection of data. Problem is not limited to data localisation but has become extra- territorial. There are issues of cross-border transfers of personal data, regulation whereof is again a big challenge with which various opinions are grappling. When it comes to the State or the instrumentality of the State, the matter has to be taken with all seriousness, on the touchstone of constitutionalism and the concept of limited Government. [Para 159, 160, 161 and 162][311-B, G-H; 312-A-B, C-D, G] A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R.

5.3 Law on Data Protection:

5.3.1 Legislation in India. The only existing legislation covering data protection related to biometric information are Section 43A and Section 72A of the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Although the IT Act and Rules do not determine the constitutionality of use of biometric data and information by the Aadhaar Act and Rules, they are instructive in determining the safeguards that must be taken to collect biometric information. Section 43A of the IT Act attaches liability to a body corporate, which is possessing, handling and dealing with any ‘sensitive personal information or data’ and is negligent in implementing and maintaining reasonable security practices resulting in wrongful loss or wrongful gain to any person. ‘Sensitive personal information or data’ is defined under Rule 3 of the Sensitive Personal Data Rules to include information relating to biometric data. Similarly, Section 72A of the IT Act makes intentional disclosure of ‘personal information’ obtained under a contract, without consent of the parties concerned and in breach of a lawful contract, punishable with imprisonment and fine. Rule 2(i) of the Sensitive Personal Data Rules define “personal information” to mean any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person. Thus, biometrics will form a part of “personal information”. The Sensitive Personal Data Rules provide for additional requirements on commercial and business entities (body corporates as defined under Section 43A of the IT Act) relating to the collection and disclosure of sensitive personal data (including biometric information). [Paras 163-166][313-B- E; 314-D-F; 315-A-B]

5.3.2 Position in other countries: (a) EUGDPR (European Union General Data Protection Regulation): EUGDPR which was enacted by the EU in 2016 came into force on May 25, 2018 replacing the Data Protection Directive of 1995. It is an exhaustive and comprehensive legal framework that is aimed at protection of natural persons from the processing of personal data and their 44 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 45 right to informational privacy. It deals with all kinds of processing of personal data while delineating rights of data subjects and obligations of data processors in detail. (b) Biometric Privacy Act in the United States of America. [Para 166, 168][316-G; 317- A-B; 318-D-E] S and Marper v. United Kingdom [2008] ECHR 1581 – referred to. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – referred to.

5.3.3 Case laws: Data collection, usage and storage (including biometric data) in Europe requires adherence to the principles of consent, purpose and storage limitation, data differentiation, data exception, data minimization, substantive and procedural fairness and safeguards, transparency, data protection and security. Only by such strict observance of the above principles can the State successfully discharge the burden of proportionality while affecting the privacy rights of its citizens. The jurisprudence with respect to collection, use and retention of biometric information in the United States differs from the EU. In the US context, there is no comprehensive data protection regime. This is because of the federal system of American government, enforcement¯federal, state, and local. Different states have differing standards for informational privacy. Thus, importance to data protection in processing the data of the citizens is an accepted norm. Observance of this fundamental principle is necessary to prevent a disproportionate infringement of the Fundamental Right of Privacy of a citizen. [Paras 187, 188, 189, 190][326-A-B, E-F] are multiple levels Ireland Ltd v. Minister Digital Rights Communication, Marine and Natural Resources [2014] All ER (D) 66 (Apr); Tele2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson, Peter Brice, Geoffrey A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Lewis, Joined Cases C-203/15 and C-698/15, 2016; BverfG 2.03.2010, 1 BvR 256/ 08, 1 BvR 263 / 08, 1 BvR 586/08; Maximillian Schrems v. Data Protection Commissioner [2016] 2 W.L.R. 873; Szabo and Vissy v. Hungary Eur. Ct. H.R. 2016; 186 – referred to.

6. Data Minimisation: Demographic information, both mandatory and optional, and photographs does not raise a reasonable expectation of privacy under Article 21 unless there is special circumstances such as juveniles in conflict of law or a rape victim’s identity. Today, all global ID cards contain photographs for identification alongwith address, date of birth, gender etc. The demographic information is readily provided by individuals globally for disclosing identity while relating with others and while seeking benefits whether provided by government or by private entities, be it registration for citizenship, elections, passports, marriage or enrolment in educational institutions. Email Ids and phone numbers are also available in public domain. Aadhaar Act only uses demographic information which are not sensitive and where no reasonable expectation of privacy exists - name, date of birth, address, gender, mobile number and e mail address. Section 2(k) specifically provides that Regulations cannot include race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Thus, sensitive information specifically stand excluded. Section 32(3) of the Aadhaar Act specifically prohibits the authority from collecting, storing or maintaining, either directly or indirectly any information about the purpose of authentication. The proviso to Regulation 26 is also to the same effect. Thus, the principle of data minimization is largely followed.[Paras 193-195][327-F-H; 328-A-C]

7. Some other provisions which are challenged on the basis of threat to security of the data. Section 2(c) pertains to authentication. It is a process by which Aadhaar number along with demographic information or biometric information of an individual is submitted to the CIDR for its verification. On submission thereof, the CIDR verifies the correctness or lack of it. Section 10 lays down that the Authority may engage one or more entities to establish or maintain the CIDR and to perform 46 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 47 any other functions as may be specified by regulations. While seeking authentication, neither the location of the person whoso identity is to be verified nor the purpose for which authentication of such identity is needed, comes to the knowledge of the Authority and, therefore, such data collected by the Authority. Therefore, the threat to real time surveillance and profiling may be far-fetched. The authentication record would only contain information about the identity about the RE. It will give information only about the RE (nic.in) and not about the organisation which is requiring authentication through the RE. In most cases the authentication is one time. [Paras 196, 197][328-G; 329-B-C]

8. Time Period for Data Retention: According to petitioners, the data is allowed to be retained for an unreasonable long period of time. Regulation 27 of the Authentication Regulations requires the UIDAI to retain the “authentication transaction data” (which includes the meta data) for a period of 6 months and to archive the same for a period of 5 years thereafter. Regulation 18(3) and 20(3) allow Requesting entities (RE) and Authentication Service Agencies to retain the authentication logs for a period of 2 years and then archive them for 5 years. It is required to be deleted only after 7 years unless retained by a court. There is is no reason for archiving the authentication transaction data for a period of five years. Retention of this data for a period of six months is more than sufficient after which it needs to be deleted except when such authentication transaction data are required to be maintained by a Court or in connection with any pending dispute. Regulations 26 and 27 shall, therefore, be amended accordingly. [Para 205][332-E-F, H; 333-A]

9. Data Protection and Security: Apprehension of petitioners was that there were not enough safeguards for data protection and security in the Act. The following explanation furnished by the respondents on various facets ensures data protection and security to a considerable extent: (a) CIDR – Regulation 3(i) & (j) of Aadhaar (Data Security) Regulation 2016 enables partitioning of CIDR network into zones A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. based on risk and trust and other security measures. CIDR being a computer resource is notified to be a “Protected System” under Section 70 of the IT Act, 2000 by the Central Government on 11.12.2015. Anyone trying to unlawfully gain access into this system is liable to be punished with 10 years imprisonment and fine. The storage involves end to end encryption, logical partitioning, firewalling and anonymisation of decrypted biometric data. Breaches of penalty are made punitive by Chapter VII of the Act. [Paras 207, 208][333-B, G-H; 334-A-B] (b) Requesting Entities (AUA and KUA) – Other identity information is shared with Requesting Entity (AUAs and KUAs) only for the limited purpose of authentication. The data is transferred from the RE to the ASA (Authentication Service Agency) to the CIDR in an encrypted manner through a leased line circuitry using secure Protocols. The storage of data templates is in safely located servers with no public internet inlet/ outlet, and offline storage of original encrypted data (PID blocks). There are safety and security provisions such as audit by Information Systems Auditor. REs are appointed through agreement. REs can enter into agreement with sub-AUA or sub- KUA with permission of the UIDAI. Whatever identity information is obtained by the requesting entity is based on a specific consent of the Aadhaar number holder. The e-KYC data shared with the RE can only be after prior consent of the Aadhaar holder. Such data cannot be shared and has to be stored in encrypted form. The biometric information used is not permitted to be stored only the logs of authentication transactions are maintained for a short period. Full identity information is never transmitted back to RE. There is a statutory bar from sharing Biometric information. The Data centres of ASA, REs and CIDR should be within the territory of India. [Para 209][334-C-F] (c) Enrolment Agencies and Registrars – The enrolment and Authentication processes are strongly regulated so that data is secure. The Enrolment agency, which collects the biometric and demographic of the individuals during enrolment, is appointed either by UIDAI or by a Registrar. The registrar are appointed through MoUs or agreements for enrolment and are to abide by a code of conduct and processes, policies and guidelines issued 48 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 49 by the authority. They are responsible for the process of enrolment. Categories of persons eligible for appointment are limited by the Regulations. The agency employs a certified supervisor, an operator and a verifier under Enrolment and Update Regulations. Registrars, enrolling agencies are obliged to use the software provided or authorized by UIDAI for enrolment purpose. The standard software has security features as specified by Authority. All equipment used are as per the specification issued by the authority. The Registrars are prohibited from using the information collected for any purpose other than uploading the information to CIDR. Sub-contracting of enrolment function is not allowed. The Code of Conduct contains specific directions for following the confidentiality, privacy and security protocols and submission of periodic reports of enrolment. Not only there are directions prohibiting manipulation and fraudulent practices but the Act contains penal provisions for such violations in Chapter VII of the Regulations. The enrolment agencies are empanelled by the authority. They are given an enrolling agency code using which the Registrar can onboard such agency to the CIDR. The enrolment data is uploaded to the CIDR certified equipment and software with a digital signature of the registrar/ enrolling agency. The data is encrypted immediately upon capture. The decryption key is with the UIDAI solely. [Para 210][334-G- H; 335-A-E] (d) Authentication Service Agency – Authentication only becomes available through the Authentication Service Agency (ASA). They are regulated by the Aadhaar (Authentication) Regulations, 2016. They are to use certified devices, equipment, or software are duly registered with or approved or certified by the Authority/agency. The systems and operations are audited by information system auditor. The REs pass the encrypted data to the CIDR through the ASA and the response (Yes/No authentication or e-KYC information) also takes the same route back. The server of the ASA has to perform basic compliance and completeness checks on the authentication data packet before forwarding it to the CIDR. [Para 211]335-F-H] (e) Hacking – So far there has been no incidence of hacking. However, the authority is conscious of the hackers and it A B C D E F G H 50 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. constantly updates itself to safe guard the data. Of late certain reports have appeared in newspapers to the effect that some people could hack the website of CIDR, though it is emphatically denied by the UIDAI. [Para 212][336-A-C] (f) Biometric Solution Providers – With respect to foreign companies owning software, Respondents submit that UIDAI has entered into licensing agreements with foreign biometric solution providers (BSP) for software. Even though the source code of the software are retained by the BSP as it constitutes their Intellectual property, the data in the server rooms is secure as the software operates automatically and the biometric data is stored offline. There is no opportunity available to BSP to extract data as they have no access to it. [Para 213][336-D-E]

10. Substantive, Procedural or Judicial Safeguards: The Union Government, on 31 July 2017, had constituted a committee chaired by Retd. Justice B N Srikrishna, former Judge of the Supreme Court of India to review data protection norms in the country and to make recommendations. The Committee recently released its report and the first draft of the Personal Data Protection Bill, 2018 which comprehensively addresses the processing of personal data where such data has been collected, disclosed, shared or otherwise processed within the territory of India. The bill has incorporated provisions and principles from the Europe’s General Data Protection Regulation (EUGDPR). The Bill largely incorporates data protection principles from the EUGDPR and EU data protection jurisprudence, including fair and reasonable processing of data, purpose limitation, collection limitation, lawful processing, storage limitation, data quality and accountability. The Draft bill and the report cull out rights and obligations of the data fiduciary and data controller respectively. These rights include the right to access and correction, the right to data portability and right to be forgotten – a right to prevent or restrict disclosure of personal data by a fiduciary. Most importantly, consent has been given a crucial status in the draft data protection law. Thus, a primary basis for processing of personal data must be individual consent. This consent is required to be free, informed, specific, clear and, in an important addition, capable of being withdrawn. The JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 51 Authority under the Bill is obligated and empowered to ensure protection of data from misuse and compromise. [Paras 223, 225, 229][340-F-G; 341-B-D]

11. Privacy: Whether Aadhaar Act violates right to privacy and is unconstitutional on this ground?

11.1 As per Section 7 of the Aadhaar Act in case an individual wants to avail any subsidy benefit or services, she is required to produce the Aadhaar number and, therefore, it virtually becomes compulsory for such a person. To that extent the petitioners may be right in submitting that even if enrolment in Aadhaar is voluntary, it assumes the character of compulsory enrolment for those who want to avail the benefits under Section 7. Likewise, authentication, as mentioned in Section 8, also becomes imperative. The relevant question, therefore, is as to whether invasion into this privacy meets the triple requirements or right to privacy. The Parliament has now passed Aadhaar Act, 2016. Therefore, law on the subject in the form of a statute very much governs the field and, thus, first requirement stands satisfied. In the Statement of Objects and Reasons, it is inter alia mentioned that though number of social benefits schemes have been floated by the Government, the failure to establish identity of an individual has proved to be a major hindrance for successful implementation of those programmes as it was becoming difficult to ensure that subsidies, benefits and services reach the intended beneficiaries in the absence of a credible system to authenticate identity of beneficiaries. The rationale behind Section 7 lies in ensuring targeted delivery of services, benefits and subsidies which are funded from the Consolidated Fund of India. In discharge of its solemn Constitutional obligation to enliven the Fundamental Rights of life and personal liberty (Article 21) to ensure Justice, Social, Political and Economic and to eliminate inequality (Article 14) with a view to ameliorate the lot of the poor and the Dalits, the Central Government has launched several welfare schemes. Some such schemes are PDS, scholarships, mid day meals, LPG subsidies, etc. These schemes involve 3% percentage of the GDP and involve a huge amount of public money. Right to receive these benefits, from the point of view of those who deserve the same, has now attained the status of fundamental right based on A B C D E F G H 52 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. the same concept of human dignity, which the petitioners seek to bank upon. Right of everyone to adequate food no more remains based on Directive Principles of State Policy (Art 47), though the said principles remain a source of inspiration. This entitlement has turned into a Constitutional fundamental right. The scheme of the Act designs a targeted public distribution system for providing food grains to those below BPL. The object is to ensure to the people adequate food at affordable prices so that people may live a life with dignity. In a welfare State, where measures are taken to ameliorate the sufferings of the downtrodden, the aim of the Act is to ensure that these benefits actually reach the populace for whom they are meant. This is naturally a legitimate State aim. [Paras 261, 263, 266][359-B-D; 360-D-E; 364-D-F; 365-A-B, D] His Holiness Kesavananda Bharati Sripadagalavaru v. State of Kerala & Anr. (1973) 4 SCC 225 : [1973] Suppl. SCR 1 – followed. Gobind v. State of M.P. (1975) 2 SCC 148 : [1975] 3 SCR 946; Chairman, All India Railway Recruitment Board v. K Shyam Kumar and others (2010) 6 SCC 614 : [2010] 6 SCR 291; Common Cause v. Union of India [2014] 3 SCR 289; PUCL v. Union of India (2011) 14 SCC 331; G. Sundarrajan v. Union of India (2013) 6 SCC 620 – referred to. Jordan & Ors v. State (2002) ZACC 22; Cruzan v. Director, Missouri Dept. of Health 497 US 361 (1990) – referred to.

11.2 In order to meet the test of proportionality, four sub- components of proportionality need to be satisfied: (a) A measure restricting a right must have a legitimate goal (legitimate goal stage). (b) It must be a suitable means of furthering this goal (suitability or rationale connection stage). (c) There must not be any less restrictive but equally effective alternative (necessity stage). (d) The measure must not have a disproportionate impact on the right holder (balancing stage). [Para 267][367-E-F]

11.3 Whether these components meet the required parameters in the instant case. JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 53 (a) Legitimate Goal Stage: The purpose of Aadhaar Act, as captured in the Statement of Objects and Reasons and sought to be implemented by Section 7 of the Aadhaar Act, is to achieve the stated objectives. [Paras 268, 276][363-G; 371-A-B] People’s Union for Civil Liberties (PUCL) v. Union of India (2001) 5 SCALE 303; State of Bihar & Ors. v. Project Uchcha Vidya, Sikshak Sangh & Ors. Civil Appeal No. 6626-6675 of 2001; Ashoka Thakur v. Union of India Writ Petition (Civil) No. 265 of 2006, judgment delivered on April 10, 2008; Paschim Banga Ket Mazdoor Samity v. State of West Bengal (1996) 4 SCC 37 : [1996] 2 Suppl. SCR 331; Mohini Jain v. State of Kerala & Ors. (1992) 3 SCC 666 : [1992] 3 SCR 658; Unnikrishnan v. State of Andhra Pradesh (1993) 1 SCC 645 : [1993] 1 SCR 594; Olga Tellis & Ors. v. Bombay Municipal Corporation & Ors. [1985] SCR 2 Suppl. 51; Francis Coralie Mullin v. The Administrator, Union Territory of Delhi & Ors. [1981] 2 SCR 516 – relied on. (b) Suitability or rationale connection stage: The measures which are enumerated and been taken as per the provisions of Section 7 read with Section 5 of the Aadhaar Act are rationally connected with the fulfillment of the objectives contained in the Aadhaar Act. The scheme for enrolling under the Aadhaar Act and obtaining the Aadhaar number is optional and voluntary. It is given the nomenclature of unique identity. A person with Aadhaar number gets an identity. By providing that the benefits for various welfare schemes shall be given to those who possess Aadhaar number and after undergoing the authentication as provided in Section 8 of the Aadhaar Act, the purpose is to ensure that only rightful persons receive these benefits. It becomes the duty of the Government to ensure that it goes to deserving persons. Therefore, second component also stands fulfilled. [Paras 277, 279][371-C-D; 372-C-D] (c) Necessity Stage: The manner in which malpractices have been committed in the past leaves to hold that apart from the system of unique identity in Aadhaar and authentication of the real beneficiaries, there is no alternative measure with lesser A B C D E F G H 54 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. degree of limitation which can achieve the same purpose. [Para 280][372-E-F] (d) Balancing Stage: No doubt, there is a right to privacy, which is now entrenched in fundmental rights. On the other hand, it is the rights of those persons whose dignity which is sought to be ensured by giving them the facilities which are necessary to live as dignified life. Therefore, balancing has to be done at two levels, rights to privacy on one hand and right to food, shelter and employment on the other hand. In the first instance, it is to be seen as to whether the petitioners claim on the information supplied while authentication to be protected is based on reasonable expectation. ‘Reasonable Expectation’ involves two aspects. First, the individual or individuals claiming a right to privacy must establish that their claim involves a concern about some harm likely to be inflicted upon them on account of the alleged act. This concern ‘should be real and not imaginary or speculative’. Secondly, ‘the concern should not be flimsy or trivial’. It should be a reasonable concern. [Para 285, 288, 289][374-A-B; 376-E-G] Katz v. US 389 U.S. 347; Smith v. Marlyand 442 US 735; R. Wood v. Commissioner (2010) 1 WLR 123 – referred to. 11.4 The second facet of balancing, namely, balancing of two fundamental rights. The Aadhaar Act truly seeks to secure to the poor and deprived persons an opportunity to live their life and exercise their liberty. By ensuring targeted delivery through digital identification, it not only provides them a nationally recognized identity but also attempts to ensure the delivery of benefits, service and subsidies with the aid of public exchequer/ Consolidated Fund of India. National Security Food Act, 2013 passed by the Parliament seeks to address the issue of food, security at the household level. The scheme of that Act is aimed at providing food grains to those belonging to BPL categories. Like the MGNREGA Act, 2005 takes care of employment. The MGNREGA Act has been enacted for the enhancement, livelihood, security of the households in rural areas of the country. It guarantees at least 100 days of wage employment in every financial year to at least one able member of every household in the rural area on assets creating public work programme. JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 55 Sections 3 and 4 of the MGNREGA Act contain this guarantee. The minimum facilities to be provided are set out by Section 5 read with Schedule II. Section 22 provides for funding pattern and Section 23 provides for transparency and accountability. This Act is another instance of a rights based approach and it enlivens the Fundamental Right to life and personal liberty of Below Poverty Line people in rural areas. The inroads into the privacy rights where these individuals are made to part with their biometric information, is minimal. It is coupled with the fact that there is no data collection on the movements of such individuals, when they avail benefits under Section 7 of the Act thereby ruling out the possibility of creating their profiles. In fact, this technology becomes a vital tool of ensuring good governance in a social welfare state. Therefore, the Aadhaar Act meets the test of balancing as well. Thus, even when two aspects of the fundamental rights of the same individual, which appear to be in conflict with each other, is done, the Aadhaar Act has struck a fair balance between the right of privacy of the individual with right to life of the same individual as a beneficiary. In the face of the all pervading prescript for accomplished socio-economic rights, that need to be given to the deprived and marginalised section of the society, as the constitutional imperative embodied in these provisions of the Act, it is entitled to receive judicial imprimatur. [Para 298, 309, 313][379-G-H; 380-A-D; 390-A-B; 394-G-H; 395-A-B] People’s Union for Civil Liberties (PUCL) & Anr. v. Union of India & Anr. (2003) 4 SCC 399 : [2003] 2 SCR 1136; Subramanian Swamy v. Union of India, Ministry of Law & Ors. (2016) 7 SCC 221 : [2016] 3 SCR 865 – relied on. Government of the Republic of South Africa & Ors. v. Grootboom (2000) ZACC 19; Budina v. Russia App. No. 45603/05 decided on 18.06.2009; Vernonia School District 47J v. Acton et ux., Guardians Ad Litem for Acton 515 US 646 (1995) – referred to. 12. Exclusion: The Authority has claimed that biometric accuracy is 99.76%. Petitioner’s contention was that where more than 110 crores of persons have enrolled themselves, even 0.232% failure would be a phenomenal figure the rate of exclusion A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. is alarming and this would result in depriving needy persons to enjoy their fundamental rights, which is the so-called laudable objective trumpeted by the respondents. The Act is aimed at achieving the public purpose, striving to benefit millions of deserving people. It cannot be invalidated only on the ground that there is a possibility of exclusion of some of the seekers of these welfare schemes. There is also situation where the formation of fingerprints may undergo change for various reasons. Even iris test can fail due to certain reasons including blindness of a person. No person rightfully entitled to the benefits shall be denied the same on such grounds. It would be appropriate if a suitable provision be made in the concerned regulations for establishing an identity by alternate means, in such situations. Furthermore, if there is a 0.232% failure in authentication, it also cannot be said that all these failures were only in those cases where authentication was for the purpose of utilising for the benefit of the welfare schemes, i.e. with reference to Section 7 of the Act. It could have happened in other cases as well. In order to address the failures of authentication, the remedy is to adopt alternate methods for identifying such persons, after finding the causes of failure in their cases. The Government cannot enlarge the scope of subsidies, services and benefits. ‘Benefits’ should be such which are in the nature of welfare schemes for which resources are to be drawn from the Consolidated Fund of India. A benefit which is earned by an individual (e.g. pension by a government employee) cannot be covered under Section 7 of the Act, as it is the right of the individual to receive such benefit. Notifications which are issued under Section 7 of the Aadhaar Act pertain to various welfare schemes under which benefits, subsidies or services are provided to the intending recipients. Moreover, in order to avail the benefits, only one time verification is required except for few services where annual verification is needed. The ‘benefits’ and ‘services’ as mentioned in Section 7 should be those which have the colour of some kind of subsidies etc., namely, welfare schemes of the Government whereby Government is doling out such benefits which are targeted at a particular deprived class. The expenditure thereof has to be drawn from the Consolidated Fund of India. On that basis, CBSE, NEET, JEE, UGC etc. cannot make the requirement of Aadhaar 56 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 57 mandatory as they are outside the purview of Section 7 and are not backed by any law. [Paras 314, 318, 319, 321, 322][395-E-F; 396-F-G; 397-A-D; 398-A-B, D-H; 399-C-D]

13. Children: Article 21A of the Constitution guarantees right to education and makes it fundamental right of the children between 6 years and 14 years of age. Such a right cannot be taken away by imposing requirement of holding Aadhaar card, upon the children. In view thereof, admission of a child in his school cannot be covered under Section 7 of the Aadhaar Act as it is neither subsidy nor service. No doubt, the expression ‘benefit’ occurring in Section 7 is very wide. At the same time, it has to be given restrictive meaning and the admission of children in the schools, when they have fundamental right to education, would not be covered by Section 7. [Paras 324, 325][400-B-C] R.D. Upadhyay v. State of Andhra Pradesh & Ors. (2007) 15 SCC 49 – relied on. Murray v. Big Pictures (UK) Ltd. (2008) 3 WLR 1360 – referred to. 14. Issue of validity of some of the other provisions of the Aadhaar Act.

14.1 Insofar as Section 2(l) read with Regulation 23 of the Aadhaar (Enrolment and Update) Regulations is concerned which deals with ‘enrolling agency’, main challenge is on the ground that the work of an enrolment could not have been given to a private entity as private entity cannot be entrusted with the crucial task of explaining the nature of Aadhaar enrolment and securing informed consent. Further, the task of collection of sensitive personal biometric and demographic data and information for the purpose of storage cannot be given to private hands. However, having regard to the nature of process that has been explained by the Authority, which ensures that immediately on enrolment, the concerned data collected by the private entity is beyond its control; it gets encrypted; and stands transmitted to CIDR, there is no basis of the apprehension expressed by the petitioners. [Para 334][412-B-D]

14.2 Section 3, by the very language thereof, mentions that it is an enabling provision which ‘entitles’ every resident to obtain Aadhaar number. Therefore, it is voluntary in nature. A B C D E F G H 58 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Apprehension of petitioner that section 3 is mandatory stands assuaged. [Para 336][412-F-G; 414-A]

14.3 Section 33 provides for disclosure of information in certain cases. The challenge to this provision is predicated on the ground that it provides for the use of Aadhaar database for police verification which is against the ethos of Article 20(3) of the Constitution which is a rule against self incrimination. Sub- section (2) of Section 33 enables disclosure of information including identity information records in the interest of national security. Disclosure of information in the interest of national security cannot be faulted with. However, giving of such important power in the hands of Joint Secretary may not be appropriate. There has to be a higher ranking officer along with, preferably, a Judicial Officer. The provisions contained in Section 33(2) of the Act to the extent it gives power to Joint Secretary is, therefore, struck down giving liberty to the respondents to suitably enact a provision on the aforesaid lines, which would adequately protect the interest of individuals. [Paras 343, 349][415-G-H; 416-A; 419- G-H; 420-A-B]

14.4 Section 47 provides that the cognizance would be taken only on a complaint made by the Authority or any officer or person authorised by it. Petitioners feel aggrieved by this provision as it does not permit an individual citizen whose rights are violated, to initiate the criminal process. It would be in the fitness of things if Section 47 is amended by allowing individual/victim whose right is violated, to file a complaint and initiate the proceedings. Section 48 cannot be treated as vague or arbitrary. ‘Public Emergency’ is the expression which has been used in several other enactments and held to be constitutional. It can always be subject to scrutiny of the Courts. [Paras 352, 353, 354][420-F-G; 421-F- G] Ex-Armymen’s Protection Services Private Limited v. Union of India & Ors. (2014) 5 SCC 409 : [2014] 3 SCR 359; People’s Union for Civil Liberties (PUCL) v. Union of India & Anr. (1997) 1 SCC 301 : [1996] 10 Suppl. SCR 321 – relied on. Raj Kumar Gupta v. Lt. Governor, Delhi & Ors. (1997) 1 SCC 556 : [1996] 8 Suppl. SCR 464; State (NCT of Delhi) v. Sanjay (2014) 9 SCC 772 : [2014] 9 SCR 1063 – referred to JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 59 R. v. Oakes (1986) 1 SCR 103; Quebec Ass’n of Protestant Sch. Bds. v. Quebec (A.G.), (1984) 2 SCR 66; Vriend v. Alberta (1998) 1 SCR 493; R. v. Zundel (1992) 2 SCR 731; R. v. Big M Drug Mart Ltd. (1985) 1 SCR 295 – referred to. Nicholas Emiliou, The Principle of Proportionality in European Law: A comparative Study 5 (Kluwer Law Int’l. 1996) – referred to.

14.5 Section 59 uses the expression ‘anything done or any action under the resolution’. This terminology used in the provision by the legislature is clearly to cover all actions of the Authority including enrolment of individuals into Aadhaar scheme. The words ‘shall be deemed to have been validly done or taken under this Act’ at the end of the Section put the things beyond any pale of doubt. The legislative intent is clear, namely, to make the provision retrospective so as to cover the actions of the Authority from the date of its establishment. Reading the provision in the manner the petitioners suggest would have the effect of annulling Section 59 itself. Such an interpretation cannot be countenanced. [Para 371][426-F-H; 427-A] West Ramnad Electric Distribution Co., Ltd. v. State of Madras & Anr. [1963] 2 SCR 747 – followed. Bishambhar Nath Kohli & Ors. v. State of Uttar Pradesh & Ors. [1966] 2 SCR 158; State of Mysore & Anr. v. D. Achiah Chetty, Etc.(1969) 1 SCC 248 : [1969] 3 SCR 55; State of Karnataka v. State of Tamil Nadu & Ors. (2017) 3 SCC 362 : [2016] 8 SCR 499 – relied on.

14.6 When the Aadhaar scheme/project under the Act has been saved from the challenge to its constitutionality, there is no reason to invalidate the enrolments which were made prior to the passing of this Act as it would lead to unnecessary burden and exercise of enrolling these persons all over again. Instead the problem can be solved by eliciting ‘consent’ of all those persons who were enrolled prior to the passing of the Act. Since, enrolment is voluntary in nature, those who specifically refuse to give the consent, they would be allowed to exit from Aadhaar scheme. After all, by getting Aadhaar card, an individual so enrolled is A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. getting a form of identity card. It would still be open to such an individual to make use of the said Aadhaar number or not. Those persons who need to avail any subsidy, benefit or service would need Aadhaar in any case. It would not be proper to cancel their Aadhaar cards. If direction is given to invalidate all those enrolments which were made prior to 2016 then such persons will have to undergo the rigours of getting themselves enrolled all over again. On the other hand, those who do not get any benefit of the nature prescribed under Section 7 of the Act, it would always be open for them not to make use of Aadhaar card or to make use of this card in a limited sense, namely, showing it as a proof of their identity, without undergoing any authentication process. Therefore, to a large extent, it does not harm this later category as well. The validity of Section 59 is upheld. As a corollary, Aadhaar for the period from 2009 to 2016 also stands validated. [Para 373][431-A-F]

15. Limited Government, Good Governance, Constitutional Trust and Constitutionalism: The matter is examined keeping in view the fundamental principles of constitutionalism in mind, and more particularly the principle that the concept of ‘limited government’ is applicable having regard to the fact that the three limbs of the State are to act within the framework of a written Constitution which assigns specific powers to each of the wing of the State and this presupposes that the sovereign power of the Parliament is circumscribed by the provisions of the Constitution and the legislature is supposed to Act within the boundaries delineated by the Constitution. The constitutionalism, which is the bedrock of rule of law, is to be necessarily adhered to by the Parliament. Further, the power of judicial review which is accorded to the courts can be exercised to strike down any legislation or executive action if it is unconstitutional. It is difficult to agree with the sweeping proposition advanced by the petitioners that the Aadhaar project is destructive of limited government and constitutional trust. [Paras 387, 388][443-D-G] Kesavananda Bharati v. State of Kerala (1973) 4 SCC 225 : [1973] Suppl. SCR 1 – followed. 60 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 61 State of M.P. v. Thakur Bharat Singh (1967) 2 SCR 454; Gobind v. State of M.P. (1975) 2 SCC 148 : [1975] 3 SCR 946; S.P. Sampath Kumar v. Union of India (1987) 1 SCC 124 : [1987] 1 SCR 435; Sub-Committee on Judicial Accountability v. Union of India (1991) 4 SCC 699; I.R. Coelho v. State of T.N. (2007) 2 SCC 1 : [2007] 1 SCR 706; Nandini Sundar v. State of Chhattisgarh (2011) 7 SCC 547 : [2011] 8 SCR 1028; Minerva Mills Ltd. v. Union of India (1980) 3 SCC 625 : [1981] 1 SCR 206; Manoj Narula v. Union of India (2014) 9 SCC 1 : [2014] 9 SCR 965; Government of NCT of Delhi v. Union of India (2018) SCC Online SC 661 – referred to. Divan quotes Seervai in his book Constitutional Law of India; H.M. Seervai, Constitutional Law of India: A Critical Commentary (N.M. Tripathi Private Limited, Bombay, 4th Ed., Vol. 2, 1993) at pages 1928-1937 – referred to. 16. Money Bill: Is the Aadhaar Act a validly enacted law having been passed as a Money Bill?

16.1 Section 23(2)(h) enables the Authority to specify the manner of use of Aadhaar with specific purpose in mind, namely, for providing or availing of various subsidies, benefits and services. These are relatable to Section 7. However, it uses the expression ‘other purposes’ as well. The expression ‘other purposes’ can be read ejusdem generis which would have its relation to subsidies, benefits and services as mentioned in Section 7 and it can be confined only to that purpose i.e. scheme of targeted delivery for giving any grant, relief etc. when it is chargeable to Consolidated Fund of India. Therefore, this provision, can be read as incidental to the main provision and would be covered by Article 110(g) of the Constitution. [Para 410][464-B-D]

16.2 Section 54 confers power upon the Authority to make regulations consistent with the Act and rules made thereunder, for carrying out the provisions of the Act. The interpretation given to Section 23(2)(h) would apply to Section 54(2)(m) as well and, therefore, there is no problem with this provision also. Now A B C D E F G H 62 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Section 57 of the Aadhaar Act mentions that Aadhaar Act would not prevent use of Aadhaar number for other purposes under the law. It is only an enabling provision as it permits the use of Aadhaar number for other purposes as well. This provision is to be viewed in the backdrop that Section 7 is the core provision. It has substantial nexus with the appropriation of funds from the Consolidated Fund of India and is directly connected with Article 110 of the Constitution. To facilitate this, UIDAI is established as Authority under the Act which performs various functions including that of a regulator needing funds for staff salary and it’s own expenses. The Authority is the performer in chief, the predominant dramatis personae. It appoints Registrars, enrollers, REs and ASAs; it lays down device and software specifications, and develops softwares too; it enrols; it de-duplicates; it establishes CIDR and manages it; it authenticates; it inspects; it prosecutes; it imposes disincentives; etc. And all this it does based on funds obtained by appropriations from Consolidated Fund of India (Section 24). [Paras 410, 411][464-D-E, F-H; 465-A-B] Kuldip Nayar & Ors. v. Union of India & Ors. (2006) 7 SCC 1 : [2006] 5 Suppl. SCR 1 – relied on. Hari Ram & Ors. v. Babu Gokul Prasad (1991) Supp. 2 SCC 608; M/s. Saru Smelting (P) Ltd. v. Commissioner of Sales Tax, Lucknow (1993) Supp. 3 SCC 97 : [1993] 3 SCR 719; S.R. Bommai & Ors. v. Union of India & Ors. (1994) 3 SCC 1 : [1994] 2 SCR 644; Raja Ram Pal v. Hon’ble Speaker, Lok Sabha & Ors. (2007) 3 SCC 184 : [2007] 1 SCR 317; Kihoto Hollohan v. Zachillhu & Ors. (1992) Supp. 2 SCC 651 : [1992] 1 SCR 686; Mohd. Saeed Siddiqui v. State of Uttar Pradesh & Anr. (2014) 11 SCC 415; Yogendra Kumar Jaiswal & Ors. v. State of Bihar & Ors. (2016) 3 SCC 183; Mangalore Ganesh Beedi Works v. State of Mysore & Anr., [1963] Supp 1 SCR 275; Ramdas Athawale v. Union of India & Ors., (2010) 4 SCC 1 : [2010] 3 SCR 1059; M.S.M. Sharma v. Dr. Shree Krishna Sinha & Ors., AIR 1960 SC 1186; Patna Zilla Truck Owners Association & Ors. v. State of Bihar & Ors. AIR 1963 Pat 16; State of Punjab v. Sat Pal Dang & Ors. [1969] 1 SCR 478; A.S. Krishna v. State of Madras, (1957) JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 63 SCR 399; Union of India & Ors. v. Shah Goverdhan L. Kabra Teachers’ College, (2002) 8 SCC 228 : [2002] 3 Suppl. SCR 220; P.N. Krishna Lal & Ors. v. Government of Kerala & Anr., (1995) Supp 2 SCC 187 : [1994] 5 Suppl. SCR 526 – referred to. 16.3 Section 57 only enables holder of Aadhaar number to use the said number for other purposes as well. That would not take away or dilute the sheen of clause 7 (now Section 7) for which purposes the Bill was introduced as Money Bill. In any case, a part of Section 57 has already declared unconstitutional whereby even a body corporate in private sector or person may seek authentication from the Authority for establishing the identity of an individual. For all the said reasons, Bill was rightly introduced as Money Bill. Main provision is a part of Money Bill and other are only incidental and, therefore, covered by clause (g) of Article 110 of the Constitution. [Para 412][465-C-D, E] 17. Section 139AA of the Income Tax Act, 1961 The Constitution Bench in K. S. Puttaswamy laid down the triple test which need to be satisfied for judging the permissible limits for invasion of privacy while testing the validity of any legislation. In the instant case, there is no dispute that first requirement stands satisfied as Section 139AA is a statutory provision and, there is backing of law. Insofar as requirement of ‘legitimate State interest’ is concerned, Section 139AA is enacted to link PAN number with Aadhaar number which is issued under the Act for the purpose of eliminating duplicate PANs from the system with the help of robust technology solution. Therefore, those who have PAN number and have already provided the information required to get PAN number cannot claim to have any legitimate expectation of withholding any data required for Aadhaar under the ground of privacy. Also, there was justifiable reason with the State for collection and storage of data in the form of Aadhaar and linking it with PAN insofar as Section 139AA of the 1961 Act is concerned. The provisions of Section 139AA of the Income Tax Act, 1961 meet the triple test of right to privacy, contained in K.S. Puttaswamy. [Paras 417, 418, 420, 424, 425][467- F, G; 468-E-F; 477-C-D; 479-D] A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R.

18. Prevention of Money Laundering Rules:

18.1 Challenge to amendment to Rule 9 of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005. As per Rule 9, linking of Aadhaar with bank account is made compulsory not only for opening a new bank account but even for existing bank accounts with a stipulation that if the same is not done then the account would be deactivated, with the result that the holder of the account would not be entitled to operate the bank account till the time seeding of the bank account with Aadhaar is done. This amounts to depriving a person of his property. This move of mandatory linking of Aadhaar with bank account does not satisfy the test of proportionality. The test of proportionality requires that a limitation of the fundamental rights must satisfy the following to be proportionate: (i) it is designated for a proper purpose; (ii) measures are undertaken to effectuate the limitation are rationally connected to the fulfilment of the purpose; (iii) there are no alternative less invasive measures; and (iv) there is a proper relation between the importance of achieving the aim and the importance of limiting the right. [Para 433][487-D-F]

18.2 The Rules are disproportionate for the following reasons: (a) a mere ritualistic incantation of “money laundering”, “black money” does not satisfy the first test; (b) no explanations have been given as to how mandatory linking of every bank account will eradicate/reduce the problems of “money laundering” and “black money”; (c)there are alternative methods of KYC which the banks are already undertaking, the state has not discharged its burden as to why linking of Aadhaar is imperative. [Para 434][487-G-H; 488-A-B] Ram Jethmalani & Ors. v. Union of India & Ors. (2011) 8 SCC 1 : [2011] 8 SCR 725; Lal Babu Hussein v. Electoral Registration Officer and Others (1995) 3 SCC 100 : [1995] 1 SCR 877 – relied on.

18.3 There may be legitimate State aim for such a move as it aims at prevention of money laundering and black money. However, there has not been a serious thinking while making 64 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 65 such a provision applicable for every bank account. Maintaining back account in today’s world has almost become a necessity. The Government itself has propagated the advantages thereof and is encouraging people to open the bank account making it possible to have one even with Zero Balance under the Pradhan Mantri Jan Dhan Yojana. The Government has taken various measures to give a boost to digital economy. Under these schemes, millions of persons, who are otherwise poor, are opening their bank accounts. They are also becoming habitual to the good practice of entering into transactions through their banks and even by using digital modes for operation of the bank accounts. Making the requirement of Aadhaar compulsory for all such and other persons in the name of checking money laundering or black money is grossly disproportionate. There should have been a proper study about the methods adopted by persons who indulge in money laundering, kinds of bank accounts which such persons maintain and target those bank accounts for the purpose of Aadhaar. It has not been done. Thus the amendment to Rule 9, by the Seventh Amendment Rules, 2017, in the present form, is held to be unconstitutional. [Paras 435, 436][488-B-F]

19. Linking of Mobile Number with Aadhaar By a Circular dated March 23, 2017, the Department of Telecommunications has directed that all licensees shall reverify the existing mobile subscribers (pre-paid and post-paid) through Aadhaar based e-KYC process. In fine, it amounts to mandatory linking of mobile connections with Aadhaar, which requirement is not only in respect of those individuals who would be becoming mobile subscribers, but applies to existing subscribers as well. Not only such a circular lacks backing of a law, it fails to meet the requirement of proportionality as well. It does not meet ‘necessity stage’ and ‘balancing stage’ tests to check the primary menace which is in the mind of the respondent authorities. There can be other appropriate laws and less intrusive alternatives. For the misuse of such SIM cards by a handful of persons, the entire population cannot be subjected to intrusion into their private lives. It also impinges upon the voluntary nature of the Aadhaar scheme. It is disproportionate and unreasonable state compulsion. Every individual/resident subscribing to a SIM card does not A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. enjoy the subsidy benefit or services mentioned in Section 7 of the Act. The Circular dated March 23, 2017 is declared as unconstitutional. [Paras 437, 442][488-G; 491-D-F] Lokniti Foundation v. Union of India & Anr. (2017) 7 SCC 155 – relied on. M.P. Sharma and 4 Others v. Satish Chandra Distt. Magistrate, Delhi and 4 Others [1954] SCR 1077; People’s Union for Civil Liberties (PDS matter) v. Union of India & Ors. (2011) 14 SCC 331; (2010) 5 SCC 318; (2010) 13 SCC 45; State of Kerala & Ors. v. President, Parent Teachers Association SNVUP School and Ors. (2013) 2 SCC 705 : [2013] 4 SCR 66 – referred to. Per Ashok Bhushan, J.

1. Whether requirement under the Aadhaar Act to give one’s biometric and demographic information is violative of fundamental right of privacy.

1.1 Requirement under the Aadhaar Act to give one’s demographic information

1.1.1 The demographic information includes information relating to the name, date of birth, address and other relevant information of an individual, as may be specified by regulations for the purpose of issuing an Aadhaar number. There is also injunction in Section 2(k) that demographic information shall not include race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Thus, demographic information which are contemplated to be given in the Act are very limited information. The Regulations have been framed under Act, namely, Aadhaar (Enrolment and Update) Regulations, 2016. A perusal of Regulation 4 indicates that information which shall be collected from individual are his name, date of birth, gender and residential address. The additional information which can be collected at the option of the individual is mobile number and e- mail address. The information contemplated under Regulation 4 are nothing but information relating to identity of the person. [Paras 112, 113, 114][562-D-E; 563-E-F] 66 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 67

1.1.2 Every person born on earth takes birth at a place at a time with a parentage. The identity of person from the time of taking birth is an identity well known and generally every person describes himself or herself to be son or daughter of such and such person. Hence, it can be safely said that there cannot be a reasonable expectation of privacy with regard to such information. An individual in interaction with society or while interacting with his close relatives naturally gives and reveals his several information e.g. his name, age, date of birth, residential address, etc. In giving of those information there is no reasonable expectation of privacy. Thus, demographic information required to be given in the process of enrolment does not violate any right of privacy. The right to identity is an essential component of an individual in her relationship with the State. Aadhaar is contemplated as one PAN INDIA identity, which is acceptable proof of identity in every nook and corner of the country. There is no expectation of right of privacy with regard to gender. This right having been clearly recognised by this Court, expression of those rights of self-identification cannot, in any manner, be said to affect their right to privacy. With regard to transgenders also no right of privacy is breached in giving the demographic information. In so far as biometric information, ample justification has been found which satisfied the three fold test as laid down in Puttaswamy case, which is equally applicable to transgender also. [Paras 115, 116, 121, 123, 129][563-G; 564-B-C; 567-F; 568-A- B; 571-C-D] M.P. Sharma & Others v. Satish Chandra & Others 1954 AIR SC 300 : [1954] SCR 1077; Kharak Singh v. State of U.P. & Others AIR 1963 SC 1295 : [1964] SCR 332; National Legal Services Authority and Union of India and others (2014) 5 SCC 438 – referred to. Alan F. Westin in his work “Privacy and Freedom”; Regina (Wood) v. Commissioner of Police of the Metropolis (2009) EWCA Civ 414: [2010] 1 WLR 123; Katz v. United States 389 US 347 (1967); United States v. Antonio Dionisio 35 L.Ed. 2D 67; Otis R. Bowen, Secretary of Health and Human Services, et al. v. Stephen J. Roy et al., 476 U.S. 693 (1986); Doris McElrath v. Joseph A. Califano – referred to. A B C D E F G H 68 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R.

1.2 Whether obtaining biometric information in context of enrolment – breaches the right of privacy of individual or not?

1.2.1 The biometric information as referred to in Section 2(g) is required to be given in the process of enrolment by a person. Biometric information means photographs, fingerprints, iris scan and other such biometric attributes of an individual as may be specified by the regulations. Biometric information is of physical characteristics of a person. A person has full bodily autonomy and any intrusion in the bodily autonomy of a person can be readily accepted as breach of his privacy. The biometric data as referred to in Section 2(g) may contain biological attributes of an individual with regard to which a person can very well claim a reasonable expectation of privacy but whether privacy rights have been breached or not needs to be examined in the subject context under which the informations were obtained. [Paras 130, 134][571-E; 574-D-E]

1.2.2 The provisions of Aadhaar Act are to be tested in light of three-fold test as have been laid in Puttaswamy case. The First requirement to be fulfilled is existence of law. Admittedly, Aadhaar Act is a Parliamentary law, hence the existence of law is satisfied. Mere existence of law may not be sufficient unless the law is fair and reasonable. The Aadhaar Act has been enacted with an object of providing Aadhaar number to individuals for identifying an individual for delivery of benefits, subsidies and services. Several materials on the record reflect that in the several studies initiated by the Government as well as the World Bank and Planning Commission, it was revealed that food grains released by the Government for the beneficiaries did not reach the intended beneficiaries due to the failure to establish identity. The Law, i.e., Aadhaar Act, which has been brought to provide for unique identity for delivery of subsidies, benefits or services was a dire necessity, which decision was arrived at after several reports and studies. Aadhaar Act was, thus, enacted for a legitimate State aim and fulfills the criteria of a law being fair and reasonable. As regards the third test, i.e., test of proportionality, it has to be kept in mind that the state is neither arbitrary nor of an excessive nature beyond what is required in the interest of public. The object of the Aadhaar Act was to provide for unique identity for purposes of delivery of benefits, subsidies and services JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 69 to the eligible beneficiaries and to ward of misappropriation of benefits and subsidies, ward of deprivation of eligible beneficiaries. Biometric information which is to be obtained for enrolment are not disproportionate nor the provisions of Aadhaar Act requiring demographic and biometric information can be said to be not passing three-fold test as laid down in Puttaswamy case. [Paras 137, 138, 142, 143, 145][575-F-H; 576-E; 578-E-F; 580-B-D; 581- G-H; 582-A-B]

2. Collection, storage, retention, use, sharing and surveillance.

2.1 Whether collection of data of residents, its storage, retention and use violates fundamental right of privacy?

2.1.1 The Aadhaar Act provides complete architecture beginning with enrolment. The enrolment means process to collect demographic and biometric information from individuals by enroling agencies. The enroling agencies have to set up enrolment centers and have to function in accordance with the procedure specified by UIDAI. Section 8 contemplates for authentication for Aadhaar number which authentication was done by authority. When a request is made for identification by any requesting entity in respect to biometric or demographic information of aadhaar number holder, the authority may engage one or more entities to establish and maintain Central Identity Data Repository (CIDR). Section 28 provides for the security and confidentiality of information. Section 29 provides for not sharing information collected or created under this Act. Section 30 itself contemplates that biometric information are sensitive personal data or information. There are strict conditions envisaged in Section 33 for disclosure of information. Chapter VII of the Act deals with the offences and penalties for impersonation at the time of enrolment penalty for disclosing identity information is provided under Sections 34 to 37. [Paras 146, 147, 148, 149][582-D-F; 583-G-H; 584-E, F-G]

2.1.2 Various modes of authentication are provided in Regulation 4 of Authentication Regulations 2016, which are: Demographic authentification; One time pin-based authentication; and Multi-factor Biometric-based authentif ication A B C D E F G H 70 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. authentification. A requesting entity may choose suitable mode of authentication for particular function or business function as per its requirement. The Aadhaar (Data Security) Regulations, 2016 contain detail provisions to ensuring data security. Regulation 3 deals with measures for ensuring information security. Regulation 5 provides security obligations of the agencies, consultants, advisors and other service providers engaged by the Authority for discharging any function relating to its processes. The Aadhaar (Sharing of Information) Regulations, 2016 also contain provisions providing for restrictions on sharing identity information. Sub-Regulation (1) of Regulation 3 provides that core biometric information collected by the Authority under the Act shall not be shared with anyone for any reason whatsoever. Sharing of Information Regulations, 2016 also contain various other restrictions. The scheme of the Aadhaar Act indicates that all parts of the entire process beginning from enrolment of a resident for allocation of Aadhaar number are statutory regulated. The Authentication Regulations, 2016 also limit the period for retention of logs by requesting entity. [Paras 153, 156-160] [586- E; 587-B-E; 588-B-C]

2.1.3 The residents’ information in CIDR are also permitted to be updated as per provisions of the Aadhaar (Enrolment and Update) Regulations, 2016. An over view of the entire scheme of functions under the Aadhaar Act and Regulations made thereunder indicate that after enrolment of resident, his informations including biometric information are retained in CIDR though in encrypted form. The major function of the authority under Aadhaar Act is authentication of identity of Aadhaar number holder as and when requests are made by requesting agency, retention of authentication data of requesting agencies are retained for limited period. There are ample safeguards for security and data privacy in the mechanism. [Para 161][588-G-H; 589-A]

2.1.4 The preponderance of authorities of different countries on the subject of retention of data is that retention of personal data effecting personal life of an individual may interfere in his right of privacy and the State can justify its retention subject to proportionality and subject to there being sufficient safeguards to personal information is not retained for longer than is required. JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 71 Reverting back to the Aadhaar Act, it is clear that requesting entity as well as authority are required to retain authentication data for a particular period and thereafter it will be archived for five years and thereafter authentication data transaction shall be deleted except such data which is required by the Court in connection with any pending dispute. The data which is retained by the entity and authority for certain period is minimal information pertaining to identity authentication only no other personal data is retained. Thus, provisions of Aadhaar Act and Regulations made thereunder fulfill three fold test as laid down in Puttaswamy case, hence, the storage and retention of data does not violate fundamental right of privacy. [Paras 180, 181][595-C- F] G. Sundarrajan v. Union of India and Others (2013) 6 SCC 620 : [2013] 8 SCR 631 – relied on. AB v. Her Majesty’s Advocate [2017] UK SC 25; Madhewoo v. State of Mauritius – referred to. 3. Whether Section 7 of Aadhaar Act is unconstitutional? Whether right to food, shelter etc. envisaged under Article 21 shall take precedence on the right to privacy of the beneficiaries? 3.1 Article 38 provides that State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. It further provided that the State shall, in particular, strive to minimise the inequalities in income, and endeavour to eliminate inequalities in status, facilities and opportunities, not only amongst individuals but also amongst groups of people residing in different areas or engaged in different vocations. After enforcement of the Constitution almost all the Governments worked towards the object of elimination of poverty and to empower marginal/poor section of the society. The endeavour of the Government was always to frame policies keeping in view the “little Indian” who is in the centre of all policies and governance. [Paras 200, 201][604-A-C]

3.2 Section 7 is an enabling provision which empowers the State Government to require that such individual undergo authentication for receipt of a subsidy, benefit or service but A B C D E F G H 72 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. neither Section 7 nor orders issued by the Central Government and State Government can be read that in the event authentication of a person or beneficiary fails, he is not to be provided the subsidies and benefits or services. The provision is couched as an enabling provision but it cannot be read as a provision to negate giving subsidies, benefits or services in the event of failure of authentication. Circular dated 24.10.2017 which fills a gap and is a direction facilitating delivery of benefits and subsidies does not breach by provisions of the Act. [Para 219][611-G-H; 612-A-B] Francis Coralie Mullin v. Administrator, Union Territory of Delhi and others (1981) 1 SCC 608 : [1981] 2 SCR 516 – relied on. PUCL v. Union of India (2011) 14 SCC 331; PUCL v. Union of India (2013) 14 SCC 368 – referred to. Otis R. Bowen, Secretary of Health and Human Services, et al. v. Stephen J. Roy et al., 476 US 693 (1986); Buchanan v. Wing 664 N.Y. 2d 865; Doris McElrath v. Joseph A. Califano, Jr., Secretary of Health, Education and Welfare, 615 F.2d 434 – referred to.

3.3 No doubt, there has been denial to few persons due to failure of authentication. There is ample material on record to indicate that prior to enforcement of Aadhaar Scheme there had been large number of denial of benefits and subsidies to real beneficiaries due to several reasons. When such scheme of Government is implemented, it is not uncommon that there may be shortcomings and some denial. There is no material on record to indicate that as compared to non-receipt of eligible beneficiaries prior to enforcement of the Act, there is increase of failure after the implementation of the Act. It cannot be accepted that few cases of exclusion as pointed out by the petitioners makes Section 7 itself arbitrary and violative of Articles 14 and 21. The respondents are still ready to take remedial measures to ensure that there is no denial of subsidies to deserving persons. [Para 220][612-C-F] State of Uttar Pradesh and Another v. Zila Parishad, Ghaziabad and Another (2013) 11 SCC 783; Ex. Armymen’s Protection Services P. Ltd. v. Union of India JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 73 (UOI) and Ors., (2014) 5 SCC 409 : [2014] 3 SCR 359 – referred to.

3.4 Whether Aadhaar scheme and its authentication for benefits, subsidies and services militate against Article 243G and hence are ultra vires to the Constitution? Article 243G is an enabling provision, which enable the State Legislature, by law, to endow the Panchayats with such powers and authorities as may be necessary to enable them to function as institutions of self-government. State is fully competent to make laws to authorise the Panchayats to take over all the matters enumerated in Eleventh Schedule. The Aadhaar Act is an Act enacted by Parliament, which is referable to Entry 97 of List I. The Aadhaar Act has been enacted to provide for efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith. The Act, thus, has been enacted to regulate the expenditure, which is incurred from the Consolidated Fund of India. No conflict between the Aadhaar Act and any law, which may be enacted by State under List II is seen. Even if any conflict is supposed, the Doctrine of Pith and Substance has to be applied to find out nature of two legislations. In Pith and Substance, the Aadhaar Act cannot be said to be entrenching upon any law, which may be made by the State under Item No.5 of List II. Aadhaar Act is not ultra vires to Article 243G and Eleventh Schedule to the Constitution. [Paras 230, 231][618-D-G; 620-F-G]

4. Whether Section 29 of the Aadhaar Act is liable to be struck down?

4.1 The ground to challenge Section 29 is that it permits sharing of identity information which amount to breach of Right of Privacy. Section 29 is a provision, which contains restrictions on sharing information as is clear from the heading of the section. Section 29 sub-section (1) contains prohibition on sharing of any core biometric information collected or created under this Act. Sub-section (2) permits sharing of identity information, other than core biometric information, only in accordance with the provisions A B C D E F G H 74 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. of this Act and in such manner as may be specified by regulations. Further sub-section (3) prohibits requesting entity to use identity information for any purpose other than that specified to the individual or to disclose any information without the consent of individual. Sub-section (4) provides that no Aadhaar number or core biometric information shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations. The attack on Section 29 that it permits sharing of information is thus wholly misconceived. When a person consents about sharing of his identity information, he cannot complain breach of Privacy Right. When an Act or Regulation regulates and controls sharing of the information, the provision is regulatory and has been engrafted to protect individual’s Privacy Right. [Paras 234-235][622-B-C; 623-A-E]

4.2 The provision under Section 29 which permits sharing of identity information except core biometric information in accordance with the Act and Regulations cannot be said to be disproportionate nor unreasonable. Legislature can very well enumerates circumstances and conditions where sharing of information becomes necessary. One of the circumstances where sharing of the information is specifically engrafted in sub- section(2) of Section 33, which provides that nothing contained in sub-section (3) of Section 29 shall apply in respect of any disclosure of information, including identity information or authentication records, made in the interest of national security in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government of India. Thus, the circumstances which can contemplate for sharing information is reasonable and proportionate. The provisions of Section 29 is constitutional and does not deserves to be struck down. [Para 236][623-G-H; 624-A-B]

5. Whether Section 33 is constitutional ?

5.1 It is not correct to say that Section 33 is unconstitutional since it provides for the use of the Aadhaar data base for Police verification which violates the protection against self- incrimination as enshrined under Article 20(3) of the Constitution of India. Sub-section (1) of Section 33 contains an ample restriction in respect of any disclosure information which can be done only JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 75 in pursuance of an order of the court not inferior to that of a District Judge. The restriction in disclosure of information is reasonable and has valid justification. The authority whose duty is to safeguard the entire data has to be heard before passing an order by the court which amply protects the interest of a person whose data is to be disclosed. [Paras 238, 239][625-B-D]

5.2 Section 33 sub-section (2) contains two safeguards. Firstly, disclosure of information is to be made in the interest of national security and secondly, in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government, who is specially authorised in this behalf by an order of the Central Government. National security, thus, has to be determined by a higher officer who is specifically authorised in this behalf. The power given under Section 33 to disclose information cannot be said to be disproportionate. The disclosure of information in the circumstances mentioned in Section 33 is reasonable and in the public interest. Section 33 is constitutional. [Paras 240, 245, 248][625-F; 628-B-C; 630-A-B] State of Bombay v. Kathi Kalu Oghad AIR 1961 SC 1808 : [1962] SCR 10 – relied on. Selvi and others v. State of Karnataka 2010(7) SCC 263 : [2010] 5 SCR 381 – held inapplicable.

6. Whether Section 47 of the Aadhaar Act unconstitutional? Special Acts are enacted for serving special objects towards offences under the Act. The initiation and prosecution of offences under the Special Act are kept by the specified authority to keep the initiation and prosecution in the hands of the authorities under the Special Act which acts as deterrent and prosecutions are brought to its logical end. The objective of such provisions is to discourage frivolous and vexatious complaints. Section 47 can be invoked by the authority on its own motion or when it receives a complaint from a victim. The authority i.e. UIDAI has varied powers and functions as enumerated in Section 23 of the Act. It is the authority who is most entrusted in ensuring that the provisions of the Act are implemented in accordance with the Act and offenders should be punished. With regard to an offence A B C D E F G H 76 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. which falls within the definition of ‘offences’ a victim can always file complaint or lodge an F.I.R. Section 46 of the Aadhaar Act clearly provides that the penalties under the Aadhaar Act shall not interfere with other punishments. The limitation as contained in Section 47 in permitting taking cognizance of any offence punishable under Aadhaar Act only on a complaint made by the authority or any officer or person authorised by it, has legislative purpose and objective. Thus, there is no unconstitutionality in Section 47 of the Aadhaar Act. [Paras 256, 258, 261, 263][635-C- D; 636-A-B; 637-B-C; 638-C-D] State (NCT of Delhi) v. Sanjay (2014) 9 SCC 772 : [2014] 9 SCR 1063 – relied on. Rajkumar Gupta v. Lt.Governor, Delhi and Others, (1997) 1 SCC 556 : [1962] SCR 10 – referred to.

7. Whether Section 57 of Aadhaar Act is unconstitutional?

7.1 In the three-fold test evolved in Puttaswamy case, proportionality is the third component which ensures that the means which are adopted by the legislature are proportional to the object and needs sought to be fulfilled by the law. Proportionality is an essential facet of the guarantee against arbitrary state action because it ensures that the nature and quality of the encroachment on the right is not disproportionate to the purpose of the law. [Paras 273, 274][643-G; 644-G] Modern Dental College and Research Centre and Others v. State of Madhya Pradesh and Others (2016) 7 SCC 353; Teri Oat Estates (P) Ltd. v. U.T. Chandigarh and Others (2004) 2 SCC 130 : [2003] 6 Suppl. SCR 1235; State of Madras v. V.G. Row AIR 1952 SC 196 : [1952] SCR 597; Om Kumar and Others v. Union of India (2001) 2 SCC 386 : [2000] 4 Suppl. SCR 693 – relied on. R v. Oakes (1986) 26 DLR 2001; John Davis v. State of Mississippi 394 US 721 (1969); United States v. Antoine Jones 132 S.Ct. 945 (2012); S. and Marper v. The United Kingdom 2008 (48) EHRR 50; Regina (Catt) v. Association of Chief Police Officers of England, Wales and Northern Ireland and another JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 77 (2015) 2 WLR 664 – (2015) UKSC 9; United States v. Antoine Jones 132 S.Ct. 945 (2012); Roman Zakharov v. Russia; Digital Rights Ireland Ltd. v. Minister for Communications [2015] QBECJ 127; Tele2 Sverige AB v. Post-och telesyrelsen; Vernonia School District v. Wayne Acton 515 US 646, 132 L.Ed. 2D 564; Board of Education of Independent School District v. Lindsay Earls 536 US 822=153 L.Ed.2d. 735; Michael Schwarz v. Stadt Bochum in its judgment dated 17.10.2013 – referred to.

7.2 Whether least intrusive test cannot be applied to judge the proportionality of Aadhaar Act? There are several reasons due to which least intrusive test cannot be insisted. For applying the least intrusive test, the Court has to enter comparative analysis of all methods of identification available, which need to be examined with their details and compared. Court has to arrive at finding as to which mode of identity is a least intrusive. Comparison of several modes of identity and to come to a decision, which is least intrusive is a matter, which may be better left to the experts to examine. Further, there are no proper pleadings and material with regard to other modes of identification, which could have been adopted by the State, to come to a definite conclusion by this Court. Section 57 begins with the phrase “nothing contained in this Act shall prevent the use of Aadhaar number.....” for establishing the identity of an individual for any purpose. Section 57 reveals following concepts and ideas, which can be para phrased in following manner:- (a) Nothing contained in this Act shall prevent the use of Aadhaar number for identifying the identity of an individual for any purpose. (b) Whether by the State or body corporate or private person. (c) Pursuant to any law, for the time being in force or any contract to this effect. [Paras 280, 281][647-G-H; 648-A-B, C-E]

7.3 The basic theme of the Aadhaar Act to implement the Aadhaar programme was for purposes of disbursement of subsidies, benefits or services to individuals entitled for the same. By various notifications issued under Section 7, the Government has made applicable Aadhaar authentication for large number of schemes namely 133 in number. The idea behind Section 57 is A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. that Aadhaar is liberated from the four corners of the Act and it may not be confined to use under Section 7 alone. The Act does not prohibit the use of Aadhaar for any other purpose. The law providing for use of Aadhaar for any purpose should be rational and proportional. There has to be some object to be achieved by use of Aadhaar, in a particular case, the legislature has ample power to provide for legislative scheme by an enactment making use of Aadhaar and use of Aadhaar has to be backed by a valid law. In event, it is accepted on the strength of Section 57 that a State or body corporate or person, on the basis of any contract to this effect, are permitted to use Aadhaar it shall be wholly unguided and uncontrolled, which is prone to violate the right of privacy. Section 57 makes use of Aadhaar on two basis. Firstly, “pursuant to any law, for the time being in force” and secondly “any contract to this effect”. When the legislature uses the phrase “pursuant to any law, for the time being in force”, obviously the word law used in Section 57 is a law other than Section 57 of Aadhaar Act, 2016 and the Regulations framed thereunder. When any law permits user of Aadhaar, its validity is to be tested on the anvil of three-fold test as laid down in Puttaswamy case, but permitting use of Aadhaar on any contract to this effect, is clearly in violation of Right of Privacy. A contract entered between two parties, even if one party is a State, cannot be said to be a law. Thus, Section 57 in so far as it permits use of Aadhaar on “any contract to this effect” is clearly unconstitutional and deserves to be struck down. Section 57 has to be read only to mean that it clarifies that nothing contained in Aadhaar Act shall prevent the use of Aadhaar for establishing the identity of an individual for any purpose, in pursuant to any law. Section 57 itself is not a law, which may permit use of Aadhaar for any purpose. There has to be a valid law in existence, which should also pass the three-fold test as laid down in Puttaswamy case for making provision for use of Aadhaar. Section 57, to the extent, which permits use of Aadhaar by the State or any body corporate or person, in pursuant to any contract to this effect is unconstitutional and void. Thus, the last phrase in main provision of Section 57, i.e. “or any contract to this effect” is struck down. [Para 282, 283, 284][648-E-H; 649- A-G] 78 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 79

8. Whether Section 59 is void or unconstitutional? A

8.1 The expression ‘anything done or any action under the Resolution’ is wide enough to cover all the actions which UIDAI executed as Department of Central Government. Section 59 seeks to save and continue under the said Act what was done under the executive scheme. The submission that breach of fundamental right cannot be retrospectively cured is incorrect. The last phrase of Section 59 uses the expression “shall be deemed”, this expression clearly indicates creation of fiction with the object of providing legislative support to the action taken before the Act. That seeks to continue the entire architecture of Aadhaar which established under the Government Resolution dated 28.01.2009. As a result of deeming provision all the actions under the said scheme shall be deemed to have been done under the Act and not under the said notification. [Para 287][650-G-H; 651-A-B] M/s. West Ramnad Electric Distribution Co. Ltd. v. The State of Madras and another AIR 1962 SC 1753 : [1963] SCR 747 – relied on.

8.2 A statute creates a legal fiction to achieve a legislative purpose. Legislature has often created legal fiction to save several actions which had happened prior to enactment. Parliamentary legislative intent of Section 59 is to save all actions taken by Central Government under the notification dated 28.01.2009 and notification dated 12.09.2015 deeming the same to have been validly done under the Aadhaar Act by creating a legal fiction. The intention to save all actions taken under the aforesaid two notifications and treat them to have done under that Act is clear, it is the purpose and object of Section 59. Legislature by legislative device can cover actions taken earlier while creating any legal fiction which has actually been done by Section 59. [Paras 301, 302, 305][657-D, F-G; 661-D-F] Hari Singh and others v. The Military Estate Officer and another (1972) 2 SCC 239 : [1973] 1 SCR 515 – followed. Bishambhar Nath Kohli and others v. State of Uttar Pradesh and others AIR 1966 SC 573 : [1966] SCR B C D E F G H 80 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. 158; Rajahmundry Electric Supply Corporation Ltd. v. State of Andhra Pradesh AIR 1954 SC 251 : [1954] SCR 779; Krishna Chandra Gangopadhyaya and others v. The Union of India and others (1975) 2 SCC 302 : [1975] 0 Suppl. SCR 151; ITW Signode India Ltd. v. Collector of Central Excise (2004) 3 SCC 48 : [2003] 5 Suppl. SCR 751; Nar Bahadur Bhandari and another v. State of Sikkim and others (1998) 5 SCC 39 : [1998] 3 SCR 421; The State of Mysore and another v. d. Achiah Chetty, Etc. (1969) 1 SCC 248 : [1969] 3 SCR 55; State of Karnataka v. State of Tamil Nadu and others (2017) 3 SCC 362 : [2016] 8 SCR 499 – relied on. East End Dwelling Co.Ltd. And Finsury Borough Council 1952 AC 109 – referred to.

9. Whether Collecting the identity information of children between 5 to 18 years is unconstitutional? Section 5 of the Act provides that the Authority shall take special measures to issue Aadhaar number to women, children, senior citizens, persons with disability, unskilled and unorganised workers, nomadic tribes or to such other persons who do not have any permanent dwelling house and such other categories of individuals as may be specified by regulations. The Aadhaar (Enrolment and Update) Regulations, 2016 contains some special measures. Regulation 5 provides for information required for enrolment of children below five years of age. For children below five, no core biometric informations are captured and only biometric information of any one parent/guardian is captured. The objection raised by petitioners is with regard to children between 5 to 18 years on the ground that they being minors, parental consent is not taken. For Aadhaar enrolment, for verification of information consent is obtained from the person submitting for enrolment. Thus, the enrolment for Aadhaar number is on consent basis. Although, it is different matter that for the purpose of obtaining any benefit or service, a person is obliged to enrol for Aadhaar. The petitioners are right in their submissions that for enrolment of a children between 5 and 18 years, there has to be consent of their parents or guardian because they themselves JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 81 are unable to give any valid consent for enrolment. Thus, parental consent have to be read in Regulation 4 in so far as children of 5 to 18 years are concerned so that the provision in reference to children between 5 to 18 years may not become unconstitutional. [Paras 307, 308] [662-D-F; 663-D-F]

10. Whether Rule 9 as amended by the Prevention of Money-Laundering (Second Amendment) Rules, 2017 is unconstitutional?

10.1 The PMLA, 2002 has been enacted to prevent money- laundering and to provide for confiscation of property derived from, or involved in, money-laundering and for matters connected therewith or incidental thereto. The siphoning away of huge volumes of money from normal economic growth poses a real danger to the economics and affects the stability of the global market which also empowers corruption organised crime. Proceeds of money-laundering are disguised to acquire properties and other assets or to make investments. It is inherent in the activity of money-laundering to keep the entire process secret. The Parliament with the objectives outlined in the international declaration enacted the PMLA Act. [Paras 309, 311][664-C; 667- D-E]

10.2 A perusal of the Second Amendment Rules, 2017 indicates that the State has sought to make the provisions of PMLA more robust and ensure that the ultimate object of the Act is achieved. Aadhaar Act, 2016 having been enacted with effect from 01.07.2016, it was decided to get the accounts verified by Aadhaar. Amended Rules help all concerned to detect fictitious, ghost and benami accounts. The object of the PMLA and the definition of beneficial owner Act seeks to traverse behind the corporate veil of shell companies and spurious Directors in order to ascertain the real natural persons controlling the accounts in the reporting entities. The Amendment Rules applicable to reporting entities and the legitimate aim sought to be achieved by the State that is conclusive identification of a natural person or the beneficial owner. The statutory rules cast an obligation on all account holders to get their identity verified by Aadhaar mechanism and those who are already holding account in the reporting entity they are required to submit the Aadhaar number or proof of their applied A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Aadhaar identity. The object of inserting the Rule is to make it possible to weed out fake and duplicate PANs and false bank accounts. The Second Amendment Rules are step in direction to cure the menace of fake bank accounts held by the shell companies in the name of dummy directors, money laundering, terror financing etc. Aadhaar number is required to be given at the time of opening of the account based relationship and not for every transaction conducted by an account holder of the bank. Those who have already existing accounts are required to submit only once their Aadhaar number for verification. The requirement of Aadhaar number being given only for once is not any cumbersome or undue burden on an account holder and is a proportionate measure. For non-submission of Aadhaar number and PAN only consequence which is contemplated by sub-rule (c) is that account shall cease to be operational. The account remains belonging to the account holder and the amount in the account is only his amount and there is no deprivation of the property of account holder. Under the banking rules and procedures, there are several circumstances where account becomes un-operational. A non-operational account also is an account which belongs to the account holder and amount laying in the non-operational account is neither forfeited by the bank nor taken out from the said account. Further, account is ceased operational only till the time Aadhaar number and PAN is submitted. The consequences provided is only to effectuate the purpose of the Act and the Rules i.e. account be verified by Aadhaar mechanism. It is not the intent to deprive the account holder of the amount lying in the account. Thus, Rule 9(17)(c) does not violate right under Article 300A. Aadhaar number providing for verification of an account also cannot be held to be violating right under Article 21. The reporting entity i.e. banks and financial institutions under various statutes are required to provide information of a bank account to different authorities including income tax authority, account verification by Aadhaar is not for the purpose of keeping a track on the transaction done by an individual. Aadhaar number has to be given only once for opening of the account or for verification of the account and transactions are not to be made on the basis of Aadhaar verification each time. Rules cannot be held in any manner violating Sections 3, 7 and 51. The rules provide for use 82 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 83 of Aadhaar for verification of bank account by law as contemplated by Section 57 of the Aadhaar Act. Rule 9 as amended by PMLA (Second Amendment) Rules, 2017 is not unconstitutional and does not violate Articles 14, 19(1)(g), 21 & 300A of the Constitution and Sections 3, 7 & 51 of the Aadhaar Act. Further Rule 9 as amended is not ultra vires to PMLA Act, 2002. [Paras 315, 316, 320, 321, 324][677-D-G; 678-A-C, F-H; 679-A-C; 680-A; 681- C-D] Bank Mellat v. Her Majesty’s Treasury (2013) UKSC 39 – referred to.

11. Circular dated 23.03.2017 issued by Ministry of Communications, Department of Telecommunications

11.1 By circular dated 23.03.2017, all licensees were directed to re-verify all existing mobile subscribers (prepaid and postpaid) through Aadhaar based e-kyc process. The circular was addressed by the Ministry of Communications, Department of Telecommunications to all Unified Licensees/Unified Access Service Licensees/Cellular Mobile Telephone Service Licensees with subject: implementation of orders of Supreme Court regarding 100% E-KYC of existing subscribers. The circular directing the licensees to mandatorily verify existing sim subscribers in turn resulted in mobile telephone service licensees directing the subscribers to get their sim seeded with Aadhaar. Repeated messages and directions have been issued by Cellular Mobile Telephone Service operators. Compulsory seeding of Aadhaar with mobile numbers has to be treated to be an intrusion in Privacy Right of a person. Any invasion on the Privacy Right of a person has to be backed by law as per the three-fold test enumerated in Puttaswamy case. Existence of a law is the foremost condition to be fulfilled for restricting any Privacy Right. [Pars 325, 327, 328][681-E-F; 682-C-D; 683-C-E]

11.2 The law as explained in Article 13(3) has to be applied for finding out as to what is law. Article 13(3)(a) gives an inclusive definition of law in following words:- (a) “law” includes any Ordinance, order, bye-law, rule, regulation, notification, custom or usage having in the territory of India the force of law. The circular dated 23.03.2017 at best is only an executive instruction issued on 23.03.2017 by the Ministry of Communications, A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Department of Telecommunications. The circular does not refer to any statutory provision or statutory base for issuing the circular. The recommendations of TRAI are only recommendations and the mere fact that circular dated 23.03.2017 was issued after the recommendation was sent by TRAI, circular dated 23.03.2017 does not acquire any statutory character. Circular dated 23.03.2017 thus cannot be held to be a law within the meaning of Part III of the Constitution. There cannot be any dispute to the right of the Central Government to part with exclusive privilege in favour of any person by granting license on such a condition and in consideration of such terms as it thinks fit. But mere issuing an instruction to the licensees to adopt mandatory process of e-KYC by Aadhaar verification in no manner exalt the instructions or directives as a law. Circular dated 23.03.2017, thus, cannot be held to be a law and direction to re-verification of all existing mobile subscribers through Aadhaar based e-KYC cannot be held to be backed by law, hence cannot be upheld. [Paras 329, 330, 337, 342][683-E-G; 687-A-B; 688-F-G] Bagalkot Cement Co. Ltd. v. R.K. Pathan and Others AIR 1963 SC 439 : [1962] Suppl. SCR 697; Sukhdev Singh and Others v. Bhagatram Sardar Singh Raghuvanshi and Another (1975) 1 SCC 421 : [1975] 3 SCR 619; Lily Kurian v. Sr. Lewina and Others (1979) 2 SCC 124 : [1979] 1 SCR 820; Alpana V. Mehta v. Maharashtra State Board of Secondary Education and Another (1984) 4 SCC 27; St. Johns Teachers Training Institute v. Regional Director, National Council for Teacher Education and Another (2003) 3 SCC 321 : [2003] 1 SCR 975 – held inapplicable. Lokniti Foundation v. Union of India and Another (2017) 7 SCC 155 – distinguished. Union of India and Another v. Association of Unified Telecom Service Providers of India and Others (2011) 10 SCC 543 : [2011] 14 SCR 657 – referred to

12. Whether Aadhaar Act is a Money Bill and decision of Speaker certifying it as Money Bill is not subject to Judicial Review of this Court? 84 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 85

12.1 Article 110(3) gives finality to the decision of the Speaker of the House of the People on question as to whether a Bill is Money Bill or not. The word occurring in sub-article (3) of Article 110 are “shall be final”. Article 122(1) puts an embargo on questioning the validity of any proceeding in the Parliament on the ground of any alleged irregularity or procedure. The Constitution uses different expressions in different articles like “shall be final”, “shall not be questioned”, “shall not be questioned in any Court of Law” etc. The finality attached to the decision of the Speaker under Article 110(3) does not inhibit the Court in exercising its Judicial Review. [Paras 348, 351][691-F- G; 695-B] Kihoto Hollohan v. Zachillhu and Others (1992) Supp. 2 SCC 651 : [1992] 1 SCR 686; Raja Rampal v. Hon’ble Speaker, Lok Sabha and Others (2007) 3 SCC 184 : [2007] 1 SCR 317 – relied on 12.2 All Bills are required to be passed by both Houses of Parliament. Exception is given in case of Money Bills and in the case of joint sitting of both houses. When a Bill does not fulfill the essential constitutional condition under Article 110(1), the said requirement will not evaporate only on certification by Speaker. The decision of Speaker certifying the Bill as Money Bill is not only a matter of procedure and in event, any illegality has occurred in the decision and the decision is clearly in breach of the constitutional provisions, the decision is subject to Judicial Review. [Para 359][704-D-E, F-H] Mohd. Saeed Siddiqui v. State of Uttar Pradesh and Another (2014) 11 SCC 415; Yogendra Kumar Jaiswal and Others v. State of Bihar and Others (2016) 3 SCC 183 – not correct law. 12.3 A condition for receipt of a subsidy, benefit or service for which the expenditure is incurred from, or the receipt therefrom forms part of, the Consolidated Fund of India, has been provided by Section 7, i.e. undergoing of an individual to an authentication. The Preamble of the Act as well as objects and reasons also indicate that the Act has been enacted to provide for, as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India, to A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. individuals residing in India through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto. Thus, the provisions of the Act is clearly covered by Article 110(1)(c) and (e). [Para 361][705-G-H; 706- A-B] Binoy Biswam v. Union of India and others (2017) 7 SCC 59 : [2017] 7 SCR 1 – relied on. 13. Whether Section 139-AA of the Income Tax Act, 1961 is unconstitutional in view of the Privacy judgment in Puttaswamy case?

13.1 Section 139-AA was clearly enacted to fulfill the legitimate State interest. Section 139-A which came into effect w.e.f. 01.04.1989 provide for Permanent Account Number (PAN) and the provision also provided that statutory mandatory provisions as to when “every person” shall quote such number (PAN number) for various purposes as enumerated in Section 139A. Introduction of Section 139-AA is an extension and implication of Section 139A. The new Section 139-AA in the Income Tax Act seeks to remove bogus PAN cards by linking with Aadhaar, expose shell companies and thereby curb the menace of black money, money laundering and tax evasion. Linking of PAN with Aadhaar will ensure that duplicate and fake PAN cards which are used for the purpose of tax evasion will be eliminated and is one of the many fiscal measures to eliminate black money from the system. Section 139-AA also cannot be said to be disproportionate. The section has been enacted to achieve the legitimate State aim. The means which are sought to be achieved by such enactment cannot be said to be disproportionate in any manner. Section 139-AA is a required first step to weed out fake PANs for individuals; it is perfectly acceptable for the legislature to weed out fake PANs for other tax-paying entities at a later stage.[Paras 373, 374, 375][715-C, D-E, F, H; 716-A-B] Shayara Bano v. Union of India (2017) 9 SCC 1 : [2017] 7 SCR 797; Namit Sharma v. Union of India (2013) 1 SCC 745 : [2013] 13 SCR 1 – relied on. 13.3 Section 139-AA targets only individual assessees and not every other tax-paying entity. The law does not have to 86 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 87 provide for complete coverage of tax-payers who may be indulging in financial fraud but may envisage ‘degrees of harm’ and act on that basis. In this context, the Aadhaar number is being mandated for all individual assessees. This is applicable to natural persons as well as persons who together constitute legal persons (e.g. Partners in a partnership, members of a company etc.) and hence provides significant coverage to weed out duplicate PANs and hence reduce the incidence of financial and tax frauds through these means. Aadhaar’s inclusion into PAN is meant to curb tax evasion, sham transactions, entry providers which are rampantly carried out on account of bogus PANs. Aadhaar’s unique de- duplication based on biometric identification has been hailed as the most sophisticated system by the World Bank. Inclusion of Aadhaar into PAN eliminates the inequality between honest tax payers and non-compliant, dishonest ones who get away without paying taxes. Inclusion of Aadhaar into PAN promotes rather than negates equality. It bolsters equality and is consistent with Article 14. In result, Section 139-AA is fully compliant of three-fold test as laid down in Puttaswamy’s case. Section 139-AA, thus does not breach fundamental Right of Privacy of an individual and cannot be struck down on that ground. [Paras 376, 377][716-D-G] K.S. Puttaswamy v. Union of India [2017] 10 SCR 569 : (2017) 10 SCC 1 – followed. 14. Whether Aadhaar Act violates the Interim Orders passed by this Court in Writ Petition (C) No. 494 of 2012? The Aadhaar Act, 2016 gives legislative backing to the Aadhaar Scheme. The Act contains specific provisions prohibiting disclosure of core biometric information collected in Aadhaar enrolment. Thus, Aadhaar Act cannot be struck down on the ground that it is in violation of interim orders passed by this Court in Writ Petition (C) No. 494 of 2012. [Para 383, 384][719-D-E, F-G] Per Dr. D. Y. Chandrachud, J. 1.1 Whether under Article 110(3), the decision of the Speaker of the Lok Sabha, that a Bill is a Money Bill, is immune from judicial review.

1.1.1 Article 109 provides for a special procedure in respect of Money Bills. It provides that a Money Bill shall not be A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. introduced in the Council of States, the Rajya Sabha. After a Money Bill is introduced in the Lok Sabha and passed by it, the Bill has to be transmitted to the Rajya Sabha for its recommendations. Article 110(4) provides that when a ‘Money Bill’ is transmitted from the Lower House to the Upper House, it must be endorsed with a certificate by the Speaker of the Lower House that it is a Money Bill. From the date of the receipt of the Money Bill, the Rajya Sabha is bound to return the Bill to the Lok Sabha, within a period of fourteen days, with its recommendations. The Lok Sabha has the discretion to “either accept or reject all or any of the recommendations” made by the Rajya Sabha. If the Lok Sabha accepts any of the recommendations of the Rajya Sabha, the Money Bill is deemed to have been passed by both Houses of the Parliament “with the amendments recommended” by the Rajya Sabha and accepted by the Lok Sabha. However, when the Lok Sabha “does not accept any of the recommendations” of the Rajya Sabha, the Money Bill is said to have been passed by both Houses in the form in which it was originally passed by the Lok Sabha. If a Money Bill after being passed by the Lok Sabha and transmitted to the Rajya Sabha for its recommendations is not returned to the Lok Sabha within a period of fourteen days, it is then deemed to have been passed by both the Houses of the Parliament in the form in which it was originally passed by the Lok Sabha. [Para 56]791-E-H; 792-A-B]

1.1.2 The Rajya Sabha is a constitutional body in a bicameral legislature. The makers of the Constitution adopted bicameralism from Britain. The draftspersons of the Constitution were conscious of the impact of a misuse of institutional power. Our Constitution does not provide absolute power to any institution. It sets limits for each institution. Our constitutional scheme envisages a system of checks and balances. The power of the Speaker of the Lok Sabha, to decide whether a Bill is a Money Bill, cannot be untrammelled. The contention that the decision of Speaker is immune from judicial review and cannot be questioned, is contrary to the entire scheme of the Constitution, which is premised on transparency, non-arbitrariness and fairness. The phrase “shall be final” used in Article 110(3) has been adopted from Article 22 of the Irish Constitution which provide a 88 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 89 mechanism for review of the certificate issued by the Speaker. Recourse is provided under the Irish Constitution by which the members of the Upper House of the Irish Parliament can request the President of Ireland to refer the question of whether a Bill is a Money Bill, to a Committee of Privileges. The members of the Constituent Assembly did not adopt this mechanism. Absence of this mechanism does not mean that the decision of the Speaker of the Lok Sabha cannot be subject to checks and balances, of which judicial review is an indispensable facet. The Speaker has to act within the domain, which the Constitution accords to the office of the Speaker. Judicial review is the ultimate remedy to ensure that the Speaker does not act beyond constitutional entrustment. [Paras 60, 71][793-G-H; 805-B-F] Justice K S Puttaswamy (Retd) v. Union of India [2017] 10 SCR 569 : (2017) 10 SCC 1 – followed. Shayara Bano v. Union of India (2017) 9 SCC 1 : [2017] 7 SCR 797; Kalpana Mehta v. Union of India (2018) 7 SCC 1; N P Ponnuswami v. Returning Officer, Namakkal Constituency, Namakkal, Salem District [1952] SCR 218; Union of India v. Jyoti Prakash Mitter (1971) 1 SCC 396 : [1971] 3 SCR 483; Union of India v. Tulsiram Patel (1985) 3 SCC 398 : [1985] 2 Suppl. SCR 131; Kihoto Hollohan v. Zachillhu (1992) Supp 2 SCC 651 : [1992] 1 SCR 686 – relied on

1.1.3 A constitutional trust has been vested in the office of the Speaker of the Lok Sabha. By declaring an ordinary Bill to be a Money Bill, the Speaker limits the role of the Rajya Sabha. This power cannot be unbridled or bereft of judicial scrutiny. If the power of the Speaker is exercised contrary to constitutional norms, it will not only limit the role of the Rajya Sabha, but denude the efficacy of a legislative body created by the Constitution. Such an outcome would be inconsistent with the scheme of the Indian Constitution. Judicial review is necessary to ensure that the federal features of the Constitution are not transgressed. [Para 94][830-D-F] Special Reference No. 1 of 1964 AIR 1965 SC 745 : [1965] SCR 413; Ramdas Athawale v Union of India (2010) 4 SCC 1 : [2010] 3 SCR 1059; Raja Ram Pal v A B C D E F G H 90 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Hon’ble Speaker, Lok Sabha (2007) 3 SCC 184 : [2007] 1 SCR 1; Mangalore Ganesh Beedi Works v State of Mysore [1963] Supp 1 SCR 275; Pandit MSM Sharma v Dr Shree Krishna Sinha AIR 1960 SC 1186 – relied on. Mohd Saeed Siddiqui v State of Uttar Pradesh (2014) 11 SCC 415; Yogendra Kumar Jaiswal v State of Bihar (2016) 3 SCC 183 – overruled. Fathali M. Moghaddam, The SAGE Encyclopaedia of Political Behaviour (2017); Sidharth Chauhan, Bicameralism: comparative insights and lessons, Seminar (February, 2013); Rajya Sabha Secretariat, Second Chamber In Indian Parliament: Role and Status of Rajya Sabha, (2009), at page 2; M.N. Kaul and S.L. Shakdher, Practice and Procedure of Parliament, Lok Sabha Secretariat (2001); H M Seervai, Constitutional Law of India, Universal Law Co. Pvt. Ltd, Vol. 1, (1991); Rajya Sabha Secretariat, Structure and Functions of Rajya Sabha Secretariat, (2009), at pages 2-3; Gary Roethenbaugh, (cited in A. Cavoukian, Privacy and Biometrics, Information and Privacy Commissioner, Ontario, Canada, 1999, page 11; Els J. Kindt, Privacy and Data Protection Issues of Biometric Applications: A Comparative Legal Analysis, Springer (2013) – referred to. 1.2 Whether the Aadhaar Act was validly passed as a Money Bill.

1.2.1 Article 110(1) of the Constitution defines a Money Bill. For a Bill to be a Money Bill, it must contain “only provisions” dealing with every or any one of the matters set out in sub-clauses (a) to (g) of clause 1 of Article 110. The expression “if it contains only provisions dealing with all or any of the following matters, namely...” is crucial. Firstly, the expression “if” indicates a condition and it is only upon the condition being fulfilled that the deeming fiction of a Bill being a Money Bill for the purposes of the Chapter will arise. Secondly, to be a Money Bill, the Bill should have only those provisions which are referable to clauses (a) to (g). The condition is much more stringent than stipulating that the Bill should incorporate any of the matters spelt out in JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 91 clauses (a) to (g). The words “only provisions” means that besides the matters in sub clauses (a) to (g), the Bill shall not include anything else. Otherwise, the expression “only” will have no meaning. The word “only” cannot be treated to be otiose or redundant. Thirdly, the two expressions “if it contains only provisions” and “namely” indicate that sub-clauses (a) to (g) are exhaustive of what a Money Bill may contain. The contents of a Money Bill have to be confined to all or any of the matters specified in sub-clauses (a) to (g). Fourthly, sub-clause (g) covers any matter incidental to sub-clauses (a) to (f). A matter is incidental when it is ancillary to what is already specified. Sub-clause (g) is not a residuary entry which covers all other matters other than those specified in sub-clauses (a) to (f). If sub-clause (g) were read as a catch-all residuary provision, it would defeat the purpose of defining a class of Bills as Money Bills. What is incidental under sub-clause (g) is that which is ancillary to a matter which is already specified in sub-clauses (a) to (f). The test is not whether it is incidental to the content of a Bill but whether it is incidental to any of the matters specifically enumerated in sub-clauses (a) to (f). Clause (2) of Article 110 provides that a Bill shall not be deemed to be a Money Bill just for the reason that it provides for the imposition of fines or other pecuniary penalties, or for the demand or payment of fees for licences or fees for services rendered, or by reason that it provides for the imposition, abolition, remission, alteration or regulation of any tax by any local authority or body for local purposes. Like in the Parliament Act of 1911, the definition of a Money Bill provided under Article 110(1) is exhaustive in nature. A Bill can be a Money Bill if it contains “only provisions” dealing with all or any of the matters listed under sub-clauses (a) to (g) of Article 110(1). If a Bill contains provisions which fall outside sub-clauses (a) to (g), it is not a Money Bill. The entirety of the Bill cannot be regarded as a Money Bill, once it contains any matters which fall beyond sub- clauses (a) to (g). Once that is the position, it could be impossible to sever those parts which fall within sub-clauses (a) to (g) and those that lie outside. [Paras 95, 98][831-A-F, G-H; 832-A-B; 834-B-C] Hari Ram v. Baby Gokul Prasad, (1991) Supp 2 SCC 608; M/s Saru Smelting (P) Ltd. v. Commissioner of A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. Sales Tax, Lucknow (1993) Supp 3 SCC 97 : [1993] 3 SCR 719; SR Bommai v Union of India AIR 1994 SC 1998 – relied on.

1.2.2 The Lok Sabha cannot introduce and pass a legislative measure in the garb of a Money Bill, which could otherwise have been amended or rejected by the Rajya Sabha. Introduction and passing of a Bill as a Money Bill, which does not qualify to be a Money Bill under Article 110(1) of the Constitution, is plainly unconstitutional. The Lok Sabha is not entrusted with the entire authority of Parliament. The Lok Sabha, the Rajya Sabha and the President together constitute the Parliament of India. The Lok Sabha is a body of elected representatives and represents the aspirations of citizens. Yet, like every constitutional institution, it is part of this basic structure of the Constitution. A political party or a coalition which holds the majority in the Lok Sabha cannot subvert the working of the Constitution. [Para 99][835- C-E]

1.3. The Speaker of the Lok Sabha has an onerous constitutional duty to ensure that a Bill, which is not a Money Bill is not passed as a Money Bill. The Speaker of the Lok Sabha, the Chairman of the Rajya Sabha, the members of the Lok Sabha and the Rajya Sabha, and the President need to work in constitutional solidarity to ensure that no provision of the Constitution is diluted or subverted. The Aadhaar Act was passed as a Money Bill. The broad description of the provisions of the Aadhaar Act indicates that the Act creates a framework for obtaining a unique identity number - the Aadhaar number - by submitting demographic and biometric information and undergoing the process of enrolment and authentication. The Act indicates that the Aadhaar number may be accepted as proof of identity for any purpose. It creates a central database (CIDR) for storage of identity information collected from individuals. The primary object of the legislation is to create one national identity for every resident. It seeks to do so by legislating a process for collecting demographic and biometric information. The Act has created an authority to oversee the fulfilment of its provisions. In its primary focus and initiatives, the law traverses beyond the territory reserved by Article 110 for a Money Bill. Aadhaar 92 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 93 numbers may be used for “other purposes”. [Paras 100, 101, 107][835-G; 836-A-B; 839-D-G; 840-B] A

1.4 The Preamble to the Aadhaar Act indicates that the main objective was to achieve an efficient and “targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the Consolidated Fund of India”. The substantive provisions of the Act are, however, not confined to the object specified in the Preamble. Indeed, they travel far beyond the boundaries of a money bill under Article 110(1). The enrolment on the basis of demographic and biometric information, generation of Aadhaar number, obtaining consent of individuals before collecting their individual information, creation of a statutory authority to implement and supervise the process, protection of information collected during the process, disclosure of information in certain circumstances, creation of offences and penalties for disclosure or loss of information, and the use of the Aadhaar number for any purpose lie outside the ambit of Article 110. These themes are also not incidental to any of the matters covered by sub-clauses (a) to (f) of Article 110(1). [Para 108][840- H; 841-A-B]

1.5 Under clause (e) of Article 110(1), the money bill must deal with the declaring of any expenditure to be expenditure charged on the Consolidated Fund of India (or increasing the amount of expenditure). Section 7 does not declare the expenditure incurred on services, benefits or subsidies to be a charge on the Consolidated Fund of India. What Section 7 does is to enact a provision allowing for Aadhaar to be made mandatory, in the case of services, benefits or subsidies which are charged to the Consolidated Fund. Section 7 provides that in the case of services, benefits or subsidies which are already charged to the Consolidated Fund, Aadhaar can be made mandatory to avail of them. Hence, even Section 7 is not within the ambit of Article 110(1)(e). However, even if Section 7 were to be held to be referable to Article 110, that does not apply to the other provisions of the Act. The other provisions of the Act do not in any event fall within the ambit of Article 110(1). Section 57 of the Act in particular (which creates a platform for the use of the Aadhaar number by the private entities) can by no stretch of logic be B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. covered under Article 110(1). The other provisions of the Act do not deal with that which has been provided under Sub-clauses (a) to (g) of Article 110. As regards the ‘incidental’ provision under Article 110(1)(g), the provisions of the Aadhaar Act are not “incidental to any of the matters specified in sub-clauses (a) to (f)”. Even if it is assumed that there is one provision (Section 7) which is relatable to sub-clause (e) of Article 110(1), the other provisions of the Act are unrelated to Article 110(1). [Para 109][841-D-E; 842-A-B]

1.6 The doctrine of pith and substance is mainly used to examine whether the legislature has the competence to enact a law with regard to any of the three Lists provided under the Constitution. It cannot be applied to sustain as a Money Bill, a Bill which travels beyond the constitutional boundaries set out by Article 110. Whether a Bill is validly passed as a Money Bill has nothing to do with the legislative competence of the legislature under Article 246 of the Constitution.[Para 115][848- F-G] A S Krishna v. State of Madras [1957] SCR 399; State of Maharashtra v. Bharat Shanti Lal Shah (2008) 13 SCC 5 : [2008] 12 SCR 1083 – relied on Union of India v. Shah Goverdhan L Kabra Teachers’ College (2002) 8 SCC 228 : [2002] 3 Suppl. SCR 220 – held inapplicable.

1.7 Introducing the Aadhaar Act as a Money Bill has bypassed the constitutional authority of the Rajya Sabha. It deprived the Rajya Sabha from altering the provisions of the Bill by carrying out amendments. The Rajya Sabha has an important role in the making of laws. Superseding the authority of the Rajya Sabha is in conflict with the constitutional scheme and the legitimacy of democratic institutions. It constitutes a fraud on the Constitution. Passing of a Bill as a Money Bill, when it does not qualify for it, damages the delicate balance of bicameralism which is a part of the basic structure of the Constitution. Institutions are crucial to democracy. The Act thus fails to qualify as a Money Bill under Article 110 of the Constitution. The Aadhaar Act is in violation of Article 110 and, therefore, is liable to be 94 A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 95 declared unconstitutional. [Paras 116, 117] [850-F-G; 851- B-C, E-F] A

2. Biometrics, Privacy and Aadhaar

2.1.1 Biometric technologies imply that “unique or distinctive human characteristics of a person are collected, measured and stored for the automated verification of a claim made by that person for the identification of that person.” These systems thus identify or verify the identity or a claim of persons on the basis of the automated measurement and analysis of their biological traits (such as fingerprints, face and iris) or behavioral characteristics (such as signature and voice). The adoption of biometric technologies in developing countries in particular poses unique challenges since the implementation of new technologies in these countries is rarely preceded by the enactment of robust legal frameworks. The lack of regulatory frameworks, or the inadequacy of existing frameworks, has societal and ethical consequences and poses a constant risk that the concepts of privacy, liberty and other fundamental freedoms will be misunderstood, eroded or devalued. The proliferation of biometric technology has facilitated the invasion of individual privacy at an unprecedented scale. The raw information at the heart of biometrics is personal by its very nature. The Aadhaar Act recognises this as sensitive personal information. Biometric technology is unique in the sense that it uses part of the human body or behaviour as the basis of authentication or identification and is therefore intimately connected to the individual concerned. [Paras 118, 121, 122, 124][852-B; 854-D-E; 855-B, D-E]

2.1.2 There are two main groups of privacy- related interests that are directly pertinent to the contemporary discussion on the ethical and legal implications of biometrics. The first group falls under ‘informational privacy’ and is concerned with control of personal information. The ability to control personal information about oneself is closely related to the dignity of the individual, self-respect and sense of personhood. The second interest group falls under the rubric of ‘physical privacy’. This sense of privacy transcends the purely physical and is aimed essentially at protecting the dignity of the human person. It is a safeguard against intrusions into persons’ physical bodies and B C D E F G H 96 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. spaces. Another issue is of property rights with respect to privacy, which concerns the appropriation and ownership of interests in human personality. In many jurisdictions, the basis of informational privacy is the notion that all information about an individual is in some fundamental way their own property, and it is theirs to communicate or retain as they deem fit. [Para 125][855-F-G; 856-A-C]

2.1.3 The collection of most forms of biometric data requires some infringement of the data subject’s personal space. Iris and fingerprint scanners require close proximity of biometric sensors to body parts such as eyes, hands and fingertips. Even in the context of law enforcement and forensic identification, the use of fingerprinting is acknowledged to jeopardise physical privacy. Many countries have laws and regulations which are intended to regulate such measures, in order to protect the individual’s rights against infringement by state powers and law enforcement. However, biometrics for the purpose of authentication and identification is different as they do not have a specific goal of finding traces related to a crime but are instead conducted for the purpose of generating identity information specific to an individual. This difference in purpose actually renders the collection of physical biometrics a more serious breach of integrity and privacy. Concerns about physical privacy usually take a backseat as compared to concerns about informational privacy. The reason for this is that physical intrusion resulting from the use of biometric technology usually results from the collection of physical information. However, for some people of specific cultural or religious backgrounds, even the mental harm resulting from physical intrusion maybe quite serious. [Para 126, 127][856-C-E, G] Nancy Yue Liu, Bio-Privacy: Privacy Regulations and the Challenge of Biometrics, Routledge (2013); Simon Davies, as cited in John D. Woodward, Biometric Scanning, Law & Policy: Identifying the Concerns - Drafting the Biometric Blueprint, University of Pittsburgh Law Review, (1997); Daniel M. L Storisteanu, Toby L. Norman, Alexandra Grigore and Alain B. Labrique, Can biometrics beat the developing world’s challenges?, Biometric Technology Today JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 97 (2016); Pam Dixon, A Failure to Do No Harm - India’s Aadhaar biometric ID program and its inability to protect privacy in relation to measures in Europe and the U.S., Health and Technology (2017), Vol. 7, at pages 539–567 – referred to. A

2.2 Consent in the collection of biometric data: Privacy B Concerns in the Aadhaar Act The right of an individual to access information related to his or her authentication record is recognized in Section 3(2)(c) and Section 32(2) of the Aadhaar Act. However, the supplementary regulations that complement the Act are bereft of detail on the procedure to access such information. Although Regulation 5 mentions that at the time of authentication, requesting entities shall inform the Aadhaar number holder of alternatives to submission of identity information for the purpose of authentication, and Regulation 6 mandates that the requesting entity shall obtain the consent of the Aadhaar number holder for the authentication, in neither of the above circumstances do the regulations specify the clearly defined options that should be made available to the Aadhaar number holder in case they do not wish to submit identity information, nor do the regulations specify the procedure to be followed in case the Aadhaar number holder does not provide consent. This is a significant omission. [Paras 145, 146][871-C, E-F] Identification for Development (World Bank Group), Technical Standards for Digital Identity Systems for Digital Identity Draft for Discussion, available at Technical-Standards-for-Digital-Identity.pdf, at page 22; Katie Bird, Is your biometric data safe online? ISO/IEC standard ensures security and privacy, (11 August 2011) – referred to.

2.3 Extent of information disclosed during authentication & sharing of core biometric information: Section 29(1) of the Aadhaar Act expressly states that ‘core biometric information can never be shared with anyone for any reason whatsoever or be used for any purpose other than generation of Aadhaar numbers and authentication under this Act’. However, this provision is contradicted by Section 29(4) of the Act, the proviso to which C D E F G H 98 A B C D E F G H SUPREME COURT REPORTS [2018] 8 S.C.R. grants UIDAI the power to publish, display or post core biometric information of an individual for purposes specified by the regulations. Moreover, sub-sections 29(1) and (2), in effect, create distinction between two classes of information (core biometric information and identity information), which are integral to individual identity. Identity information requires equal protection as provided to core biometric information. [Paras 145, 148][872- G-H; 873-C-E; 874-A]

2.4 Other concerns regarding the Aadhaar Act: Misconceptions regarding the efficacy of biometric information: Sections 6 and 31(2) of the Aadhaar Act place an additional onus on individual Aadhaar holders to update their information. These provisions create a legal mandate on individuals to ensure that their information is accurate within the CIDR. An individual’s biometric information may change from time to time. Natural factors like ageing, manual labour, injury and illness can cause an individual’s biometric information to be altered over the course of a lifetime. [Paras 150-151][874-F; 875-C-D] Ramesh Subramanian, Computer Security, Privacy & Politics: Current Issues, Challenges & Solutions, IRM Press, at pages 99-100; L. Vishwanath, Four Reasons You Should Worry About Aadhaar’s Use of Biometrics, The Wire (28 March, 2017); A. Cavoukian, Privacy and Biometrics, Information and Privacy Commissioner Canada (1999); Robert Gellman, Privacy and Biometric ID Systems: An Approach Using Fair Information Practices for Developing Countries, CGD Policy Paper 028 Washington DC: Centre for Global Development (1 August 2013) – referred to.

2.5 No access to biometric records in database: The proviso to Section 28(5) of the Aadhaar Act disallows an individual access to the biometric information that forms the core of his or her unique ID (Aadhaar). Denial of access to the individual violates a fundamental principle of data protection: ownership of the data must at all times vest with the individual. Overlooking this fundamental principle is manifestly arbitrary and violative of Article 14. [Para 152][876-F-G; 877-C] JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 99

2.6 Biometric locking: Authentication Regulations 11 (1) and (4) provide for the facility of Biometric Locking. The provision allowing biometric locking is salutary to the extent that it allows Aadhaar number holders to permanently lock their biometrics and temporarily unlock them only when needed for biometric authentication. But the regulation is problematic to the extent that it also empowers the UIDAI to make provisions to remove such locking without any specified grounds for doing so. [Para 153][877-C-D, E-F]

2.7 Key takeaways: In order to uphold democratic values, the government needs to curtail its own powers concerning the tracking of all citizens and prevent the needless collection of data. Such protections may assuage the fears and uphold the long-term legitimacy of Aadhaar. If the legislative process takes into account public feedback and addresses the privacy concerns regarding Aadhaar, it would provide a solid basis for more digital initiatives, which are imminent in today’s digital age. However, in its current form, the Aadhaar framework does not address the privacy concerns issues. [Para 157][879-F-G] John D Woodward, Biometrics: Identifying Law & Policy Concerns, in Biometrics (AK Jain A.K, R Bolle, and S Pankanti eds.), Springer (1996); Robert Gellman, Privacy and Biometric ID Systems: An Approach Using Fair Information Practices for Developing Countries, CGD Policy Paper 028 Washington DC: Centre for Global Development (1 August, 2013); Pam Dixon, A Failure to Do No Harm – India’s Aadhaar biometric ID program and its inability to protect privacy in relation to measures in Europe and the U.S., Health and Technology, Vol. 7 (2017), at pages 539– 567 – referred to.

3. Legitimate state aim

3.1 Directive Principles: The essence of the Directive Principles lies in Article 38 of the Constitution, which places an obligation on the State to secure a social order for the promotion of the welfare of the people. Article 41 speaks of the right to work, to education, and to public assistance. Article 43 contemplates a living wage and conditions of work which provide A B C D E F G H 100 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H a decent standard of life. Article 47 casts a positive obligation upon the State to raise the level of nutrition and the standard of living and to improve public health, as among its primary duties. [Paras 158, 161][880-A; 881-F-G; 882-F-G; 883-A, C]

3.2 Development and freedom: Social security acts as an underpinning link with development. There is also a two-way relationship between development and social security (expansion of human capability). The State has a legitimate aim to ensure that its citizens receive basic human facilities. In order to witness development, the huge amount of expenditure that the State incurs in providing subsidies and benefits to the common citizens, must be accompanied by accountability and transparency. These concerns form the basis of the Aadhaar Act, 2016. The Statement of Objects and Reasons indicates that the enactment is designed to ensure “the effective, secure and accurate delivery of benefits, subsidies and services from the Consolidated Fund of India to targeted beneficiaries”. The Aadhaar platform is not a social welfare benefit in itself. Essentially, what it seeks to achieve is to provide a unique identity to every resident. This identity, in the form of an Aadhaar number, is obtained upon the submission of demographic and biometric information in the course of enrolment. The legislative design envisages that the identity of the individual is verified through the process of authentication by which the biometric data stored in the central repository is matched with the biometric information submitted for authentication. As an instrument for verifying identity, Aadhaar seeks to ensure that social welfare benefits are obtained by persons eligible to do so and are not captured by the ineligible. Relying on an asserted reliability of biometric markers, the Aadhaar platform attempts to eliminate, or at least to curb rent- seeking behaviour. There is a state interest in ensuring that the welfare benefits which the state provides reach those for whom they are intended. [Paras 164, 174, 175, 177, 178][885-F; 894-F- G; 895-E; 897-G; 898-C-D; 899-B-C, E, G] Minerva Mills Ltd. v. Union of India (1980) 3 SCC 625 : [1981] 1 SCR 206 – relied on. Arun K Thiruvengadam, The Constitution of India: A Contextual Analysis, (Bloomsbury 2017), at page 1; JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 101 George H Gadbois, JR, Supreme Court of India: The Beginnings (Vikram Raghavan and Vasujith Ram eds.), Oxford University Press (2017), at page 193; “A known but an indifferent judge”: Situating Ronald Dworkin in contemporary Indian jurisprudence, International Journal of Constitutional Law, (2003) at page 582 by Upendra Baxi; Development as Freedom, Oxford University Press (2000), at page xii by Amartya Sen; Two Concepts of Liberty by Isaiah Berlin; The Constitution of Liberty, Routledge & Kegan Paul, (1960) at pages 11, 207-208 by F A Hayek; Women and Human Development, Cambridge University Press, (2000) by Martha Nussbaum; Basic Rights: Subsistence, Affluence and US Foreign Policy, Princeton University Press, Second Edition (1996) by Henry Shue; The Idea of Justice, Penguin (2009) at pages 379-380 by Amartya Sen; An Uncertain Glory, Penguin (2013), at pages x and xi by Jean Dreze and Amartya Sen – referred to.

3.3 Identity and Identification: Identity is inseparable from the human personality. An identity is a statement of who an individual is. The human personality is, at a certain level, all about identity, for it is through the assertion of identity that each individual seeks to preserve the core of his or her humanity. An identity is the persona which an individual puts forth in a multitude of relationships. When the Constitution protects our right to be and to be what we are, it creates a space where the individual is immune from interference. By recognizing our liberty as autonomous persons, the Constitution recognizes our ability to preserve and shape our identities in interactions with others. There is a distinction between identity and identification. Identification is a matter of proof of establishing that a person is actually, the individual who claims a right or entitlement. In their daily interactions, individuals have to distinguish themselves from others, whether it be in the course of employment, travel, civil union, location, community perspectives, revenue obligations or access to benefits. Identification is a proof of identity or evidence of identity. Identification is mandatory in numerous activities of day to day life: a passport is necessary for international travel, a A B C D E F G H 102 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H voter ID is required for exercising electoral rights, a driving license is necessary to ply a vehicle and an arms license is needed to possess a fire arm. [Paras 179, 180][899-G-H; 900-A-B, E-F]

3.4 There are two important facets of the Aadhaar regime. The first is that under Section 3, it is a voluntary option of the individual to choose Aadhaar as a form of identification. However, if the individual seeks a subsidy, benefit or service for which the expenditure is incurred from the Consolidated Fund of India, Aadhaar becomes a mandatory requirement. The second important feature is the requirement of informed consent when the individual parts with identity information. The mandate of Section 7 must be understood from the perspective of the obligation imposed on the State to ensure effective and efficient utilization of public resources. Article 266 reinforces that mandate in its stipulation that all monies out of the Consolidated Fund of India can only be appropriated in accordance with law, for the purpose of and in the manner provided by the Constitution. The State is a trustee of public resources. The adoption of Aadhaar is in fulfilment of the doctrine of public trust. The state is under a bounden obligation to ensure that its revenues which are placed in the Consolidated Fund are appropriated in accordance with law and are not diverted for extraneous purposes. The mandate of Section 7 is founded on a legitimate state interest. The state has a vital interest in ensuring that public revenues are duly accounted, that the Consolidated Fund is utilized for purposes authorized by law; that funds for development reach genuine beneficiaries and that scarce public resources meant for those at the foot of the socio-economic ladder are not mis-utilized by rent- seeking behavior. [Para 187][907-C-E, G-H; 908-A] National Legal Services Authority v. Union of India (2014) 5 SCC 438; Natural Resources Allocation, In Re, Special Reference No.1 of 2012 (2012) 10 SCC 1 : [2012] 9 SCR 311; Centre for Public Interest Litigation v. Union of India (2012) 3 SCC 1 : [2012] 3 SCR 147; Reliance Telecom Limited v. Union of India (2017) 4 SCC 269 : [2017] 4 SCR 972 – relied on. Opinion on the Right to Identity, 2007; Identity and Identification – the Individual in the Time of JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 103 Networked Governance, Socio Legal Review by Nishant Shah; Conversation with Manuel Castells, Globetrotter by Manuel Castells – referred to.

4. Proportionality

4.1 Harmonising conflicting rights – It is the foremost duty of the State to work towards achieving and maintaining a fine balance, taking into account these myriad considerations. The State must always be guided by the knowledge and sense of duty that in a true democracy, the citizens cannot be made to choose between rights and needs, as they are equally entitled to both. As the sentinel of justice and protector of fundamental rights, it is the responsibility of this Court to act as a check and ensure that government action or inaction does not endanger or threaten to disturb the balance that the Constitution seeks to achieve. [Para 190][911-B-C]

4.2 While exercising judicial review, courts are often confronted with situations involving conflicts between rights, tensions between individuals arising from the assertion of rights and discord arising out of the assertion of the same right by two or more individuals. Conflicts between rights arise when the assertion of a fundamental human right by an individual impacts upon the exercise of distinct freedoms by others. The freedom of one individual to speak and to express may affect the dignity of another. A person may be aggrieved when the free exercise of the right to speak by someone impinges upon his or her reputation, which is integral to the right to life under Article 21. [Para 191][911-D-E]

4.3 In seeking to draw the balance between political freedoms and economic freedoms, the Court must preserve the euphony between fundamental rights and directive principles. It is on their co-existence that the edifice of the Constitution is founded. Neither can exist without the other. Democracy rejects the totalitarian option of recognising economic entitlements without political liberty. Economic rights have become justiciable because of the constitutional guarantees founded on freedom and the rule of law. The Constitution is founded on democratic governance and is based on the protection of individual freedom. A B C D E F G H 104 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H Freedom comprehends both fundamental political freedoms as well as basic human rights. A just balance between the two is integral to the fulfilment of India’s constitutional commitment to realise human liberty in a social context which is cognizant of the histories of discrimination and prejudice suffered by large segments of our society. Where the question is related to the limiting the right to privacy, Puttaswamy requires the test of proportionality. It has, therefore, to be tested whether the Aadhaar scheme fulfils the test of proportionality. The test of proportionality stipulates that the nature and extent of the State’s interference with the exercise of a right (in this case, the rights to privacy, dignity, choice, and access to basic entitlements) must be proportionate to the goal it seeks to achieve (in this case, purported plugging of welfare leakage and better targeting). In applying the proportionality test, the Court cannot mechanically defer to the State’s assertions. Especially given the intrusive nature of the Aadhaar scheme, such deference to the legislature is inappropriate. [Paras 196, 198][915-G-H; 916-A-C; 917-B, E] People’s Union for Civil Liberties (PUCL) v Union of India (2003) 4 SCC 399 : [2003] 2 SCR 1136; Thalappalam Service Cooperative Bank Limited v State of Kerala (2013) 16 SCC 82 : [2013] 14 SCR 475; G Sundarrajan v Union of India (2013) 6 SCC 620 : [2013] 8 SCR 631; Subramanian Swamy v Union of India (2016) 7 SCC 221 : [2016] 3 SCR 865; Asha Ranjan v Chandrakeshwar Prasad (2017) 4 SCC 397; Chintaman Rao v State of Madhya Pradesh [1950] SCR 759; State of Madras v V G Row [1952] SCR 597 – relied on. Granville Austin, Working a Democratic Constitution: A History of the Indian Experience, Oxford University Press (2003) at page 6; Lon L. Fuller and Kenneth I. Winston, The Forms and Limits of Adjudication, Harvard Law Review, Vol. 92, (1978), at pages 353- 409; Kwame Anthony Appiah, The Lies That Bind: Rethinking Identity, Liveright Publishing (2018); Francis Fukuyama, Identity: The Demand for Dignity and the Politics of Enlightenment, Farrar, Straus and Giroux (2018); Anand Giridharadas ‘What is Identity?’, The JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 105 New York Times, 27 August, 2018; Peter F Drucker, The Age of Discontinuity: Guidelines to Our Changing Society, Harper & Row (1969). Drucker’s book popularized the term ‘Knowledge Economy’; What is Knowledge Economy?’, IGI Global: Disseminator of Knowledge; Krishnadas Rajagopal, ‘Aadhaar in figures from UIDAI CEO’s numbers: key presentation to the Supreme Court’, The Hindu, (March 22, 2018). Aadhaar enrollment as of March 2018 stood at over 1 billion; Upendra Baxi, The Right To Be Human: Some Heresies, India International Centre Quarterly, Vol. 13, (1986); Thomas Erskine May, A treatise on the law, privileges, proceedings and usage of Parliament, Ninth Edition (1883); B Shiva Rao, The Framing of India’s Constitution: A Study, Indian Institution of Public Administration (1968), at page 420; Pratik Datta, Shefali Malhotra & Shivangi Tyagi, Judicial Review and Money Bills, NUJS Law Review (2017); Granville Austin, The Indian Constitution: Cornerstone of a Nation, Oxford University Press (1966) – referred to.

4.4 Proportionality standard in Indian jurisprudence: Proportionality has been the core of reasonableness since the 1950s. In Puttaswamy, (Chandrachud J.), speaking for four judges, laid down the tests that would need to be satisfied under our Constitution for violations of privacy to be justified. The third principle adopts the test of proportionality to ensure a rational nexus between the objects and the means adopted to achieve them. The essential role of the test of proportionality is to enable the court to determine whether a legislative measure is disproportionate in its interference with the fundamental right. In determining this, the court will have regard to whether a less intrusive measure could have been adopted consistent with the object of the law and whether the impact of the encroachment on a fundamental right is disproportionate to the benefit which is likely to ensue. The proportionality standard must be met by the procedural and substantive aspects of the law. The ‘test of proportionality’ is a judicially-entrenched principle which has invigorated fundamental rights jurisprudence in the country. The A B C D E F G H 106 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H application of the proportionality standard in rights-based adjudication is well-recognised across diverse jurisdictions. [Paras 199, 204][917-F; 918-C-D; 922-B-C, E-G; 923-B-C] State of Bihar v. Kamla Kant Misra (1969) 3 SCC 337 : [1970] 3 SCR 181; Mohammed Faruk v. State of Madhya Pradesh (1969) 1 SCC 853 : [1970] 1 SCR 156; Bishambhar Dayal Chandra Mohan v. State of Uttar Pradesh (1982) 1 SCC 39 : [1982] 1 SCR 1137; Om Kumar v. Union of India (2001) 2 SCC 386 : [2000] 4 Suppl. SCR 693; Teri Oat Estates v. U.T., Chandigarh (2004) 2 SCC 130 : [2003] 6 Suppl. SCR 1235; Modern Dental College and Research Centre v. State of Madhya Pradesh (2016) 7 SCC 353 – relied on. Elloy de Freitas v. Permanent Secretary of Ministry of Agriculture, Fisheries, Lands and Housing, [1999] 1 AC 69; Huang (FC) v. Secretary of State for the Home Department [2007] UKHL 11 – referred to. All things in Proportion? American Rights Review and the Problem of Balancing, Emory Law Journal, Vol. 60 (2011) by Jud Mathews and Alec Stone Sweet; Proportionality Balancing Global Constitutionalism, Columbia Journal of Transnational Law, Vol. 47 (2008) by Alec Stone Sweet & Jud Mathews; Proportionality and the Culture of Justification, American Journal of Comparative Law Vol. 59 (2011) (cited in); Etienne Mureinik, A Bridge to Where? Introducing the Interim Bill of Rights, South African Journal on Human Rights, Vol. 10 (1994) by Moshe Cohen-Eliya and Iddo Porat; The Principle of Proportionality, University of Michigan Journal of Law Reform, Vol. 42 (2009) Andrew B. Serwin, Privacy 3.0 – The Principle of Proportionality, University of Michigan Journal of Law Reform, Vol. 42 (2009) by Andrew B. Serwin, Privacy 3.0; Adalah v. The Minister of Interior, HCJ 7052/03; Jean Dreze and Amartya Sen, An Uncertain Glory, Penguin (2013), at pages x and xi; Gary Roethenbaugh, (cited in A. Cavoukian, Privacy and Biometrics, Information and Privacy Commissioner, Ontario, Canada, 1999, page JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 107 11; Rajya Sabha Secretariat, Structure and Functions of Rajya Sabha Secretariat, (2009), at pages 2-3; Aharon Barak’s seminal book; Aharon Barak, Proportionality: Constitutional Rights and their Limitations, Cambridge University Press (2012) – referred to. 4.5 Aadhaar: the proportionality analysis 4.5.1 When Aadhaar is seeded into every database, it becomes a bridge across discreet data silos, which allows anyone with access to this information to re-construct a profile of an individual’s life. While Section 2(k) of the Aadhaar Act excludes storage of individual information related to race, religion, caste, tribe, ethnicity, language, income or medical history into CIDR, the mandatory linking of Aadhaar with various schemes allows the same result in effect. What the Aadhaar Act seeks to exclude specifically is done in effect by the mandatory linking of Aadhaar numbers with different databases, under cover of the delivery of benefits and services. Moreover, the absence of proof of an Aadhaar number would render a resident non-existent in the eyes of the State, and would deny basic facilities to such residents. Section 7 thus makes a direct impact on the lives of citizens. If the requirement of Aadhaar is made mandatory for every benefit or service which the government provides, it is impossible to live in contemporary India without Aadhaar. It suffers from the vice of being overbroad. The scope of subsidies provided by the government (which incur expenditure from the Consolidated Fund) is not the same as that of other benefits and services which the government provides to its citizens. Therefore, benefits and services cannot be measured with the same yardstick as subsidies. The inclusion of services and benefits in Section 7 is a pre-cursor to the kind of function creep which is inconsistent with privacy and informational self-determination. The broad definitions of the expressions ‘services and ‘benefits’ would enable government to regulate almost every facet of its engagement with citizens under the Aadhaar platform. Section 7 suffers from clear overbreadth in its uncanalised application to services and benefits. [Para 247][968-E-H; 969-A-C] Monnet Ispat and Energy Ltd v Union of India (2012) 11 SCC 1 : [2012] 7 SCR 644 – referred to. A B C D E F G H 108 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H Federal Census Act Case (Volkszählungsurteil) (1983) 65 BVerfGE 1; S and Marper v United Kingdom (2008) 48 EHRR 1169; Aycaguer v. France Application no. 8806/12; Digital Rights Ireland Ltd v. Minister C 293/ 12 and C 594/12; Michael Schwarz v. Stadt Bochum [2013] EUECJ C-291/12; Madhewoo v. The State of Mauritius [2016] UKPC 30; S and Marper v. The United Kingdom [2008] ECHR 1581; Vernonia School District 47J v. Acton 515 U.S. 646 (1995); Skinner v Railway Labor Executives’ Association 489 U.S. 602 (1989); Whalen v Roe 429 U.S. 589 (1977); United States v Dionisio 410 U.S. 1 (1973); Bowen v. Roy 476 U.S. 693 (1986); In re Crawford 194 F.3d 954 (9th Cir. 1999); Haskell v. Harris 669 F.3d 1049 (9th Cir. 2012); Utility Workers Union of America v. Nuclear Regulatory Commission 664 F. Supp. 136 (S.D.N.Y. 1987); Nicholas A Iacobucci v. City of Newport 785 F.2d 1354 (6th Cir. 1986); Thom v. New York Stock Exchange 306 F. Supp. 1002 (S.D.N.Y. 1969); Perkey v. Department of Motor Vehicles (1986) 42 Cal. 3D 185; Buchanan v Wing N.Y.S.2d 865; People v. Stuller 10 Cal. App.3d 582 (1970); United States v. Kelly 55 F.2d 67 (2d Cir. 1932); Brown v. Brannon 399 F. Supp. 133 (M.D.N.C. 1975) – referred to. Association pour la promotion de l’image Conseil d’ Etat in France, 26 October 2011; Privacy and Security of Aadhaar: A Computer Science Perspective” – referred to. 4.5.2 Can the provisions of Section 7 be applied with any justification to pensions payable on account of the past service rendered by a person to the state? Pension is not a largesse or bounty conferred by the state. Pension, as a condition of service, attaches as a recompense for the long years of service rendered by an individual to the state and its instrumentalities. A right cannot be denied on the anvil of requiring one and only one means of identification. The pension disbursing authority is entitled to lay down regulations (which are generally speaking, already in place) to ensure the disbursal of pension to the person who is rightfully entitled. This aim of the government can be fulfilled by JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 109 other less intrusive measures. The requirement of insisting on an Aadhaar number for the payment of pensionary benefits involves a breach of the principle of proportionality. Such a requirement would clearly be contrary to the mandate of Article 14. Similarly, the state as a part of its welfare obligations provides numerous benefits to school going children, including mid-day meals or scholarships, to children belonging to the marginalised segments of the society. The object of the state is to ensure that the benefits which it offers are being availed of by genuine students who are entitled to them. This legitimate aim can be fulfilled by adopting less intrusive measures as opposed to the mandatory enforcement of the Aadhaar scheme as the sole repository of identification. The state has failed to demonstrate that a less intrusive measure other than biometric authentication will not subserve its purposes. The inclusion of benefits and services in Section 7 suffers from a patent ambiguity, vagueness and overbreadth which renders the inclusion of services and benefits arbitrary and violative of Article 14. [Para 248][969-G-H; 970-A- C] Maneka Gandhi v. Union of India (1978) 1 SCC 248 : [1978] 2 SCR 621; Vishaka v. State of Rajasthan (1997) 6 SCC 241 : [1997] 3 Suppl. SCR 404; Githa Hariharan (Ms) v. Reserve Bank of India (1999) 2 SCC 228 : [1999] 1 SCR 669; Anuj Garg v. Hotel Association of India (2008) 3 SCC 1 : [2007] 12 SCR 991; National Legal Services Authority v. Union of India (2014) 5 SCC 438; Madhu Kishwar v. State of Bihar (1996) 5 SCC 125 : [1996] 1 Suppl. SCR 442; Nandini Sundar v. State of Chattisgarh (2011) 7 SCC 547 : [2011] 8 SCR 1028 – relied on. Betty Drexhage, Bicameral Legislatures: An International Comparison, Ministry of the Interior and Kingdom Relations- Netherlands (2015), at page 7; Abhinay Muthoo & Kenneth A. Shepsle, The Constitutional Choice of Bicameralism, in Institutions and Economic Performance (Elhanan Helpman ed.), Harvard University Press (2008), at pages 251-252; James Madison, The Federalist No. 62 – The Senate, The Federalist Papers (1788); William H. Riker, The A B C D E F G H 110 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H Justification of Bicameralism, International Political Science Review (1992), Vol. 13, Issue 1, at pages 101–16; Saul Levmore, Bicameralism: When Are Two Decisions Better than One?, International Review of Law and Economics (1992), Vol. 12, at pages 147- 148; James N. Druckman & Michael F. Thies, The Importance of Concurrence: The Impact of Bicameralism on Government Formation and Duration, American Journal of Political Science (2002), Vol. 46, No. 4, at pages 760-771; Elliot Bulmer, Bicameralism, International Institute for Democracy and Electoral Assistance (2017), at page 4; James R. Rogers, The Advantage of Second Chambers in Republican Legislatures: An Informational Theory, at page 6; “Privacy and Data Protection Issues of Biometric Applications: A Comparative Legal Analysis”; Automating Inequality: How High-Tech Tools Profile, Police, and Punish the Poor”; Aadhaar and Food Security in Jharkhand: Pain without Gain?” – referred to.

4.5.3 Aadhaar is about identification and is an instrument which facilitates a proof of identity. It must not obliterate constitutional identity. The definition of demographic information in Section 2(k) excludes race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. However, the linking of the Aadhaar number to different databases is capable of profiling an individual, which could include information regarding her/his race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Thus, the impact of technology is such that the scheme of Aadhaar can reduce different constitutional identities into a single identity of a 12-digit number and infringe the right of an individual to identify herself/himself with choice. [Para 252][974-F-G; 975-A]

4.5.4 Social security schemes and programmes are a medium of existence of a large segment of society. Social security schemes in India, such as the PDS, were introduced to protect the dignity of the marginalized. Exclusion from these schemes defeats the rationale for the schemes which is to overcome chronic hunger and malnutrition. Exclusion is violative of human dignity. JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 111 The statistics recorded in government records and the affidavits filed by the petitioners point out glaring examples of exclusion due to technical errors in Aadhaar. Exclusion as a consequence of biometric devices has a disproportionate impact on the lives of the marginalized and poor. Compulsive linking of biometrics to constitutional entitlements should not result in denial to the impoverished. The Court has to be specifically conscious of the dignity of the underprivileged. The exclusion errors in this case have led to grave injustice to the marginalized. The Court, therefore, has to play an active role in protecting their dignity. [Para 253][975-B-F]

4.5.5 There is no antinomy between the right to privacy and the legitimate goals of the State. An invasion of privacy has to be proportional to and carefully tailored for achieving a legitimate aim. While the right to food is an important right and its promotion is a constitutional obligation of the State, yet the right to privacy cannot simply and automatically yield to it. No legitimate goal of the State can be allowed at the cost of infringement of a fundamental right without passing the test of constitutionality. While analysing the architecture of Aadhaar, this Court has demonstrated how the purported safeguards in the Aadhaar architecture are inadequate to protect the integrity of personal data, the right of informational self-determination and above all rights attributable to the privacy-dignity-autonomy trilogy. It is also concluded that the Aadhaar scheme is capable of destroying different constitutional identities. The financial exclusion caused due to errors in Aadhaar based authentication violate the individual’s right to dignity. The Aadhaar scheme causes an unwarranted intrusion into fundamental freedoms guaranteed under the Indian Constitution since the respondents have failed to demonstrate that these measures satisfy the test of necessity and proportionality. [Para 255][976-D-G]

4.6 Dignity and financial exclusion: Dignity is an integral element of natural law and an inalienable constitutional construct. To lead a dignified life is a constitutional assurance to an individual. Any action or inaction on the part of the State which is insensitive to and unconcerned about protecting the dignity of the marginalized is constitutionally impermissible. Denial of benefits arising out of any social security scheme which promotes A B C D E F G H 112 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H socio-economic rights of the marginalized, would not be legitimate under the Constitution, for the reason that such denial violates human dignity. No individual can be made to part with his or her dignity. Responsibility for protection of dignity lies not only with governments but also with individuals, groups and entities. Section 7 of the Aadhaar Act makes it mandatory for an individual to undergo authentication or furnish proof of possession of an Aadhaar number in order to avail a subsidy, benefit or service, which incurs expenditure from the Consolidated Fund of India. Errors in biometrics matching imply that an individual will not be considered a part of the biometrics database. If a benefit or service is subject to the matching of biometrics, then any mismatch would result in a denial of that benefit or service. Exclusion based on technological errors, with no fault of the individual, is a violation of dignity. The fate of individuals cannot be left to the vulnerabilities of technological algorithms or devices. Even a small percentage of error results in a population of crores being affected. Denial of subsidies and benefits to them due to the infirmities of biometric technology is a threat to good governance and social parity. [Paras 256, 257, 258, 262][976-G; 977-B; 978- B-C, E; 984-G; 986-D]

4.7 Constitutional validity of Section 139AA of the Income Tax Act 1961 Section 139AA of the Income Tax Act 1961 which was inserted by the Finance Act 2017, mandates the quoting of an Aadhaar number in the application for a Permanent Account Number (PAN) and in the return of income tax. Failure to intimate an Aadhaar number results in the PAN being deemed invalid retrospectively. Section 139AA of the Income Tax Act 1962 is postulated on the requirement of Aadhaar having been enacted under a valid piece of legislation. The validity of the legislation seeding Aadhaar to PAN is dependent upon and cannot be segregated from the validity of the parent Aadhaar legislation. The decision in Puttaswamy has recognised that protection of the interests of the revenue constitutes a legitimate state aim in the three-pronged test of proportionality. The circumstances which have been adverted to in the decision in Binoy Viswam are a sufficient indicator of the legitimate concerns of the revenue to curb tax evasion, by embarking upon a programme for JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 113 de-duplication of the Pan data base. A legitimate state aim does exist. However, that in itself is not sufficient to uphold the validity of the law, which must meet the other parameters of proportionality spelt out in Puttaswamy. The explanation to Section 139AA adopts the definition of the expressions ‘Aadhaar number’, ‘enrolment’ and ‘resident’ from the parent Aadhaar legislation. The seeding of Aadhaar with Pan cards must depend for its validity on the constitutional validity of the Aadhaar legislation. Hence, besides affirming that the object of the measure in Section 139AA constitutes a legitimate state aim, the decision of this Court in regard to the validity of Aadhaar will impact upon the seeding of PAN with Aadhaar, which Section 139AA seeks to achieve. [Paras 271, 278][995-A; 1003-B; 1005- D-F] Binoy Viswam v. Union of India (2017) 7 SCC 59 : [2017] 7 SCR 1; Malpe Vishwanath Acharya v. State of Maharashtra (1998) 2 SCC 1 : [1997] 6 Suppl. SCR 717; Mardia Chemicals Ltd. v. Union of India (2004) 4 SCC 311 : [2004] 3 SCR 982; State of Tamil Nadu v. K Shyam Sunder (2011) 8 SCC 737 : [2011] 11 SCR 1094; Andhra Pradesh Dairy Development Corporation Federation v. B Narasimha Reddy (2011) 9 SCC 286 : [2011] 14 SCR 1; K T Plantation Private Limited v. State of Karnataka (2011) 9 SCC 1 : [2011] 13 SCR 636; Avishek Goenka v. Union of India (2012) 5 SCC 275 : [2012] 5 SCR 547 – referred to. 4.8 Linking of SIM cards and Aadhaar numbers The state cannot be oblivious to the need to protect privacy and of the dangers inherent in the utilization of the Aadhaar platform by telecom service providers. In the absence of adequate safeguards, the biometric data of mobile subscribers can be seriously compromised and exploited for commercial gain. While asserting the need for proper verification, the state cannot disregard the countervailing requirements of preserving the integrity of biometric data and the privacy of mobile phone subscribers. The mere existence of a legitimate state aim will not justify the means which are adopted. Ends do not justify means, at least as a matter of constitutional principle. For the means to be valid, they must be carefully tailored to achieve a A B C D E F G H 114 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H legitimate state aim and should not be either disproportionate or excessive in their encroachment on individual liberties. Mobile technology has become a ubiquitous feature of our age. Mobile phones are not just instruments to facilitate a telephone conversation. They are a storehouse of data reflecting upon personal preferences, lifestyles and individual choices. They bear upon family life, the workplace and personal intimacies. The conflation of biometric data with SIM cards is replete with grave dangers to personal autonomy. A constitution based on liberal values cannot countenance an encroachment of this nature. The decision to link Aadhaar numbers to SIM cards and to enforce a regime of e-KYC authentication clearly does not pass constitutional muster and must stand invalidated. All TSPs shall be directed by the Union government and by TRAI to forthwith delete the biometric data and Aadhaar details of all subscribers within two weeks. The above data and Aadhaar details shall not be used or purveyed by any TSP or any other person or agency on their behalf for any purpose whatsoever. [Paras 283, 284, 285][1008-G-H; 1009-A, C-F]

5. Money laundering rules 5.1 Parliament enacted a law on money-laundering as part of a concerted effort by the international community to deal with activities which constitute a threat to financial systems and to the integrity and sovereignty of nations. Rule 9 of the 2005 Rules requires every reporting entity to carry out client due diligence at the time of the commencement of an account-based relationship. Due diligence requires a verification of the identity of the client and a determination of whether the client is acting on behalf of a beneficial owner, who then has to be identified. [Paras 286, 288][1009-G-H; 1013-E] Lokniti Foundation v. Union of India (2017) 7 SCC 155; Bombay Dyeing and Mfg v. Bombay Environmental Action Group (2006) 3 SCC 434 : [2006] 2 SCR 920 – referred to. 5.2 As a result of the amendment to the Rules brought about in 2017, Rule 9(4) mandates that in the case of a client who is an individual, who is eligible to be enrolled for an Aadhaar number, submission of the Aadhaar number is mandatory. Instead of furnishing an option to submit one of six OVDs, submission of JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 115 Aadhaar number alone is mandated. Where an Aadhaar number has not been assigned, proof of an application for enrolment is required to be submitted. Under Rule 9(15), the reporting entity at the time of receipt of an Aadhaar number is under an obligation to carry out authentication using either the e-KYC authentication facility or the yes/no authentication provided by UIDAI. If a client who is eligible to be enrolled for Aadhaar and to obtain a PAN card does not submit its details while commencing an account based relationship, there is a period of six months reserved for submission. Those who already have accounts are required to submit their Aadhaar numbers by a stipulated date. Failure to do so, renders the account subject to the consequence that it shall cease to be operational until compliance is effected. [Para 295][1022-C-F]

5.3 The state has a legitimate aim in preventing money- laundering. In fact, it is with a view to curb and deal with money- laundering that the original version of the Master Circular as well as its updated version impose conditions for initial and on- going due diligence. The Reserve Bank has introduced several reporting requirements including those required to comply with FATCA norms. The existence of a legitimate state aim satisfies only one element of proportionality. Requiring every client in an account based relationship to link the Aadhaar number with a bank account and to impose an authentication requirement, is excessive to the aim and object of the state. There can be no presumption that all existing account holders as well as every individual who seeks to open an account in future is a likely money-launderer. The type of client, the nature of the business relationship, the nature and value of the transactions and the terrorism and laundering risks involved may furnish a basis for distinguishing between cases and clients. The rules also fail to make a distinction between opening an account and operating an account. If an account has been opened in the past, it would be on the basis of an established identity. The consequences of the non-submission of an Aadhaar number are draconian. Non- submission within the stipulated period will result in a consequence of the account ceasing to be operational. A perfectly genuine customer who is involved in no wrongdoing would be deprived of the use of the moneys and investments reflected in A B C D E F G H 116 SUPREME COURT REPORTS [2018] 8 S.C.R. the account, in violation of Article 300A of the Constitution purely on an assumption that he or she has indulged in money- laundering. The classification is over-inclusive: a uniform requirement of such a nature cannot be imposed on every account based relationship irrespective of the risks involved to the financial system. The account of a pensioner or of a salaried wage earner cannot be termed with the same brush as a high net- worth individual with cross-border inflows and outflows. Treating every account holder with a highly intrusive norm suffers from manifest arbitrariness. Blocking an account is a deprivation of property under Article 300A. The Union Government has been unable to discharge the burden of establishing that this was the least intrusive means of achieving its aim to prevent money- laundering or that its object would have been defeated if it were not to impose the requirement of a compulsory linking of Aadhaar numbers with all account based relationships with the reporting entity. Money-laundering is indeed a serious matter and the Union Government is entitled to take necessary steps including by classifying transactions and sources which give rise to reasonable grounds for suspecting a violation of law. But, to impose a uniform requirement of linking Aadhaar numbers with all account based relationships is clearly disproportionate and excessive. It fails to meet the test of proportionality and suffers from manifest arbitrariness. [Para 296][1022-G-H; 1023-A-H; 1024-A-B]

6. Savings in Section 59

6.1 Section 59 is a validating provision. It seeks to validate all the actions of the Central Government prior to the Aadhaar Act, which were done under the notifications of 28 January 2009 and 12 September 2015. Section 59 does not validate actions of the state governments or of private entities. Acts undertaken by the State governments and by private entities are not saved by Section 59. The website of the Press Information Bureau of the Government of India states that, by the time Aadhaar Act was notified by the Central government, UIDAI had generated about 100 crore Aadhaar numbers. The collection of biometrics from individuals prior to the enactment of the Aadhaar Act does not fall within the scope of the 2009 notification. Having failed to specify finger prints and iris scans in the notification, the validating A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 117 provision does not extend to the collection of biometric data before the Act. The 2009 notification did not provide authority to any government department or to any entity to collect biometrics. Since the collection of biometrics was not authorised by the 2009 notification, Section 59 of the Aadhaar Act does not validate these actions. [Paras 302, 303][1027-B-C, E-G]

6.2 The invasion of any right flowing from privacy places a heavy onus upon the State to justify its actions. Nine judges of this Court in Puttaswamy categorically held that there must be a valid law in existence to encroach upon the right to privacy. A valid law, in this case, would mean a law enacted by Parliament, which is just, fair and reasonable. Any encroachment upon the fundamental right to privacy cannot be sustained by an executive notification. There is also no merit in the submission of the Respondents that prior to the enactment of the Aadhaar Act, no individual has been enrolled under compulsion, and since all enrolments were voluntary, these cannot be considered to be in breach of Article 21 or any other fundamental right. The format of the first two enrolment forms used by UIDAI, under which around 90 crore enrolments were done, had no mention of informed consent or the use of biometrics. Apart from the existence of a valid law which authorises an invasion of privacy, Puttaswamy requires that the law must have adequate safeguards for the collection and storage of personal data. Data protection, which is intrinsic to privacy, seeks to protect the autonomy of the individual. The judgment noted the centrality of consent in a data protection regime. The Aadhaar Act provides certain safeguards in Section 3(2) and Section 8(3) for the purposes of ensuring informed consent, and in terms of Section 29 read with Chapter VII in the form of penalties. The safeguards provided under the Act were not in existence before the enactment of the Act. The collection of biometrics after the 2009 notification and prior to the Aadhaar Act suffers from the absence of adequate safeguards. While a legislature has the power to legislate retrospectively, it cannot retrospectively create a deeming fiction about the existence of safeguards in the past to justify an encroachment on a fundamental right. At the time when the enrolments took place prior to the enactment of the Aadhaar Act A B C D E F G H 118 SUPREME COURT REPORTS [2018] 8 S.C.R. in September 2016, there was an absence of adequate safeguards. Section 59 cannot by a deeming fiction, as it were, extend the safeguards provided under the Act to the enrolments done earlier. This will be impermissible simply because the informed consent of those individuals, whose Aadhaar numbers were generated in that period cannot be retrospectively legislated by an assumption of law. Moreover, it is a principle of criminal law that it cannot be applied retrospectively to acts which were not offences at the time when they took place. Article 20(1) of the Constitution provides that “No person shall be convicted of any offence except for violation of the law in force at the time of the commission of the act charged as an offence”. The application of the criminal provisions of the Act, provided under Chapter VII of the Act which deals with “Offences and Penalties”, cannot be extended to the period prior to the enactment of the Aadhaar Act. [Para 304][1028-B-G; 1029-A-D]

6.4 Section 43A applies only to bodies corporate and has no application to government or to its departments. Explanation (i) defines body corporate to mean any company and to include a firm, sole proprietorship or other association of individuals engaged in professional or commercial activities. Personal information leaked or lost by government agencies will not be covered under Section 43A. The scope of Section 66E is limited. It only deals with the privacy of the “private area” of any person. It does not deal with informational privacy. The scope of Section 72A is also limited. It only penalises acts of disclosing personal information about a person obtained while providing services under a lawful contract. Section 66C deals with identity theft and punishes the dishonest or fraudulent use of the unique identification feature of a person. The Information Technology Act also does not penalise unauthorised access to the Central Identities Data Repository. Many of the safeguards which were introduced by the Aadhaar Act were not comprehended in the provisions of the Information Technology Act.[Para 306][1032- D-F] K Industries Ltd v. Union of India (2007) 13 SCC 673 : [2007] 12 SCR 136; West Ramnad Electric Distribution Co. Ltd. v. State of Madras [1963] 2 SCR A B C D E F G H JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 119 747; State of Mysore v. D. Achiah Chetty, Etc1 (1969) 1 SCC 248 : [1969] 3 SCR 55; Hari Singh v. Military Estate Officer (1972) 2 SCC 239 : [1973] 1 SCR 515; State of Karnataka v. State of Tamil Nadu (2017) 3 SCC 362 : [2016] 8 SCR 499; Jaora Sugar Mills (P) Ltd. v. State of Madhya Pradesh [1966] 1 SCR 523; SKG Sugar Ltd. v. State of Bihar (1974) 4 SCC 827 : [1975] 1 SCR 312; Krishna Chandra Gangopadhyaya v. Union of India (1975) 2 SCC 302 : [1975] Suppl. SCR 151 – referred to.

6.5 There were several deficiencies in the collection of biometric data during the period between 2009 and 2016, before the Aadhaar Act came into force. The first was the absence of enabling legislation. As a result, the collection of sensitive personal information took place without the authority of law. Second, the notification of 2009 did not authorize the collection of biometric data. Third, the collection of biometric data was without an enabling framework of the nature which the Aadhaar Act put into place with effect from 2016. The Aadhaar Act introduced a regime for obtaining informed consent, securing the confidentiality of information collected from citizens, penalties and offences for breach and regulated the uses to which the data which was collected could be put. In the absence of safeguards, the collection of biometric data prior of the enactment of Aadhaar Act 2016 is ultra vires. [Para 317][1041-G-H; 1042-A-B] State of A P v. McDowell & Co (1996) 3 SCC 709 : [1996] 3 SCR 721; State of Madhya Pradesh v. Rakesh Kohli (2012) 6 SCC 312 : [2012] 6 SCR 661; Rajbala v. State of Haryana (2016) 2 SCC 445 : [2015] 12 SCR 1106; Ajay Hasia v. Khalid Mujib Sehravardi (1981) 1 SCC 722 : [1981] 2 SCR 79; Dr. K R Lakshmanan v. State of T N (1996) 2 SCC 226 : [1996] 1 SCR 395; E P Royappa v. State of Tamil Nadu (1974) 4 SCC 3 : [1974] 2 SCR 348; Bishambhar Nath Kohli v. State of Uttar Pradesh [1966] 2 SCR 158; State of Karnataka v. State of Tamil Nadu (2017) 3 SCC 362 : [2016] 8 SCR 499; Amarendra Kumar Mohapatra v. State of Orissa (2014) 4 SCC 583 : [2014] 2 SCR 1031; A B C D E F G H 120 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H Shri Prithvi Cotton Mills Ltd v. Broach Borough Municipality (1969) 2 SCC 283 : [1970] 1 SCR 388 – referred to.

7. Rule of law and violation of interim orders

7.1 The rule of law is the cornerstone of modern democratic societies and protects the foundational values of a democracy. When the rule of law is interpreted as a principle of constitutionalism, it assumes a division of governmental powers or functions that inhibits the exercise of arbitrary State power. It also assumes the generality of law: the individual’s protection from arbitrary power consists in the fact that her personal dealings with the State are regulated by general rules, binding on private citizens and public officials alike. It envisages a fundamental separation of powers among different organs of the State. Separation of power supports the accountability aspect of the rule of law. Separation of the judicial and executive powers is an essential feature of the rule of law. By entrusting the power of judicial review to courts, the doctrine prevents government officials from having the last word on whether they have acted illegally. The separation of judicial power provides an effective check on the executive branch. [Para 323][1046-C-E]

7.2 Interim orders of courts are an integral element of judicial review. Interim directions issued on the basis of the prima facie findings in a case are temporary arrangements till the matter is finally decided. Interim orders ensure that the cause which is being agitated does not become infructuous before the final hearing. The power of judicial review is not only about the writs issued by superior courts or the striking down of governmental action. Entrustment of judicial review is accompanied by a duty to ensure that judicial orders are complied with. Unless orders are enforced, citizens will lose faith in the efficacy of judicial review and in the legal system. When the Aadhaar Act was notified on 25 March 2016, the interim directions issued by this court were in operation. Once a law was enacted by Parliament, a statutory authorisation was brought into existence to enable government to issue administrative instructions. Hence, compliance with the interim orders stands obviated upon the enactment of the law. [Paras 331, 333][1054-A-B; 1059-A, B-C] JUSTICE K. S. PUTTASWAMY (RETD.) v. UNION OF INDIA 121

7.3 Judicial orders, be they interim or final, cannot simply be wished away. If governments or citizens were allowed to ignore judicially enforceable directions, that would negate the basis of the rule of law. Both propriety and constitutional duty required Union government to move this Court after the enactment of the Aadhaar Act for variation of the interim orders. The existence of law (post 2016) is only one aspect to be considered in deciding the interim arrangement which would hold the field when the constitutional challenge was pending adjudication before this Court. Institutions of governance are bound by a sense of constitutional morality which requires them to abide by judicial orders. What seems to emerge from the course of action which has been followed in the present case by government is a perception that judicial directions can be ignored on a supposed construction of the statute. Besides the fact that this construction is erroneous in law, it is above all, the fundamental duty of this Court to ensure that its orders are not treated with disdain. [Para 334][1060-C, D-F] Sahib Ram Jawaya Kapur v. State of Punjab [1955] 2 SCR 225; S G Jaisinghani v. Union of India [1967] 2 SCR 703; Smt Indira Nehru Gandhi v. Shri Raj Narain (1975) Supp SCC 1 : [1976] SCR 347; State of Tamil Nadu v. State of Kerala (2014)12 SCC 696; State of Bihar v. Bal Mukund Sah (2000) 4 SCC 640 : [2000] 2 SCR 299; Additional District Magistrate, Jabalpur v. Shivakant Shukla (1976) 2 SCC 521 : [1976] Suppl. SCR 172; L Chandra Kumar v. Union of India (1997) 3 SCC 261 : [1997] 2 SCR 1186; I R Coelho v. State of Tamil Nadu (2007) 2 SCC 1 : [2007] 1 SCR 706; Krishna Kumar Singh v. State of Bihar (2017) 3 SCC 1 : [2017] 5 SCR 160; State of M.P. v. Thakur Bharat Singh [1967] 2 SCR 454; S P Sampath Kumar v. Union of India (1987) 1 SCC 124 : [1987] 1 SCR 435; K.T. Plantation (P) Ltd. v. State of Karnataka (2011) 9 SCC 1 : [2011] 13 SCR 636; State of Assam v. Barak Upatyaka DU Karmachari Sanstha (2009) 5 SCC 694; Bhubaneshwar Singh v. Union of India (1994) 6 SCC 77 : [1994] 1 Suppl. SCR 639; P Sambamurthy v. State A B C D E F G H 122 SUPREME COURT REPORTS [2018] 8 S.C.R. A B C D E F G H