An Indian visitor (r) receives cash from a bank employee after withdrawing money from his bank account with his AADHAAR or Unique Identification (UID) card during a Digi Dhan Mela, held to promote digital payment, in Hyderabad, Jan. 18. The Digi Dhan mela is a government initiative aimed at digital transformation in the country following the recent demonetization. (Noah Seelam/AFP/Getty Images)

Dismissing reports of misuse of biometrics data, the Indian government said, March 5, Aadhaar-based authentication is “fully safe and secure.” Moreover, subsidy transfers linked to Aadhaar has led the exchequer to save Rs. 49,000 crore during the last two and a half years. – @Siliconeer #Siliconeer #Aadhar #DigitalIndia #UIDAI

According to Unique Identification Authority of India (UIDAI), there has been no incident of misuse of Aadhaar biometrics leading to identity theft and financial loss when more than 400 crore Aadhaar authenticated transactions took place during the last five years, it said.

UIDAI also said that it has carefully gone through various reports and would like to emphasize that there has been no breach to UIDAI database of Aadhaar in any manner whatsoever and personal data of individuals held by UIDAI is fully safe and secure.

An Indian Sikh (c) looks through an optical biometric reader, which scans and individual’s iris patterns, during registration for AADHAAR cards or Unique Identification (UID) cards in Amritsar, Punjab, May 24, 2011. The Unique Identification Authority of India (UIDAI) is responsible for implementing the envisioned Multipurpose National Identity Card or Unique Identification card (UID Card) project in the country. (Narinder Nanu/AFP/Getty Images)

“Aadhaar-based authentication is robust and secure as compared to any other contemporary systems. Aadhaar system has the capability to inquire into any instance of misuse of biometrics and identity theft and initiate action,” it said.

With reference to an incident of misuse of biometrics reported in a newspaper, UIDAI said that it is an isolated case of an employee working with a bank’s Business Correspondent’s company making an attempt to misuse his own biometrics which was detected by UIDAI internal security system and subsequently actions under the Aadhaar Act were initiated.

Responding to media reports about on-boarding of the ecosystem partners, UIDAI said that the regulations under the Aadhaar Act strictly regulate the on-boarding, functioning including the data sharing restrictions imposed on the companies which want to use Aadhaar information.

UIDAI further said that Aadhaar is an important tool of good governance and empowerment of people and has helped more than 4.47 crore people open bank accounts through Aadhaar e-KYC.

It has enabled the government to do Direct Benefit Transfers under various schemes including LPG subsidy and has helped the exchequer save over Rs 49,000 crores during the last two and a half years.

Aadhaar-based Public Distributions System is benefiting people by ensuring that their food grain entitlement are given only to the deserving beneficiaries and are not cornered by unscrupulous and corrupt elements, it said.

Local residents line up at the AADHAAR Card Camp, during the Public Information Campaign, at Swaroopganj, Sirohi District, Rajasthan, Dec. 10, 2015. (Press Information Bureau)

With reference to reports that there are no extant regulations available to prevent storage and misuse of e-KYC data, while citing instances like capturing IRIS from high resolution photograph, UIDAI said that there are stringent provisions in the Aadhaar (Authentication) Regulations governing the usage of e-KYC data including storage and sharing, resident consent being paramount in both the cases.

Any unauthorized capture of IRIS or fingerprints or storage or replay of biometrics or their misuse is a criminal offence under the Aadhaar Act, it said.

On reports of misuse of e-KYC data by various agencies and allegations that the e-KYC API is available in public domain, UIDAI said that e-KYC APIs are available only to authorized Authentication User Agencies (AUAs) and e-KYC User Agencies (KUAs) through authorized Authentication Service agencies (ASAs) which have established secured network connectivity for the purpose of authentication with the Central Identities Data Repository (CIDR).

The authorization is in compliance with the regulations, specifications, standards and technology architecture as prescribed, it said, adding, any violation would lead to penal action.

AADHAAR registration camp at the Public Information Campaign organized by the Press Information Bureau Thiruvananthapuram, at Vithura Grama Panchayath, Kerala, Nov. 26, 2014. (Press Information Bureau)

The statement said that news reports also speak of private agencies hired by mobile operators and banks for e-KYC leading to availability of these data in parallel database and the vulnerabilities in the scenario where there is no privacy law in the country.

In this regard, the authority pointed out that “Aadhaar authentication or e-KYC is only available to authorized agencies whose appointment, responsibilities, statutory obligations, penal provisions for contraventions are clearly provided for in the Aadhaar Act and the regulations framed thereunder.”

Banks or mobile operators have to become UIDAI’s AUA/ASAs to obtain e-KYC data of their customers from UIDAI.

The e-KYC data can be given by UIDAI to these agencies only after they obtain consent of their customers and can be used only for the purpose for which it was obtained.

Citing an example, it said, a telecom operator can obtain the e-KYC data of its subscribers and will keep them in their records without biometrics and use them only for the purpose of proving telecom services.

Similarly, a bank, after obtaining the e-KYC information of its account holders, will keep the information without their biometrics within the bank and will use it only for the purpose of providing banking services and cannot use it for any other purpose without obtaining consent of the customer, it said.

Members of Trinamool Mahila Congress protesting the Center’s moved to link mid-day meals with AADHAAR, at a rally in Kolkata, March 6. (Swapan Mahapatra/PTI)

UIDAI uses one of world’s most advanced encryption technologies in transmission and storage of data.

As a result, it said, that during the last 7 seven years, there has been no report of breach or leak of residents’ data.

The authority is continuously updating its security parameters looking at the new threats in cyber space, the statement said, adding, it also undertakes security audits and ensures necessary steps to augment security features.

UIDAI has decided to have registered devices for capturing biometrics data and such biometrics will be encrypted at the point of capture itself.