By Simran Jalan (firstname.lastname@example.org)
The Supreme Court announced a landmark ruling in the case of Justice K.S. Puttaswamy (Retd.) & Anr. V. Union of India, W.P. (Civil) 494/2012 dated September 26, 2018. (“Aadhaar Verdict”), the one which the entire country was looking forward to, relating to the constitutional validity of the Aadhaar card and the Aadhaar Act. Since the very introduction of Aadhaar card, there have been innumerable applications against the same, however this ruling rests each of those.
One of the major highlight of the ruling is that the same has partially quashed section 57 of the Aadhaar Act, which dealt with use of Aadhaar by private companies or bodies corporate. This has posed a lot of operational difficulties of the startups especially the fintech startups and in this write up we intend to examine the same. But before we delve into further details let us understand what changes have been made to section 57 of the Aadhaar Act.
The ruling has struck down the last phrase in the main provision of Section 57 of the Aadhaar Act., i.e. “or any contract to this effect”, which enabled fintech companies to use Aadhaar number for verifying the identity of a person for the purpose of KYC. Therefore, the section now reads as:
“Nothing contained in this Act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect“.
Earlier private entities and bodies corporate were allowed to use Aadhaar number of establishing identities of the customers, however, under the state of law, the private entities will not be able to demand Aadhaar for establishing identity unless the same is pursuant to any law. Therefore, this will change the way KYC checks were being conducted all this while.
Further, the judgement can be interpreted that if any person voluntarily wants to give Aadhaar as a proof of identity/proof of residence, then the same shall be valid. However, Unique Identification Authority of India (“UIDAI”) is seeking legal opinion on the authentication of Aadhaar provided voluntarily by the customers to such private companies and appropriate decisions are expected to be issued in the future.
Know Your Customer (“KYC”) is a process that allows business to identify their customers. This is a concept adopted by the sectoral regulators of different countries to prevent money laundering. RBI has issued Master Direction-Know Your Customer (KYC) Direction, 2016 to provide guidelines on the KYC done by the regulated entities. It further states that “The revised Master Direction is in accordance with the changes carried out in the PML Rules vide Gazette Notification GSR 538 (E) dated June 1, 2017 and thereafter and is subject to the final judgment of the Hon’ble Supreme Court in the case of Justice K.S. Puttaswamy (Retd.) & Anr. V. Union of India, W.P. (Civil) 494/2012 etc. (Aadhaar cases).”
Earlier, KYC was done physically. With the introduction of Aadhaar, the concept of e-KYC has emerged, which is the successor of paper based KYC. This Aadhar based e-KYC made the process of KYC simple and cost-effective for fintechs and telecos.
Post the Aadhaar Verdict, the private companies are barred from mandating Aadhaar for e-KYC compliance. Now the question arises that how will these companies do their KYC? To answer this question, UIDAI has allowed service providers to use offline tools for verification of Aadhar as a temporary solution until any proper legislation is framed in this respect. The offline tools to verify Aadhaar of a person is a method which will not require sharing of biometric details or involve UIDAI servers. Hence, such offline tools are in conformity with the Aadhaar Verdict.
The UIDAI has suggested two offline methods for verification of Aadhaar. The first method is by using the Quick Response (QR) codes. In this method, the company seeks the Aadhaar QR code form the customer, which can be provided via email or whatsapp. The same is required to be downloaded and printed and once the company purchases the QR code reader, an instant verification can be done. The QR code has the name, address and picture of the individual, but not the Aadhaar number. Such details are anyway available in other ID documents. However, the biometric details of the individual will be confidential and the privacy of the individual will not be tampered.
The second method is via Paperless local e-KYC. This method involves generation of a digitally signed Extensible Markup language (XML) which can be stored in laptop and phone. The XML offers a secure shareable document which can be used by the Aadhaar holder for offline verification of identification. The file so generated will contain only the name and address of the individual. Th Aadhaar holder has to take the file to the service provider for verifying the details.
However, it is to be noted, that both these tools are an interim solution and shall be used until any legislation is framed for KYC.
The striking down of Section 57 of the Aadhaar Act is a major setback for the fintechs and payment systems. These companies were highly dependent on Aadhaar for verifying their customers. The Aadhaar Verdict is likely to cause an adverse impact on the fintech companies as the cost of KYC for these companies will shoot up significantly. The government is trying to come up with a solution for all the problems created post the Aadhaar Verdict and have also sought for legislations from different sectors. Each sector has to study the judgement and decide how they will carry out their operations with or without the use of Aadhaar. This Aadhaar Verdict is a landmark judgement and it will slowly cater the problems faced by different sectors.