A retired judge, multiple Magsaysay award recipients and a retired army major general, among others, became unlikely allies in the fight against Aadhaar at the Supreme Court. The constitutional challenge against Aadhaar also led to the landmark judgment in 2017 on the Right to Privacy.

Only one judge was common between the Right to Privacy judgment and the judgment on the constitutional validity of Aadhaar—Justice D.Y. Chandrachud. He held the entire Aadhaar project to be unconstitutional on multiple grounds, including for violation of privacy.

However, a majority of four judges held that the Act and the national biometric identity project was constitutional by and large, and allowed the mandatory collection of biometrics by the government.

Effectively, it also allowed the government to force us to provide our Aadhaar numbers to receive subsidies (though not for rights, which they unfortunately see as distinct), or for purposes that meet the three-fold “legality-necessity-proportionality” test, which mandatory linking of Aadhaar with PAN apparently does. The majority opinion written by Justice A.K. Sikri, however, does fundamentally change Aadhaar.

The Congress has long accused the Bharatiya Janata Party-led National Democratic Alliance of changing the mandate of Aadhaar from a welfare-delivery aid and turning it into a gargantuan mass surveillance machine by linking it to everything and allowing even private parties to demand your Aadhaar number.

However, there is no function-creep. Such uses of Aadhaar were envisioned even in November 2009, when a 40-page “working paper”, which was marked “confidential”, was circulated to the participants of a workshop held by the then-nascent UIDAI. Aadhaar, from the very beginning, even when it was “UID”, had always been envisioned as an “identity infrastructure” project, which the state as well as the private entities could use, and which other IDs can be built on top of.

This vision of Aadhaar has been severely curtailed by the Supreme Court. The majority opinion makes it clear that Aadhaar may only be used by the government, and not by private parties, although the way the justices have chosen to do that, by reading down Section 57 of the Aadhaar Act, is not, in this author’s view, ideal.

In a way, the UIDAI seems to have made peace with this even before the judgment came out. The Justice B.N. Srikrishna Committee, which had UIDAI’s chief executive officer as a member, had recommended amendments to the Aadhaar Act, which would have had a similar effect of preventing private parties from authenticating people’s identities by asking the UIDAI.

There are many challenges that still remain. First, is the impact of mandating Aadhaar on the poor: Rather than enabling easier access, it ends up harming them by denying them their rights. The second is that of privacy. We need a strong data protection law that prevents the government and private parties from non-consensually using Aadhaar—the Justice Srikrishna recommendations provide a good starting point for that. Lastly, the risks of a nation- or state-wide biometric database remains. They could treat de-duplication as a one-time exercise, and seek to improve birth registration and use birth certificates as a way of ensuring uniqueness of ID. That way, governments could destroy their biometric databases, yet still keep a unique national ID.

Pranesh Prakash is an Affiliated Fellow at the Yale Law School’s Information Society Project.