The Ministry of Electronic & Information Technology (MeitY) released the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules, 2023 (GG Rules, 2023) on April 20, 2023 for public consultation. Read the joint submission on the GG Rules, 2023 by Article 21 Trust, Rethink Aadhaar Campaign, Access Now, and Internet Freedom Foundation.
An interesting infraction that has been normalised is that it seems some private companies have already started making Aadhaar verification mandatory, seemingly without permission.
Although there are legal provisions for “requesting entities” that already provide the necessary authentication permissions to authorised private companies, the Act nevertheless does not permit making Aadhaar based authentication mandatory, which appears to have occurred without oversight under the operating regime for requesting entities (the Aadhar Authentication and Offline Verification Regulations, 2021 which supersede the Aadhar Authentication Regulations, 2016)
I guess this leads one to ask how the proposed and prevalent additions to the operating regime through the Authentication for Good Governance Rules, 2020, which provide for an additional mode of approving authentication requests for ostensibly vague purposes is different from the operating regime for requesting entities prior to the rules which regulate “requesting entities” in general and when operating as KUAs and AUAs. To study the differences in order to shed light on the actual operation of these vague purposes, it might help if one studies the proposals and notification of entities requesting authorisation under the 2020 Rules, so far. It might help to study the activities of a requesting entity which violates the legal provisions, of which there seem to be many.
If the good folks at IFF could share what they have observed in the requests made under the 2020 Rules, it would make a substantial difference to understanding the materialisation of these vaguely delineated purposes.