The Unique Identification Authority of India (UIDAI) has said that the residents' informed consent before conducting the Aadhaar authentication is a must. Entities will need to take the approval of residents either on paper or electronically prior to conducting the Aadhaar authentication.
In its new guidelines for Requesting Entities (REs), UIDAI has asked the Requesting Entities, to ensure that residents understand the type of data that is being collected and the reason behind the Aadhaar authentication.
These logs of authentications including the consent taken are kept only for the time period that is prescribed in the Aadhaar regulations. It was also highlighted that this information is purged as per the Aadhaar Act and its regulations, once the expiry date is met.
It is to be noted that REs generally should not store Aadhaar either in physical or electronic form without masking or redacting the first 8 digits of the Aadhaar number. UIDAI has guided REs to store an Aadhaar number only if it is authorised to do so.
What are REs and what do they do?
Requesting Entities provide Aadhaar authentication services to residents. They submit their Aadhaar number and demographic/biometric OTP information to the central Identities Data Repository for authentication. In the release, UIDAI stressed that REs should be courteous to residents and assure them about the security and confidentiality of the Aadhaar numbers.
The Authority has also urged REs to immediately report to the UIDAI about any suspicious activity around authentications like suspected impersonation by residents, or any compromise or fraud by any authentication operator.