Read Time: 11 minutes

Maintaining one’s privacy has been one of the hottest topics in the past few years. In an important decision, the Delhi High Court recently said that the Unique Identification Authority of India (UIDAI) can be directed to provide the Aadhaar data about a missing person, even without a hearing. The Court clarified that this could be done only in “exceptional circumstances”.

The Aadhaar data from the UIDAI, has to be strictly secured and cannot be released without the consent of the individual concerned. This is as per Sections 28 and 33 of the Aadhar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. The whole case came up before the Court after a daughter approached the court claiming that her mother was missing and therefore, filed a writ of habeas corpus. Notably, the petitioner’s mother was not traceable despite repeated efforts made by the Delhi Police all while the mother’s Aadhaar details were continuously being updated. This, the court said, is an exceptional circumstance.

“In addition, considering the urgency of the matter, and in order to safeguard the safety and security of an individual, UIDAI can also be directed by the High Court dealing with the Habeas Corpus petition, in exceptional cases such as the present one, to disclose the data to the Court in a sealed cover, even without being afforded a prior hearing. In a habeas corpus, there is a sense of urgency, with which the Court has to act as the missing person could be in danger. Under such circumstances, the UIDAI can be directed to provide the data forthwith".
– High Court’s order

The Court has rightly attempted to draw a balance between an individual’s privacy with respect to their data and the safety & well-being of that individual, says Niharika Karanjawala, Principal Associate, Karanjawala & Co. adding,

“While in the normal course, in terms of the provisions of the Aadhar Act, 2016, a High Court could not order disclosure of any information collected by the UIDAI without first giving both the Authority as well as the Aadhar number holder a chance to be heard, circumstances such as the instant case, where police are unable to trace the whereabouts of an individual pursuant to a Habeus Corpus case, present an inherent challenge to the requirement of withholding such information until the Aadhar number holder can be heard. As such, in a circumstance where the very safety and wellbeing of the individual are in question and hinge on the individual being located, the Hon’ble Court has rightly dispensed with the requirement to hear such an individual first”.

In K.S. Puttuswamy v. Union of India, the Supreme Court affirmed that Aadhaar data constitutes private and personal information. This data must be kept confidential, with the UIDAI ensuring its protection. Based on this, Advocate on Record Sumeer Sodhi opined that the judgment creates an exception for disclosure of information in a manner which is otherwise prohibited by law viz the court cannot direct disclosure of information without notice to the owner of the information. The phrase “exceptional circumstance” can vary according to the need of the hour and hence, is prone to dilution in the future by other courts, he added.

“For certain judges, locating a proclaimed offender can be an exceptional circumstance and so on. Therefore, when it comes to privacy and protection of personal data, such a wide discretion cannot be left to the court and hence, the law should be followed in letter and spirit.”

The Digital Personal Data Protection Act was enacted last year to process digital personal data in a manner that recognizes both the right of individuals to protect their data and the need to process such personal data for lawful purposes.

Since Privacy protection has become increasingly important as communication and information technology has advanced, the Parliament enacted the DPDP Act, Vikas Jain, Advocate on Record & Partner at Avika Law Offices, said.

“Although democratic governments have traditionally backed individual liberties such as the right to free expression and movement, the growth of smart devices has raised privacy concerns. Nowadays, anyone can utilize technological technology to intrude on another person's privacy, making legal protection of this right even more crucial.”

While the DPDP Act does not lay down specific circumstances in which an individual’s data may be shared without them being heard on the matter, the provisions of section 33 of the Aadhar Act, 2016, read alongside the observations in the instant case would help create a guideline for any future circumstance where a High Court is faced with a similar issue as in this case, Karanjawala said.

But – does UIDAI come under the ambit of the DPDP Act as a data fiduciary? As per the 2023 Act, data fiduciary means any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data. That question is yet to be tested by a court of law as the provisions of the DPDP Act are less stringent than the Aadhaar Act, Jain opined.