Aadhaar has become the world’s largest biometric identity system, with approximately 1.34 billion active users and over 17 billion authentication transactions completed to date, as disclosed to the Parliament on Wednesday. Union Minister of State for Electronics and Information Technology Jitin Prasada informed the Lok Sabha that the Unique Identification Authority of India (UIDAI) maintains the Aadhaar ecosystem, which is crucial for identity verification in service delivery. The UIDAI offers Aadhaar authentication services to authorized entities, enabling identity verification through methods like one-time passwords (OTPs), biometrics such as fingerprints, iris, and face scans, or demographic information.
Aadhaar-based face authentication, utilized by authorized entities, leverages artificial intelligence and machine learning technologies to ensure precise verification. Prasada mentioned that entities wishing to utilize Aadhaar authentication services must be onboarded as Authentication User Agencies (AUAs) or KYC User Agencies (KUAs) in accordance with the Aadhaar Act’s provisions. Regarding data access and retention, Prasada stated that AUAs and KUAs maintain authentication logs for two years, accessible to Aadhaar holders for grievance redressal, with subsequent archiving for five years before deletion.
The Aadhaar ecosystem is constructed with robust privacy protections, with demographic data encrypted during storage and transmission, coupled with legal constraints on its collection, storage, and utilization. Prasada emphasized that UIDAI adheres to a three-tier audit framework, encompassing self-compliance audits, annual information security audits, and governance, risk, compliance, and privacy (GRCP) audits to ensure system integrity. Moreover, stringent standard operating procedures mandate user informed consent, restricted authentication use for specific purposes, secure data storage, certified device usage, and prohibition on biometric data retention by entities.
The government clarified that Aadhaar data is stored and processed within India, with measures in place to prevent any violation of these regulations.
