UIDAI cancels 4.75 lakh Aadhaars; CAG says strengthen data protection, biometrics

The Comptroller and Auditor General of India (CAG) has said that the Unique Identification Authority of India (UIDAI) had to cancel more than 4.75 lakh Aadhaars till November 2019 as part of its de-duplication exercise and called for strengthening UIDAI's Automated Biometric Identification System to avoid generation of multiple or duplicate Aadhaars at the initial stage itself. The apex auditor also called for the framing of a data archival policy to mitigate the risk of vulnerability to data protection and reduce saturation of valuable data space.

The observations are part of CAG's performance audit on the functioning of UIDAI for the period 2014-15 to 2018-19. However, statistical information on generation, update and authentication services of Aadhaar and financial information referred to in the report have been updated up to March 2021.

The report presented to the Parliament on April 6 wanted UIDAI to tighten the service level agreement (SLA) parameters of Biometric Service Providers (BSPs), devise foolproof mechanisms for capturing unique biometric data and improve upon their monitoring systems to proactively identify and take action to minimise, multiple/duplicate Aadhaar numbers generated. It also blamed UIDAI for the delay in fixing fees for authentication services and providing free services for the first three years. "UIDAI took three years from the enactment of the Aadhaar Act 2016 to decide the applicable fees for authentication services and allowed a large number of authentication transactions without charging any fees, in violation of their own Regulations, resulting in loss of revenue to the Government," the CAG observed.

The report noted that there is no assurance that all the Aadhaar holders in the country are 'Residents' as defined in the Aadhaar Act as UIDAI takes confirmation of the residential status through a casual self-declaration from the applicant without insisting upon any documental proof. It wanted UIDAI to prescribe a procedure and required documentation other than self-declaration, in order to confirm and authenticate the residence status of applicants, in line with the provisions of the Aadhaar Act. Similarly, it wanted UIDAI to explore alternate ways to capture uniqueness of biometric identity for minor children below five years instead of the current practice of issuing Aadhaar numbers to minor children below the age of five, based on the bio metrics of their parents.