Aadhaar and the right to privacy (Puttaswamy)

Cause title and case names

The short version

A retired High Court judge asked a simple question: can the government force you to hand over your fingerprints and iris scan to get a ration card? The Supreme Court answered it in two stages.

First, in August 2017, nine judges held unanimously that privacy is a fundamental right. A year later five judges decided that Aadhaar itself was valid, but not the way the government had been using it. Banks, mobile companies and schools lost the right to demand it. Benefits and tax filing did not.

What the case was about

Aadhaar is a 12-digit number issued by the Unique Identification Authority of India (UIDAI) against a person's fingerprints, iris scan and photograph. It started in 2009 as an executive scheme. A statute, the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, came later, and Parliament passed it as a Money Bill.

By then Aadhaar was being asked for everywhere. Government departments wanted it for subsidies and pensions. The income tax law wanted it for returns. The Reserve Bank and the telecom department wanted it for bank accounts and SIM cards. Schools asked for it at admission.

The petitioners made four points. Taking biometrics is an invasion of privacy. A national database is a security risk. Exclusion is real, because a failed fingerprint can mean a denied ration. And the 2016 Act could not have been passed as a Money Bill, which meant the Rajya Sabha was bypassed.

The government's first response was awkward. Its Attorney General told the Court in 2015 that there was no fundamental right to privacy, citing two old rulings. That is what made the larger bench necessary.

Who was involved

More than thirty petitions were heard together. Petitions that had been filed in some High Courts were tagged with the main case in the Supreme Court.

Issues before the Court

In the privacy reference (2017)

1. Is there a fundamental right to privacy in the Constitution?
2. If so, where does it come from and how far does it go?
3. Were M.P. Sharma (1954) and Kharak Singh (1962), which said there was none, rightly decided?

In the Aadhaar case (2018)

1. Does the Aadhaar scheme, including the biometric database, violate the right to privacy?
2. Was the Aadhaar Act validly passed as a Money Bill?
3. Is Aadhaar valid as a condition for subsidies, PAN, bank accounts, mobile numbers and school admission?
4. Is the section letting private companies use Aadhaar valid?

How it reached this stage

This was never a High Court or tribunal case. Justice Puttaswamy filed under Article 32 in the Supreme Court in 2012, long before Parliament passed the Aadhaar Act.

• 11 Aug 2015: a three-judge bench directed the government to publicise that Aadhaar was not mandatory for welfare schemes, and sent the constitutional questions, including privacy, to a larger bench.
• 15 Oct 2015: a five-judge bench led by Chief Justice H.L. Dattu modified that interim order. Aadhaar could be used, voluntarily, for a longer list of schemes (including MGNREGS, pensions, Jan Dhan and the EPF), and the privacy question again went to a larger bench.
• 18 Jul 2017: Chief Justice Khehar's bench, hearing the Aadhaar challenges, referred the privacy question to nine judges. Arguments before that bench began the next day.
• 2018: a separate five-judge Constitution Bench heard the actual Aadhaar challenge.

The Karnataka petitioner is why the case carries a Karnataka judge's name. The Aadhaar Act challenge itself drew petitioners from across the country, including cases that were filed first in High Courts.

The benches

Privacy, 2017 (nine judges)

J.S. Khehar (CJI), J. Chelameswar, S.A. Bobde, R.K. Agrawal, R.F. Nariman, A.M. Sapre, D.Y. Chandrachud, S.K. Kaul and S.A. Nazeer. There were six opinions. Chandrachud J. wrote the main one for himself, Khehar CJI, Agrawal and Nazeer JJ. Everyone agreed on the result.

Aadhaar, 2018 (five judges)

The hearing

Privacy reference

• The nine-judge bench heard arguments from 19 Jul 2017 to 2 Aug 2017.
• The hearing ended on 2 Aug 2017 and judgment followed on 24 Aug 2017.
• The Attorney General did not push for the old position in full. He accepted that privacy could be a fundamental right, but argued it would be a qualified right.

Aadhaar challenge

• Arguments began on 17 Jan 2018.
• The bench sat for 38 days. At the time, only Kesavananda Bharati had taken longer.
• Judgment was reserved on 10 May 2018 and pronounced on 26 Sep 2018, about four and a half months later.

What the Court held

Privacy, 24 Aug 2017

• Privacy is a fundamental right. It is part of the right to life and personal liberty under Article 21 and of the freedoms in Part III of the Constitution.
• M.P. Sharma and Kharak Singh were overruled to the extent they said otherwise.
• Any interference must pass three tests: there must be a law, a legitimate aim, and the interference must be proportionate to that aim.
• The lead opinion also called the majority view in ADM Jabalpur (1976) wrong.

Aadhaar, 26 Sep 2018

• The Aadhaar Act is constitutionally valid, and it was properly passed as a Money Bill (the majority view).
• Aadhaar can be required for subsidies and welfare benefits that the government funds.
• Linking PAN with Aadhaar, and using Aadhaar for filing income tax returns, was upheld.
• Making Aadhaar compulsory for opening bank accounts and for getting mobile connections was struck down.
• Schools cannot demand Aadhaar for admission, and it cannot be required for entrance examinations and similar tests.
• Section 57 of the Act, which let private entities use Aadhaar for authentication, was struck down.
• Section 33(2), which allowed disclosure of information on national security grounds, was struck down. Section 33(1), which allows disclosure on a District Judge's order, was read down so that the person affected must be heard first. Section 47, which let only UIDAI file a complaint about a data breach, was struck down so that individuals can complain too.
• Authentication records cannot be kept for more than six months. Children enrolled under the scheme must be allowed to exit it when they reach adulthood.
• Justice Chandrachud dissented. In his view the Act was wrongly passed as a Money Bill and so failed on that ground alone, and the scheme also failed on privacy.

What changed afterwards

The privacy ruling was used almost at once. In September 2018 the Court decriminalised same-sex relations (Navtej Singh Johar) and struck down the adultery offence (Joseph Shine). Both relied on the idea that intimate choices are private.

Parliament passed the Aadhaar and Other Laws (Amendment) Act in 2019, replacing a March 2019 ordinance. It allowed Aadhaar to be used for verification on a voluntary basis under the Telegraph Act and the Prevention of Money-laundering Act, which is how banks and telecom companies could continue to use it.

The review petitions were dismissed on 20 Jan 2021 by a 4:1 majority. The bench was Khanwilkar, Chandrachud, Bhushan, Nazeer and Gavai JJ. Chandrachud J. dissented and would have kept the review pending the larger-bench decision on the Money Bill question, which was being heard in another case (Rojer Mathew).

After the privacy ruling the government set up a committee under Justice B.N. Srikrishna on data protection, which reported in July 2018. A bill was introduced in 2019 and withdrawn in 2022. The Digital Personal Data Protection Act was enacted on 11 Aug 2023.

Related cases

• Kesavananda Bharati The 2017 bench relied on the same line of reasoning for fundamental rights.