India’s successful adoption of unique biometric identities, popularly known as Aadhaar, has catalyzed inclusion and innovation in the delivery of financial services. While Aadhaar enabled remarkable gains, the program has always raised concerns over the appropriate place of a digital ID in broader social and economic activity. With the Indian Supreme Court moving to restrict the use of Aadhaar in 2018, its role in the financial system is now something of an open question. For now, India’s financial market participants—from banks and technology firms to regulators and consumers—will have to adjust to evolving rules as they confront a number of emerging issues raised by a digitizing economy, including how to balance personal data rights with gains in inclusion and innovation.
Aadhaar’s Big Dream
An Aadhaar identity is comprised of a physical card and number associated with unique biometrics (fingerprint and iris data) and demographic information. When Aadhaar first launched a decade ago, its proponents envisioned a digital future for India’s economy and society built on a broader ecosystem known as the India Stack. An Aadhaar identity would serve as a passport into the Stack ecosystem. Government transfers for items like food subsidies or scholarships would be delivered through Aadhaar-enabled payment rails and bank accounts, which were expected to prevent corruption and funds leakage. Under this design, India’s previously unbanked consumers would gain access to the formal financial system. Innovative companies would leverage the Aadhaar database, populated by nearly every living Indian adult, to offer financial services to new customers by way of Aadhaar’s streamlined handling of Know Your Customer compliance.
The good news: Much of this future has come true. Aadhaar has enabled the government’s innovative Direct Benefits Transfer program, which sends money to many of India’s poorest households, using digital payment and banking services offered to anyone with an Aadhaar identity. These direct transfers have saved the government an estimated 900 billion rupees ($12.4 billion) through March 2018 due to a reduction in corruption and funds diversion to other purposes. All Aadhaar cardholders have access to simple savings accounts, basic credit in the form of overdraft privileges, and the ability to conduct digital payments using the most basic, low-cost mobile phone. Meanwhile, a number of traditional institutions and new technology start-ups have taken advantage of the Aadhaar database to lower customer acquisition costs and deliver services to people previously excluded from the financial system.
The not-so-good news: The rollout of Aadhaar has been accompanied by some unintended consequences, which is not entirely surprising. The Indian government began requiring Aadhaar for the receipt of many government services—and it became a de facto requirement for some private services like mobile phone activation—but before every Indian adult had gained access. Some Aadhaar holders faced further access challenges, particularly the rural poor and disabled. Moreover, access does not necessarily lead consumers to use the new system, and India continues to confront the challenge of getting the newly banked to use their new accounts—an issue faced around the world by policy makers pursuing financial inclusion. Notwithstanding these challenges, in broad terms, Aadhaar has become a critical piece of the emerging digital economy.
Pushback at the Supreme Court
A full realization of the Aadhaar-enabled digital economy is now in some doubt as private firms face new restrictions in using the program. The Indian Supreme Court, which has long deliberated over a number of issues related to Aadhaar and data rights, ruled in September 2018 that private firms could no longer require Aadhaar as a form of authentication for customers, based on concerns that doing so would exclude those Indians that do not have an Aadhaar card. The ruling further prohibited private firms from using the biometric keys embedded in Aadhaar identities for electronic Know Your Customer (eKYC) verification, based on separate data privacy and security concerns.
The limits on private use of Aadhaar calls into question a range of new payment rails and financial accounts enabled by Aadhaar and operated by private financial institutions—from some of the country’s largest banks to innovative fintech firms. The Indian parliament is contemplating an amendment to the Aadhaar Act to permit broader use in banking and telecommunications, and the Reserve Bank of India encourages firms to verify identity with alternative tools like offline QR codes—which serve as an Aadhaar token that can authenticate without revealing sensitive data. Meanwhile, a number of companies are reassessing their reliance on the program.
Evolving to Protect Emerging Data Rights
While the Supreme Court’s ruling has been interpreted in some quarters as a barrier to broader use of Aadhaar in India’s digital economy, it might be more accurately seen as a necessary speed bump. In the same ruling the Indian Supreme Court clearly affirmed Aadhaar’s value as a tool of economic empowerment, but emphasized the need to balance “two competing fundamental rights, right to privacy on one hand, and right to food, shelter, and employment on the other hand.” Aadhaar’s various applications arguably touch on an even broader range of data rights than those addressed by the court. These include the right to privacy but also areas like security, ownership, portability, interpretability, and the right to be forgotten.
In India and any other country seeking to transition to a digital economy, a unique digital ID will arguably need to satisfy, protect, and enable all of these emerging data rights—whether they are codified in law or entrenched in the norms and values of digital society—if they are to become central to future activity. Global sentiment around privacy rights indicates consumers do want more transparency and control over the use of their data, while increasingly frequent data breaches emphasize the importance of security. India is not alone in facing concerns over unique identifiers that impact privacy and security. In the United States, nearly 150 million Americans were exposed to the 2017 Equifax data breach that exposed social security numbers—which were not originally intended for broad use as a unique identifier. In the case of India, Aadhaar stakeholders will need to provide assurances that biometric IDs remain secure.
Indian policy makers and regulators are still weighing the appropriate response to the court’s ruling, but under consideration are a new data protection bill and amendment to the Aadhaar act. The data protection bill is likely to have similarities to regimes such as the General Data Protection Regulation in Europe, while amendments to the Aadhaar act will aim to codify and enable the use of Aadhaar by banks and telecommunications companies. Still, many questions remain unresolved. Will less regulated technology firms still be able to take advantage of Aadhaar eKYC, which has substantially lowered the cost of customer acquisition and enabled real innovation by new entrants? Will the Unique Identity Authority of India, the operator and regulator of Aadhaar, provide sufficient oversight of data privacy and security to satisfy the Indian Supreme Court and consumer demands? Will proposed alternatives for Aadhaar eKYC like QR codes work seamlessly for users, or add cumbersome steps that encourage other more costly forms of authentication, particularly in rural areas where limited internet connectivity creates last-mile delivery hurdles?
Building a New Model for Digital Identity
Asking and addressing these hard questions will be beneficial for the financial system in the long run. Aadhaar and the India Stack ecosystem have the opportunity to establish new global standards for digital identities. The courts and broader society have raised valid concerns about the broad use of such identities, which appear to be leading to more thoughtful caretaking of data rights. If implemented effectively, new protections need not inhibit innovation or inclusion, but make gains more sustainable and entrench Aadhaar as a key tool in digital life. If India can effectively address these issues, its new framework just might serve as a model for the rest of the world.
The views expressed here do not necessarily reflect the views of the management of the Federal Reserve Bank of San Francisco or of the Board of Governors of the Federal Reserve System.