UIDAI introduces 'Virtual ID' to address privacy concerns

According to a statement by UIDAI, which administers Aadhaar, the VID can be generated and revoked only by the Aadhaar number holder through channels such as the Aadhaar portal and the mAadhaar mobile app. The older VID gets canceled each time the Aadhaar number holder issues a new one.

The issue of privacy of citizen data has picked up steam in the last week after The Tribune reported that an anonymous WhatsApp number was selling access to the entire Aadhaar database for as low as Rs 500.

The UIDAI has further introduced limited KYC (know your customer) process wherein only some entities, categorised as global authentication user agency (global AUA) will be allowed to store a citizen's Aadhaar number, while others, known as local AUAs will not be allowed to store Aadhaar numbers.

These agencies will be given a UIDAI token specific to them, to enable them to uniquely identify their customers.

The UID token, a unique character for system usage, will be unique to every authentication request made by a global or local AUA.

Currently, every agency that uses Aadhaar for KYC authenticates a user and often stores a person's Aadhaar number.

In the absence of strong data protection and privacy laws, the issue of what can be done with stored citizen information is a grey area.

The new measures do not specify what happens to the Aadhaar numbers that have already been stored by public or private entities. It also does not mention which AUAs would qualify as global or local.