One of the many issues raised by the petitioners challenging the constitutionality of the Aadhaar Act 2016, was the legality of the very act of collecting fingerprints and iris scans.
As Shyam Divan, senior advocate for one of the petitioners phrased it in court during the arguments last year in the Binoy Viswam case (challenging the PAN-Aadhaar linking):
My fingerprints and iris are mine and my own. As far as I am concerned, the State cannot take away my body. This imperils my life. As long as my body is concerned, the State cannot expropriate it without consent, and for a limited purpose.
Those were widely reported lines that captured the imagination of many people. The Binoy Viswam judgment records Divan’s legal argument in the following words:
“The right to life extends to allowing a person to preserve and protect his or her finger prints and iris scan. The strongest and most secure manner of a person protecting this facet of his or her bodily integrity and identity is to retain and not part with finger prints/iris scan.”
These arguments were meant to establish that the very act of collecting biometrics was in violation of bodily integrity of the citizens and that biometrics were personal information protected under the informational privacy doctrine.
An added bonus for the petitioners was that Divan’s widely reported lines provoked the-then attorney general Mukul Rohatgi to proclaim in court that “Citizens don’t have absolute right over their bodies”. That utterance sounded ominous in the following day’s press.
Ultimately, the Binoy Viswam case did not examine the issue on the grounds that the nine judges had yet to decide the issue of whether privacy was a fundamental right.
The nine judges last year agreed that privacy was a fundamental right and that bodily integrity and informational privacy were components of the fundamental right to privacy. Since the judges only laid down principles without deciding the constitutionality of the Aadhaar programme, the issue of whether collection of biometrics violated bodily integrity was raised once again before the 5 judges who delivered, on September 26, 2018 the three judgments running into 1,448 pages.
Are biometrics any different from photographs?
One of the problems with the petitioner’s characterisation of biometric collection as “expropriation of the human body” (as I pointed out earlier in these pages) is that biometrics are simply high quality photographs and as we all know when a camera is used to take a photographs of our faces it does not expropriate any part of our face. If the court was to declare a scan of a fingerprint as an expropriation of a body, it would necessarily have to conclude that even the photograph of the face is expropriation of the body.
Consequential reasoning aside, it is difficult to understand, even from a conceptual standpoint as to how scanning fingerprints or iris scans violates the bodily integrity. Issues like laws disallowing abortions or contraceptives for women, forced stress positions, where agents of the state curb the ability of a person to control their own bodies definitely results in violation of bodily integrity because harm is caused to the body by an agent of the state.
The mere scanning of either fingerprints or iris scans does not result in citizens losing control over their body. At best, the petitioners had an arguable case to classify biometrics as personal information that is protected under the theory of informational privacy. This is an issue that even the Unique Identification Authority of India (UIDAI) agrees to.
The majority opinion
The majority judgment by Justice Sikri states that an “Iris scan is nothing but a photograph of the eye, taken in the same manner as a face photograph.” They also state that “Finger print and iris scan have been considered to be the most accurate and non-invasive mode of identifying an individual.” (page 320) This conclusion is logical and the court should have concluded that the mere collection of biometrics does not violate bodily integrity.
Except the majority then proceed to make the following worrying conclusion:
“There is no reasonable expectation of privacy with respect to fingerprint and iris scan as they are not dealing with the intimate or private sphere of the individual but are used solely for authentication”.
In the same breadth, the majority also concludes that biometrics are unique identifiers. If some information is unique to a person, and forms a part of the identity, it is only logical that it be classified as personal information that requires to be protected under the informational privacy doctrine.
It is not clear why the majority concluded that there is no reasonable expectation of privacy with regard to biometrics because even the Aadhaar Act, 2016 concedes this point when it grants core biometrics the highest level of data protection under the legislation.
The concurring opinion
Justice Bhushan borrows similar reasoning from the majority to conclude that fingerprints and iris scans are “non-invasive” (page 1109), while also agreeing that an “Iris scan is nothing but a photograph of the eyes taken from a camera.” (page 1108) Again, this analysis was enough to deal with the bodily integrity argument but the reasoning that follows is as worrying as that of the majority.
Justice Bhushan specifically states that “From fingerprints and iris scans nothing is revealed with regard to a person” and “there is no reasonable expectation of privacy” with regards to biometric information.
And like the majority, he also concludes that: “The fingerprint and iris scan have been considered to be most accurate and non-invasive mode of identifying an individual.” (Page 1108-09)
But if the biometric information serves as a unique identifier for each individual does it then not deserve to be classified as personal information which the state is obligated to protect under the fundamental right to informational privacy?
The dissenting judgment by Justice Chandrachud leans the other way. He is silent on the majority’s classification of the technology as nothing but photographs. On whether collection of biometrics is a violation of bodily integrity he is silent. Rather he classifies it as a violation of the personal space, stating:
“The collection of most forms of biometric data requires some infringement of the data subject’s personal space. Iris and fingerprint scanners require close proximity of biometric sensors to body parts such as eyes, hands and fingertips.” (page 754)
His judgment however does not push the analysis far enough to conclude that it is a violation of bodily integrity. Rather, he states that:
“The use of biometric technology is only likely to grow dramatically both in the private and public sector. On our part, we can only ensure that the strides made in technology are accompanied by stringent legal and technical safeguards so that biometrics do not become a threat to privacy.” (Page 784).
This is an implicit recognition that biometrics are better protected under the head of informational privacy which means that the state can collect information but subject to restrictions and safeguards.
To, collect such biometrics, Justice Chandrachud reasons that the government must demonstrate “…a compelling legitimate interest in using biometric technology” and that governments must follow the “no harm principles” which according to him means “that biometrics and digital identity should not be used by the issuing authority…….to serve purposes that could harm the individuals holding the identification”. (Page 786)
The rest of Justice Chandrachud’s dissent analyses whether the Aadhaar Act provides a “compelling legitimate interest” for the collection of biometric information, which will be the subject of a separate article.
To conclude, none of the five judges agreed with the petitioners that collection of fingerprints and iris scans violate bodily integrity.
This was a predictable result because of the outlandish nature of the argument in the first place but what is quite surprising is the conclusion by four judges that there is no reasonable expectation of privacy with regard to fingerprints and iris scans.
That conclusion is baffling since these same judges also conclude that fingerprints and iris scans are the most accurate unique identifiers. Why did these judges arrive at such a conclusion when even the UIDAI concedes that fingerprints and iris scans are personal information that are accorded the highest level of protection?
Prashant Reddy T. is a an Asst. Professor at NALSAR University of Law, Hyderabad.