UIDAI will issue 16-digit virtual ID to secure Aadhaar privacy

Only those with a valid Aadhaar number can generate their VID and revoke it after the UIDAI stipulates the minimum validity period.

"But, it (India) should not miss the digital revolution", Prasad said while mentioning the Justice Srikrishna Committee, which is working on making a robust law for data protection and anonymity. "No one else including the authentication agency can generate this VID on behalf of Aadhaar holder", the UIDAI explained. For instance, only your name, photo and address will be shared with a telco. "These are likely to be entities which require de-duplication for subsidy transfer, such as banks and government agencies".

"The last digit of the VID is the checksum using "Verhoeff" algorithm (for error detection) as in Aadhaar number".

VID will be temporary and it will not be possible to derive Aadhaar number from VID.

Delhi Police had on Monday registered the FIR on a complaint by an UIDAI official following the newspaper report on data breach of more than 1 billion Aadhaar cards, naming the journalist behind the story. The move comes in as UIDAI expects that it will ensure that no one, except the holder, can access the person's Aadhaar number.

You can also generate/replace VIDs on the Aadhaar mobile app and at enrolment centres. But it seems the idea is to create a virtual ID linked with the Aadhaar number, which will be linked with your profile. Lawyers say there is no legal recourse now available for citizens whose Aadhaar numbers are being stored by banks or telecom companies/insurers.

This will also reduce the ability to merge databases across agencies thus enhancing privacy substantially.

When will the limited KYC and UID Tokens be in place? "The virtual ID is a new format introduced by UIADI only now and could not obviously be retrospectively imposed", said Sanjay Hegde, lawyer, Supreme Court. According to the UIDAI.

- Aadhaar number holder can use VID in lieu of Aadhaar number whenever authentication or KYC services are performed. Aadhaar authentication is the process by which an Aadhaar holder's Aadhaar number along with the demographic information or biometric information is submitted to the Central Identities Data Repository (CIDR) for verification.

"I think this is a very significant announcement by UIDAI and in some sense it really makes the case against it go away", he said.

The UIDAI's and the government's cavalier attitude towards security in Aadhaar has been exposed many times over.

VID launch is on March 1, so you won't have to wait for long.

Further, all service providers will also need to upgrade their systems to support the new tool from June. Any non-compliance will invite action in the form of financial disincentives and termination of the said Agreement.

Nilekani was reacting to The Tribune's report from January 4, which alleged that the Aadhaar details of millions of users was easily accessible. For Rs. 500 or around US$8.

All the remaining AUAs will be branded as Local AUAs and will neither get access to full KYC, nor can they store the Aadhaar number on their systems.

The data collection scheme also received a lot of bad press after the government chose to file a lawsuit against the publication and the reporter who broke the story. The complete statement from UIDAI is available here. It may be recalled that Airtel used the e-KYC Aadhaar verification process to open payments bank accounts without consent of users.

Vanessa Coleman