We’ve long been concerned about Aadhaar, the Indian national biometric identity database. Despite Supreme Court of India directives to the contrary, the Government of India has been pushing aggressively for Aadhaar to be linked, and indeed mandatory, to a large number of services. At the time of writing, Aadhaar is now required for 108 services, everything from food rations of rice to activating a SIM card. While the Aadhaar was sold as a way to reduce welfare fraud and improve welfare delivery, the system is increasingly being integrated by private companies, further complicating the public interest balance at play and the potential for substantial privacy harms.
As Aadhaar becomes increasingly pervasive, the impacts of the system are becoming increasingly invasive and forcing users to turn over their most personal details with little choice or control. This is not just about petrol subsidies and midday meals, a friend of mine recently was asked for his Aadhaar number by Amazon. The product he bought had been marked by the delivery man as delivered, even though it wasn’t. When my friend contacted Amazon’s customer service, he was told that they needed his Aadhaar number to investigate. Clearly, this is a far cry from improving welfare delivery, something Aadhaar is failing at too.
My friend’s experience, one which is shared by many other Indians, raises a number of questions, not just for Amazon, but for all private companies integrating Aadhaar:
- Do company policies (in this case, Amazon’s) now require users to have an Aadhaar number in order to have a lost package investigated? If so, for what purpose(s)? Is this pursuant to a ruling, directive, or law enacted by the Government of India? If so, which one?
- Will Indians be required to link their accounts to Aadhaar numbers? If so, for what purpose(s)? What user benefit does this serve? What ruling, directive, or law requires this?
- What information, if any, is the company sharing with the Government of India and/or other third parties about Aadhaar-authenticated purchasing behaviour?
- Will the company access demographic information as part of using the Aadhaar and for what purposes (e.g., advertising)?
- What are the policies around customers who don’t have the Aadhaar? Are their lost packages not a concern? Will they eventually be blocked from buying goods and services?
- Why would the company require a greater burden of proof for identity verification in India than it does in other parts of the world?
- What steps is the company taking to protect the Aadhaar information that it collects? Who has access to this information? What purposes is this information used for?
- Is the company providing and requiring security training for all staff that handle Aadhaar data?
While raising some of these questions on Twitter with Amazon India, I wasn’t surprised to find that others had faced the same coercion to link Aadhaar numbers with their Amazon accounts. Do you have other stories where Amazon or other companies have unexpectedly asked for your Aadhaar number? Please let us know by filling out this form. We’re looking to compile stories like this to help shine a light on how private companies are dangerously and unnecessarily integrating Aadhaar into their systems.