Why the Aadhaar verdict is a roadblock for businesses collecting KYC details

When Delhi-based digital marketing professional Sudarshan Sahu requested digital wallet firm Paytm to complete his know your customer (KYC) process for his wallet in August, he was surprised to find a vendor at his doorstep three days later, armed with a thumb scanner to link his Aadhaar number to the account. 

In another instance, if a customer wants to avail an offer for a cardless equated monthly instalment on Amazon Pay, he or she must do so through another entity such as digital finance company Capital Float as the e-commerce company does not provide credit directly. To apply for a loan, the person has to provide his or her Aadhaar details, a virtual identification number generated through it and PAN card details on the Amazon app.

These are just some of the ways in which companies and businesses have sought to verify customer data using the Aadhaar number.

Coercive measures to link Aadhaar for verification have now been pared down. The verdict on Aadhaar by a Constitution Bench of the Supreme Court on Wednesday struck down Section 57 of the Aadhaar Act which allows private entities to use the 12-digit unique identity number for verification purposes. However, this does not address the data which people have already shared with companies, banks, telcos and others.

When contacted, Paytm, Amazon Pay and Capital Float declined to comment on the verdict or its implications on their businesses. In April, Paytm had told The Times of India that it had 100 million KYC-compliant users for its mobile wallet service.

Lack of clarity on shared data

According to Abhisaar Bairagi, principal associate at law firm Khaitan & Co, these companies were drawing on the power of Section 57 of the Act, where a corporate or a body can ask an individual for his or her Aadhaar number as long as there was a legal sanction. This legal backing came in the form of various circulars, similar to the one issued by the Department of Telecom (DoT) which mandated that users were required to submit Aadhaar details to avail new connections. 

“The judgement says we need a stronger Data Protection Bill and the Supreme Court sees this as the need of the hour,” Bairagi added.

There is little clarity on the data already collected. However, the judgement does say that data gathered for authentication can only be stored for six months, whereas in its original form, the Aadhaar Act allowed for a five-year time frame. 

In a dissenting judgement, Justice Chandrachud states that all biometric data and Aadhaar details collected by telecom service providers will have to be deleted in a time frame of two weeks under the direction of the Telecom Regulatory Authority of India. For example, a user applying for a new SIM card or porting to a telecom service such as Airtel is de riguer required to provide his or her thumb imprint for verification.

Airtel, Yes Bank and RBL Bank declined to comment on the implications of the verdict.

“We respect the Aadhaar verdict of the Hon’ble Supreme Court. We are going to review the judgement and its implications. We shall await further orders and instructions from DoT. Our member operators, as always, will definitely comply with the law,” said Rajan S Mathews, director general of the Cellular Operators Association of India.

Some businesses were agile in implementing corrective measures immediately. Soon after the verdict was announced, the KYC for Ola Money, the wallet for ride-hailing app Ola, was temporarily disabled.

Similarly, peer-to-peer lending platform LenDen Club said that the company, which was using virtual identification number for verification, will move to physical verification with immediate effect for KYC processes. 

“Though the verdict does not affect us, we believe that this will be a regressive move for fin-tech companies as they will eventually move to the traditional mode of verifying individuals. Thereby, the turnaround time for processing loans will increase considerably,” said Bhavin Patel, co-founder of LenDen Club.

The startup does not have any provision to de-link Aadhaar numbers. “What's done is done till today. From now on, physical verifications will be practiced,” he added.

Till the air clears on the implication of sharing Aadhaar data with institutions, the easy loan or cashback on wallet might be worth the wait.