The court ruled that in habeas corpus cases, disclosure of personal data, such as Aadhaar information, may be permitted without prior consent due to urgency, provided confidentiality is maintained.

JUDGMENT :

Prathiba M. Singh, J.

1. This hearing has been done through hybrid mode.

2. The Petitioner has filed the present writ petition under Article 226 of the Constitution of India read with Section 528 of the Bharatiya Nagarik Suraksha Sanhita, 2023 seeking a writ of habeas corpus directing the Respondents to produce her mother, who is missing since 15th May, 2019. Continuous efforts are being made to trace the whereabouts of Petitioner’s mother.

3. Vide order dated 11th July, 2024 and 23rd July, 2024, the Court had directed the concerned officials of UIDAI to be present in Court and file a status report regarding any information in respect of the Petitioner’s mother as also her Aadhaar Card including address etc.,

4. Mr. Ankur Singh Chauhan and Mr. Deepak Soni, Deputy Director of UIDAI and Assistant Director, Legal of UIDAI respectively are present in Court. They have handed over to the Court in a sealed cover the contact details etc., available with them (without biometric data) of the missing lady, who is the mother of the Petitioner. The four different printouts, which have been shown to the Court are of data updated as on 11th August, 2011, 26th April, 2016, 21st February, 2024 and 9th July, 2024.

5. The said data also reveals that initially the Petitioner’s mother had given her address as Srinivas Puri, New Delhi and thereafter, the address given is of Rudauli, Faizabad, Uttar Pradesh and the latest data given is that she is in Ward No.2, Harijan Basti, Hansari, Jhansi, Uttar Pradesh. The latest mobile number has also been mentioned.

6. The Aadhar data, as per the officials, who have appeared before the Court from the UIDAI, has to be strictly secured and cannot be released without the consent of the individual concerned. Reliance is placed on Sections 28 and 33 of the Aadhar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (hereinafter ‘Aadhar Act’) respectively. Section 28-‘Security and confidentiality of information’ defines the responsibility of the authority to secure the identity of the individual and Section 33- ‘Disclosure of information in certain cases’ explains the situations in which the information can be disclosed on the order of a High Court. Relevant provisions have been extracted below:

Section 28- Security and confidentiality of information:

“28. Security and confidentiality of information.—(1) The Authority shall ensure the security of identity information and authentication records of individuals.

(2) Subject to the provisions of this Act, the Authority shall ensure confidentiality of identity information and authentication records of individuals.

(3) The Authority shall take all necessary measures to ensure that the information in the possession or control of the Authority, including information stored in the Central Identities Data Repository, is secured and protected against access, use or disclosure not permitted under this Act or regulations made thereunder, and against accidental or intentional destruction, loss or damage.

(4) Without prejudice to sub-sections (1) and (2), the Authority shall (a) adopt and implement appropriate technical and organisational security measures;

(b) ensure that the agencies, consultants, advisors or other persons appointed or engaged for performing any function of the Authority under this Act, have in place appropriate technical and organisational security measures for the information; and

(c) ensure that the agreements or arrangements entered into with such agencies, consultants, advisors or other persons, impose obligations equivalent to those imposed on the Authority under this Act, and require such agencies, consultants, advisors and other persons to act only on instructions from the Authority.

(5) Notwithstanding anything contained in any other law for the time being in force, and save as otherwise provided in this Act, the Authority or any of its officers or other employees or any agency that maintains the Central Identities Data Rep