High Court Can Order UIDAI to Share Aadhaar Location Data for Investigations

Bengaluru, India – In a landmark judgment that meticulously balances the stringent privacy safeguards of the Aadhaar ecosystem with the exigent needs of law enforcement, the Karnataka High Court has affirmed its authority to direct the Unique Identification Authority of India (UIDAI) to disclose Aadhaar card usage and location data for the purpose of investigating missing persons cases. This pivotal ruling clarifies the scope of Section 33 of the Aadhaar Act, 2016, establishing a clear judicial pathway for accessing sensitive information in critical situations.

The decision, delivered by a single-judge bench of Justice Suraj Govindaraj, provides a significant precedent for law enforcement agencies nationwide, potentially transforming how they approach "cold" cases involving missing individuals. The court’s order came in response to a writ petition filed by a distressed father, Krishnamurthy, whose son has been missing since 2019. The case took a crucial turn when the petitioner discovered that his son's Aadhaar card had been used for an authenticated transaction on June 20, 2023, providing the first tangible lead in years.

This development prompted the petitioner to seek judicial intervention to compel UIDAI to share the location details associated with this authentication, a request that directly confronts the robust data protection and privacy provisions enshrined in the Aadhaar Act.

Navigating the Statutory Labyrinth: Section 29 vs. Section 33

The core of the legal deliberation rested on the interplay between two critical sections of the Aadhaar Act, 2016: Section 29, which imposes strict restrictions on sharing information, and Section 33, which carves out a specific exception for judicial orders.

Section 29(2) unequivocally states that UIDAI and its partner agencies shall not make public any identity information or authentication records. The Act further protects "core biometric information"—such as fingerprints and iris scans—from being shared with anyone for any reason whatsoever.

However, the petitioner’s counsel, Advocate Dinesh M Kulkarni, argued that the overarching restrictions of Section 29 are subject to the exceptional circumstances outlined in Section 33. This provision, titled "Disclosure of information in certain cases," acts as a non-obstante clause, empowering a court "not inferior to that of a Judge of a High Court" to order the disclosure of information, including identity details and authentication records.

In his detailed analysis, Justice Govindaraj concurred with this interpretation. The court emphasized the distinction between "core biometric information," which remains sacrosanct and inaccessible, and other forms of "identity information" and "authentication records," which can be disclosed under a High Court's order.

“The restriction is only as regards core biometric information," the bench observed. "Identity information would include Aadhaar number, biometric information and demographic information which can be furnished on an application being made.”

The court decisively held that Section 33 overrides the general prohibitions laid out in Section 29. "Section 33 makes it clear that nothing contained in Subsection (2) or (5) of Section 28 or Subsection (2) of Section 29 shall apply in respect of any disclosure of information... made pursuant to an order of a court not inferior to that of a Judge of a High Court," the order stated.

Justice Govindaraj articulated the procedural mechanism for law enforcement:

“When during the course of investigation by police authority or any investigating authority in the event of usage of Aadhaar card including authentication, etc. are required, an application can be made before the High Court in terms of Section 33 of the Act of 2016... and the High Court could examine the same after providing an opportunity to the UIDAI Authority and pass such orders as just and necessary, including providing of details of usage of Aadhaar card and the location where it has been used.”

This statement effectively establishes the High Court as the sole gatekeeper for such data requests, ensuring a high level of judicial scrutiny is applied before privacy safeguards are pierced for investigative purposes.

A Narrowly Tailored Order: Balancing Privacy and Justice

While establishing this powerful precedent, the Karnataka High Court was acutely conscious of the privacy implications. The final order was meticulously crafted to be as non-intrusive as possible, granting the police access only to the essential information required to advance their investigation.

The court directed UIDAI to furnish "only the details of location of the usage of Aadhaar card of the missing son of the Petitioner from the time of filing of the missing complaint till date." The order explicitly stated that "apart from the location of usage, no other details shall be furnished."

Furthermore, the court imposed a strict confidentiality clause on the police (Respondent No. 2), directing that they "shall not share such details/information with anyone else, apart from that required for the purposes of investigation." This two-fold safeguard—limiting the data disclosed and restricting its subsequent dissemination—is crucial in preventing the misuse of sensitive personal information and upholding the spirit of the Aadhaar Act's privacy framework.

Implications for Legal Practice and Law Enforcement

This judgment carries profound implications for both legal practitioners and investigative agencies.

1. A New Investigative Tool: For police departments, this ruling unlocks a potent new tool, especially in cases where traditional investigative methods have reached a dead end. In an increasingly digital India, where Aadhaar is linked to a multitude of services from banking to mobile connections, authentication records can provide vital, real-time leads on a person's whereabouts.

2. Jurisdictional Clarity: The decision provides unambiguous clarity that the High Court is the exclusive forum for such applications. This prevents forum shopping and ensures that requests for sensitive Aadhaar data are adjudicated by a high constitutional court capable of weighing the complex legal and privacy issues at stake.

3. Privacy Litigation: The judgment will undoubtedly be cited in future privacy litigation. While it permits data disclosure, its emphasis on judicial oversight, necessity, and proportionality reinforces the principles laid down by the Supreme Court in the Puttaswamy (Right to Privacy) judgment. It demonstrates a practical application of how the right to privacy, while fundamental, is not absolute and can be subject to reasonable restrictions in the interest of justice.

4. Guidance for UIDAI: The ruling provides UIDAI with a clear legal mandate and procedure to follow when faced with requests from law enforcement. By requiring a High Court order, it shields the authority from arbitrary demands and ensures that any disclosure is legally sanctioned.

The case, Krishnamurthy AND The Director UIDAI & ANR (WRIT PETITION NO. 105596 OF 2025), is a seminal development in the evolving jurisprudence surrounding data privacy and state surveillance in India. It carves a constitutionally sound and procedurally robust exception to Aadhaar's privacy rules, affirming that while an individual's data is protected, it is not beyond the reach of the law when a compelling case for justice is presented before the high courts of the land.