Retired Army Officer's Aadhaar Privacy PIL: Karnataka High Court Seeks Centre's Response

The Karnataka High Court has called upon the Union government to file objections regarding an application seeking the restoration of a public interest litigation that challenges the legality of Aadhaar contracts with foreign private companies. The Division Bench, comprising Justice Anu Sivaraman and Justice T.P Vivekananda, granted time to Central Government Counsel M.N. Kumar after the plea was taken up for hearing. The matter is now scheduled for further proceedings on October 10, 2026.

The original PIL was filed by 82-year-old retired Army officer and defence missile scientist Mathew Thomas, who had earlier been a petitioner in the landmark Supreme Court case Justice K.S. Puttaswamy v. Union of India (2017), which established the fundamental right to privacy. In the present case, Thomas alleges that the contracts entered into by the Unique Identification Authority of India (UIDAI) with foreign biometric solution providers pose a grave threat to national sovereignty and violate the privacy rights of over a billion Indian citizens.

A Second Chance at Justice

The procedural journey of this PIL has been unusually complex. Thomas initially filed the petition before the Karnataka High Court in 2021 . In October 2022 , he withdrew the case with the court's liberty to approach the Supreme Court under Article 32 of the Constitution . However, when the matter reached the apex court, it observed on July 8, 2024 , that there was "really no occasion for the High Court to grant liberty to the petitioner to move the Supreme Court ." Consequently, the Supreme Court disposed of the petition while granting Thomas the liberty to once again approach the High Court for restoration of the PIL under Article 226 . This restoration application is the subject of the current proceedings.

The petitioner's counsel, Advocate Chaitanya S. G., argued that the facts raised in the present petition were not considered or adjudicated by the Supreme Court in the Puttaswamy judgment. He stressed that the matter involves issues of national security because the biometric and demographic details of millions of citizens are at stake, and that private data has been compromised and handed over to foreign entities and defence contractors through the impugned agreements.

Contracts Under Scrutiny

The PIL specifically challenges three contracts executed in 2010. The first is between the President of India (acting through the Director General, UIDAI) and M/s. L1 Identity Solutions, a US-based company that later became part of French defence contractor Safran and is now known as IDEMIA. The second is a contract with M/s. Accenture Services Pvt. Ltd. The third involves a collaboration between M/s. Satyam Computer Services Ltd., an Indian company, and MorphoSafran, a French defence contractor.

The petitioner contends that these Biometric Solution Providers (BSPs) were originally US-based companies that serve as contractors to the US Defence and Homeland Security departments as well as US intelligence agencies. By entering into agreements with such entities, the UIDAI has allegedly authorized them to collect, use, store, transfer, process, and link the personal data of Indian residents.

Privacy and National Security at Stake

One of the most alarming allegations in the petition concerns a contractual clause that treats biometric algorithms as a "black box." This clause, according to the petitioner, means that UIDAI has no control over the processing of inputs and outputs within these systems, effectively giving foreign entities unfettered control over the database. The plea originally filed in 2021 states: "The citizens of India have been made to think that the government in its own capacity is collecting those databases. In reality, private agencies are operating in the guise of government bodies and are siphoning away valuable information which could very well lead to a major security threat to our nation."

The petition further argues that linking the Aadhaar number to various other databases—such as those for banking, taxation, and ration cards—could enable real-time tracking of citizens. Such tracking, enabled by international contracts, would also affect top government officials, judges, and armed forces personnel, whose whereabouts and details are sensitive in nature, potentially exposing them to foreign intelligence agencies.

Technical Legal Challenge

In addition to the privacy and security grounds, the petitioner has raised a technical legal challenge regarding the execution of the contracts. It is submitted that the agreements were prepared on Rs. 500 non-judicial stamp paper, which violates the provisions of the Registration Act, 1908, rendering them invalid. The petitioner therefore prays for the striking down of all three contracts as void in law.

The restoration application seeks a mandamus directing the Union of India not to use the existing UIDAI database for any purpose whatsoever. Alternatively, it prays for a direction to ensure that the data is not used for tracking citizens, or to destroy the entire database. Additionally, the data stored by the contractors should be destroyed and audited by Indian auditors. Other prayers include directing the Union to make suitable changes to the Aadhaar Act to achieve its objectives, and appointing a commission to decide on measures to prevent the misuse of data already in the possession of foreign entities.

What Lies Ahead

The Division Bench has granted time to the Central Government to file objections to the interim application for restoration. The matter is now listed for October 10, 2026, a date that suggests a lengthy procedural timeline ahead. Legal experts following the case note that if the PIL is restored and eventually heard on merits, it could have far-reaching implications for the Aadhaar ecosystem and the government's data governance framework.

The case also raises fundamental questions about the constitutional validity of outsourcing critical national identification infrastructure to foreign private entities, especially those with links to defence and intelligence agencies of other nations. For legal professionals, the interplay between the right to privacy, national security, and the legality of government contracts will be closely watched.

The matter is captioned as Mathew Thomas v. Union of India & Ors. (IA 1/24 in WP 17664/2021). With the court's next hearing set for October 2026, the legal community will have to wait to see whether this challenge gains traction and potentially reshapes the contours of data protection and sovereignty in India.