First Performance Review of UIDAI by CAG

In News 

• The Comptroller and Auditor General (CAG) has pulled up the Unique Identification Authority of India (UIDAI) for “deficient data management” as data of Aadhaar card holders have not been matched with Aadhaar number even after 10 years in some cases.

Major Issues highlighted by CAG 

• Data-matching, errors: 
  • There are issues of data-matching, errors in authentication, and shortfall in archiving
  •  The data of Aadhaar card holders have not been matched with their Aadhaar number even after 10 years in some cases.
• Authentication errors:
  • It has also criticised the absence of a system to analyse the factors leading to authentication errors, and said that even though UIDAI was maintaining one of the largest biometric databases in the world, it did not have a data archiving policy, which is considered “a vital storage management best practice”.
    • UIDAI provided Authentication services to banks, mobile operators and other agencies free of charge till March 2019, contrary to the provisions of their own Regulations, depriving revenue to the Government

• Deduplication: 
  • The CAG registered instances of issuance of Aadhaars with the same biometric data to different individuals indicating flaws in the deduplication process and issue of Aadhaars on faulty biometrics and documents.
    • The ‘deduplication process’ remained vulnerable for generating multiple Aadhaar numbers and manual interventions had to be done to resolve the problem
• Privacy and Safety concerns: 

• The CAG has flagged that UIDAI has not ensured that the applications or devices used by agencies or companies for authentication “were not capable of storing the personal information of the residents, which put the privacy of residents at risk”.
• The Authority had not ensured security and safety of data in Aadhaar vaults. They had not independently conducted any verification of compliance to the process involved.

• Incomplete information:
  •  The UIDAI has not prescribed any specific proof, document, or process to confirm whether a person who is applying for Aadhaar has resided in India for the period specified by the Rules.
  • Therefore, “there is no assurance that all the Aadhaar holders in the country are ‘Residents’ as defined in the Aadhaar Act”
  • UIDAI generated Aadhaar numbers with incomplete information, which, along with the lack of proper documentation or poor quality biometrics, have resulted in multiple or duplicate Aadhaar cards being issued to the same person.
• Delivery related issues: 
  • The UIDAI does not have adequate arrangements with the postal department, due to which a large number of Aadhaar cards were returned to the government after they could not be delivered to their intended recipients.

Suggestions /Recommendations 

• The UIDAI should go beyond self-declaration, and “prescribe a procedure and required documentation other than self-declaration, in order to confirm and authenticate the residence status of applicants.
• UIDAI needs to strengthen the Automated Biometric Identification System, so that generation of duplicate Aadhaar can be curbed at the initial stage itself.
• UIDAI needs to establish alternate ways to determine the unique identity of children below five years.
• UIDAI should frame a suitable data archival policy to mitigate the risk of vulnerability to data protection.
• UIDAI may levy penalties on biometric service providers for deficiencies in their performance in respect of biometric de-duplication  and biometric authentication… agreements in this regard should be modified, if required.

Source :IE