Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 149) Insofar as the aspect of privacy of individual is concerned, that would be dealt with in detail while addressing that issue. To segregate issue of surveillance from privacy, we are focusing the discussion to the aspect whether there is sufficient data available with the respondents which may facilitate the profiling and misuse thereof or whether there are sufficient safeguards to ward off the same. In the process, we would be discussing the issues pertaining to data protection as well. At the same time, there would be some overlapping of discussion inasmuch as it will have to be seen as to the collection, storage and use of biometric data satisfies the proportionality principle. 150) It is clear that the argument of the petitioners is that on the basis of the data available with the Authority, there can be a profiling of an individual which may make the surveillance state. And such a mass surveillance is not permitted by the Constitution of India. The entire foofaraw about the Aadhaar architecture is the so- called enormous information that would be available to the Government on using Aadhaar card by residents. Two issues arise from the respective arguments of the parties: (a) whether the architecture of the Aadhaar project enables the Sate to create a regime of surveillance?; and (b) whether there are adequate provisions for data protection? 151) Insofar as issue (a) above is concerned, after going through the various aspects of the Aadhaar project, the provisions of the Aadhaar Act and the manner in which it operates, it is difficult to accept the argument of the petitioners. The respondents have explained that the enrolment and authentication processes are strongly regulated so that data is secure. The enrolment agency, which collects the biometric and demographic of the individuals during enrolment, is appointed either by UIDAI or by a Registrar [Section 2(s)]. The Registrars are appointed through MoUs or agreements for enrolment and are to abide by a code of conduct and processes, policies and guidelines issued by the Authority. They are responsible for the process of enrolment. Categories of persons eligible for appointment are limited by the Regulations. The agency employs a certified supervisor, an operator and a verifier under Enrolment and Update Regulations. Registrars and the enrolling agencies are obliged to use the software provided or authorized by UIDAI for enrolment purpose. The standard software has security features as specified by the Authority. All equipment used is as per the specification issued by the Authority. The Registrars are prohibited from using the information collected for any purpose other than uploading the information to CIDR. Sub-contracting of enrolment function is not allowed. The Code of Conduct contains specific directions for following the confidentiality, privacy and security protocols and submission of periodic reports of enrolment. Not only there are directions prohibiting manipulation and fraudulent practices but the Act contains penal provisions for such violations in Chapter VII of the Regulations. The enrolment agencies are empanelled by the Authority. They are given an enrolling agency code using which the Registrar can onboard such agency to the CIDR. The enrolment data is uploaded to the Central Identities Data Repository (CIDR) certified equipment and software with a digital signature of the Registrar/enrolling agency. The data is encrypted immediately upon capture. The decryption key is with the UIDAI solely. Section 2(ze) of the Information Technology Act, 2000 (hereinafter referred to as the IT Act) which defines secure systems and Section 2(w) of the Act, which defines Indian Kanoon - http://indiankanoon.org/doc/127517806/ 121