Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 concern. When it comes to the State or the instrumentality of the State, the matter has to be taken with all seriousness, on the touchstone of constitutionalism and the concept of limited Government. (ii) Law on Data Protection: 163) In order to determine this aspect, i.e. the nature and magnitude of data protection that is required to enable legal collection and use of biometric data, reliance can be placed on (a) various existing legislations both in India and across the world; and (b) case law including the judgment in K.S. Puttaswamy. (a) Legislation in India: (i) Information Technology Act, 2000 The only existing legislation covering data protection related to biometric information are Section 43A and Section 72A of the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (hereinafter Sensitive Personal Data Rules). Although the IT Act and Rules do not determine the constitutionality of use of biometric data and information by the Aadhaar Act and Rules, they are instructive in determining the safeguards that must be taken to collect biometric information 68. 164) Following are the provisions which cover biometric information under the IT Act: Section 43A of the IT Act attaches liability to a body corporate, which is possessing, handling and dealing with any 68 A challenge to the Aadhaar project for violation of IT Act and Rules has been filed in the Delhi High Court in the matter of Shamnad Basheer v UIDAI and Ors. Therefore, we are not dealing with this aspect, nor does it arise for consideration in these proceedings. sensitive personal information or data and is negligent in implementing and maintaining reasonable security practices resulting in wrongful loss or wrongful gain to any person. Sensitive personal information or data is defined under Rule 3 of the Sensitive Personal Data Rules to include information relating to biometric data. Section 43A reads as follows: 43A. Compensation for failure to protect data. -Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected. Explanation. -For the purposes of this section,(i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities; Indian Kanoon - http://indiankanoon.org/doc/127517806/ 127