Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 (iii) Non-core biometric information comprising photograph; (iv) Core biometric information comprising finger print and iris scan. 193) Demographic information, both mandatory and optional, and photographs does not raise a reasonable expectation of privacy under Article 21 unless under special circumstances such as juveniles in conflict of law or a rape victims identity. Today, all global ID cards contain photographs for identification alongwith address, date of birth, gender etc. The demographic information is readily provided by individuals globally for disclosing identity while relating with others and while seeking benefits whether provided by government or by private entities, be it registration for citizenship, elections, passports, marriage or enrolment in educational institutions. Email ids and phone numbers are also available in public domain, For example in telephone directories. Aadhaar Act only uses demographic information which are not sensitive and where no reasonable expectation of privacy exists - name, date of birth, address, gender, mobile number and e mail address. Section 2(k) specifically provides that Regulations cannot include race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Thus, sensitive information specifically stand excluded. 194) We find that Section 32 (3) of the Aadhaar Act specifically prohibits the authority from collecting, storing or maintaining, either directly or indirectly any information about the purpose of authentication. The proviso to Regulation 26 of Authentication Regulations is also to the same effect. 195) Thus, the principle of data minimization is largely followed. 196) With this, we advert to some other provisions, challenge whereof is based on threat to security of the data. These are Section 2(c), Section 2(g) and Section 2(h) read with Section 10 of the Aadhaar Act. Section 2(c) pertains to authentication. It is a process by which Aadhaar number along with demographic information or biometric information of an individual is submitted to the CIDR for its verification. On submission thereof, the CIDR verifies the correctness or lack of it. CIDR is defined in Section 2(h). Section 10 lays down that the Authority may engage one or more entities to establish or maintain the CIDR and to perform any other functions as may be specified by regulations. 197) Insofar as authentication process is concerned, that has already been taken note of above. The manner in which it is explained by the respondent authority, that may not pose much of a problem. As noted earlier, while seeking authentication, neither the location of the person whoso identity is to be verified nor the purpose for which authentication of such identity is needed, comes to the knowledge of the Authority and, therefore, such data collected by the Authority. Therefore, the threat to real time surveillance and profiling may be far-fetched. The respondents have explained that Section 2(d) defines authentication record to mean the record of the time of authentication, identity of the RE and the response provided by the authority, Regulation 26 (a) to (d) does not go beyond the scope of Section 2(d). None of the four clauses of Regulation 26 entitle the authority to store data about the purpose for which authentication is being done. The device can therefore only Indian Kanoon - http://indiankanoon.org/doc/127517806/ 138