Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 which Aadhaar can be used and defeats the principle of informed consent at the time of enrolment and purpose limitation. 203) Respondents controvert the aforesaid submission by arguing that there is purpose limitation under the Aadhaar Act as purpose of use of biometric data in the CIDR is limited to authentication for identification. The Aadhaar holder is made aware of such use of the Aadhaar card at the time of enrolment. The enrolling agency is obliged under the Enrolment Regulations to inform the individual about the manner in which the information shall be used, the nature of recipients with whom the information is to be shared during authentication; and the existence of a right to access information, the procedure for making request for such access and details of the person/ department to whom request can be made. This information to individual is the basis for his consent for enrolment. 204) As per the respondents, Section 57 is not an enabling provision which allows Aadhaar to be used for purposes other than Section 7, but is a limiting provision. It limits its use by State, Body Corporate or a person by requiring it to be sanctioned by any law in force or any contract and making the use subject to the proviso to Section 57. The proviso requires the use of Aadhaar under this Section to be subject to procedure and obligations under Section 8 and Chapter VI of penalties. Section 8(2)(a) requires Requesting Entities (RE) (parties authorized to carry out authentication under Section 57) to obtain the consent of an individual before collecting her identity information for the purposes of authentication in such manner as may be specified by regulations. Section 8(3) enables this consent to be informed consent by requiring that an individual submitting her identity information for authentication shall be informed of the nature and the use of the information that may be shared upon authentication and the alternatives to submission of identity information to the requesting entity. This aspect is discussed in detail at a later stage, as it touches upon privacy aspects as well. Suffice it is to mention here that we have found some portion of Section 57 as offending and declared that unconstitutional. Insofar as Sections 2(f), (w) and (x) are concerned, these provisions are discussed at a later stage 77. We would like to mention here that we have read down these provisions. The aforesaid measure would subserve the purpose limitation as well. Time Period for Data Retention: 205) We have touched upon this aspect hereinabove. According to petitioners, the data is allowed to be retained for an unreasonable long period of time. Regulation 27 of the Authentication Regulations requires the UIDAI to retain the authentication transaction data (which includes the meta data) for a period of 6 months and to archive the same for a period of 5 years thereafter. Regulation 18(3) and 20(3) allow Requesting entities (RE) and Authentication Service Agencies to retain the authentication logs for a period of 2 years and then archive them for 5 years. It is required to be deleted only after 7 years unless retained by a court. The right of the citizen to erasure of data or right to be forgotten is severely affected by such regulation. There is no provision to delete the biometric information in any 77 See paragraphs 320 to 322 eventuality once a person is enrolled. Indian Kanoon - http://indiankanoon.org/doc/127517806/ 141