Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 tell the authority the identity of the RE, the PID, the time and nature of response, the code of the device and the authentication server side configurations. Identity of the RE does not include details of the organization which is seeking authentication as an RE provides authentication service to large number of government organizations who have agreements with it. Such a mechanism preventing the authority from tracking the nature of activity for which the authentication was required. To illustrate nic.in is an RE which provides authentication service to large number of Government organisations who have agreements with it. The authentication record would only contain information about the identity about the RE. It will give information only about the RE (nic.in) and not about the organisation which is requiring authentication through the RE. In most cases the authentication is one time. Mr. Dwivedi has also explained that yet again, there may be organisations, which have branches in different part of India. Assuming Apollo Hospital (although in fact it is not an RE) has five branches in India. If Apollo Hospital seeks authentication as an RE, the authentication record will merely tell the identity of Apollo Hospital and its device code, but it will not indicate which branch of Apollo was seeking authentication and from which part of the country. Further, assuming that the Indira Gandhi International Airport is an RE and there is requirement of authentication at the point of entry and/or exit. All that the record will show that the ANH has entered the airport at a particular time but it will not show by which plane he is flying and to what destination. At the time of exit, it will only show that the person has exited the airport at a particular time. It will not show from which flight he has arrived and from which destination and at what time he has arrived or with whom he travelled. 198) However, other apprehension of the petitioners is that storing of data for a period of seven years as per Regulations 20 and 26/27 of the Aadhaar (Authentication) Regulations, 2016 is too long a period. We may reproduce Regulations 26 and 27 of the Aadhaar (Authentication) Regulations, 2016 hereunder: 26. Storage and Maintenance of Authentication Transaction Data (1) The Authority shall store and maintain authentication transaction data, which shall contain the following information:(a) authentication request data received including PID block; (b) authentication response data sent; (c) meta data related to the transaction; (d) any authentication server side configurations as necessary: Provided that the Authority shall not, in any case, store the purpose of authentication. 27. Duration of storage (1) Authentication transaction data shall be retained by the Authority for a period of 6 months, and thereafter archived for a period of five years. Indian Kanoon - http://indiankanoon.org/doc/127517806/ 139