Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 We do not find any reason for archiving the authentication transaction data for a period of five years. Retention of this data for a period of six months is more than sufficient after which it needs to be deleted except when such authentication transaction data are required to be maintained by a Court or in connection with any pending dispute. Regulations 26 and 27 shall, therefore, be amended accordingly. Data Protection and Security: 206) Petitioners argued that there are not enough safeguards for data protection and security in the Act. Section 28 of the Act which addresses security and confidentiality of information is vague and fails to lay down any standard of data security or prescribe any cogent measures which are to be taken to prevent data breaches. Section 54 empowers UIDAI to make regulations related to various data management processes, security protocol and other technology safeguards. The Aadhaar (Data Security) Regulations, 2016 passed by UIDAI under Section 54, vest in the authority a discretion to specify an information security policy (Regulation 3). This leads to excessive delegation. Alternatively, it has not been subject to parliamentary oversight which Regulations under Section 54 require. Further, the CIDR central database, unlike the ASAs and REs (under Authentication Regulation 22(1)), are not required to be located in data centres. The personal data is accessible by private entities such as AUAs and KUAs and other private entities such as banks, insurance companies and telecom service providers. There have been numerous data breaches in the Aadhaar system. These establish its vulnerability. There are not enough safeguards from data hack and data leak. The data is being used by private parties to build comprehensive databases containing information and profiles of individuals. Thus the project also lacks transparency of data and its use. 207) The Respondents contend that strong measures for data protection and security, taken at all stages of data collection, transfer, storage and use. After deliberating over respective contentions, we are of the opinion that the following explanation furnished by the respondents on various facets ensures data protection and security to a considerable extent: (a) CIDR 208) Regulation 3(i) & (j) of Aadhaar (Data Security) Regulation 2016 enables partitioning of CIDR network into zones based on risk and trust and other security measures. CIDR being a computer resource is notified to be a Protected System under Section 70 of the IT Act, 2000 by the Central Government on 11.12.2015. Anyone trying to unlawfully gain access into this system is liable to be punished with 10 years imprisonment and fine. The storage involves end to end encryption, logical partitioning, firewalling and anonymisation of decrypted biometric data. Breaches of penalty are made punitive by Chapter VII of the Act. Biometric information is deemed to be an electronic record, and Sensitive personal data or information under the IT Act, 2000. There are further guards under The Aadhaar ( Data Security )Regulation, 2016. (b) Requesting Entities (AUA and KUA) Indian Kanoon - http://indiankanoon.org/doc/127517806/ 142