Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 (2) Upon expiry of the period of five years specified in subregulation (1), the authentication transaction data shall be deleted except when such authentication transaction data are required to be maintained by a court or in connection with any pending dispute. 199) It is also submitted that Section 10 which authorises the Authority to engage one or more entities, which may be private entities, to establish and maintain CIDR is a serious threat to privacy and it even amounts to compromise on national sovereignty and security. Insofar as first argument is concerned, there appears to be some force in that. If authentication is the only purpose, we fail to understand why this authentication record is needed to be kept for a period of 2+5 years. No satisfactory explanation in this behalf was given. 200) Insofar as information regarding metadata is concerned, we may note that the respondents distinguished between three types of meta-data :technical, business and process metadata. Process metadata describes the results of various operations such as logs key data, start time, end time, CPU seconds used, disk reads, disk writes, and rows processed. This data is valuable for purposes of authenticating transaction, troubleshooting , security, compliance and monitoring and improving performance. They submit that the metadata contemplated under this Regulation is Process metadata. 201) However, metadata is not defined in the Aadhaar Act. In common parlance, it is understood as information about data, example whereof was given by Mr. Sibal that the text of a message exchanged between two persons would be the data itself. However, surrounding circumstances like when the message was sent; from whom and to whom the message was sent; and location from which the message was sent would include meta data. As noted above, Mr. Dwivedi had tried to explain it away by stating that there are three types of meta data, namely, technical, business and process meta data. According to him, meta data under the Aadhaar Act refers to only process meta data. In support, he had referred to Section 2(d) of the Aadhaar Act which defines authentication record to mean the record of the time of authentication, identity of requesting entity and the response provided by the Authority. He, thus, submitted that Regulation 26 would not go beyond Section 2(d). However, aforesaid explanation that meta data refers to process data only does not find specific mention. There is, thus, need to amend Regulation 26 to restrict it to process meta data, and to exclude other type of meta data specifically. Purpose Limitation: 202) As per the petitioners, there is no purpose limitation. Identity information collected for one purpose under the Act can be used for any other (new) purpose. Definition of benefit (Section 2(f)) and service (Section 2(w)) and subsidy (Section 2(x)), to which the personal data collected is supposed to be applied is not identifiable. It is open to the executive to notify that any advantage, gift, reward, relief, payment, provision, facility, utility or any other assistance aid, support, grant subvention, or appropriation may be made conditional on Aadhaar Authentication. Moreover, under Section 57, the State, a body corporate or any person can avail authentication facility and access information under CIDR. This creates an open ended and unspecified set of laws and contracts for Indian Kanoon - http://indiankanoon.org/doc/127517806/ 140