Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 209) Other identity information is shared with Requesting Entity (AUAs and KUAs) only for the limited purpose of authentication. The data is transferred from the RE to the ASA (Authentication Service Agency) to the CIDR in an encrypted manner through a leased line circuitry using secure Protocols (Regulation 9 of the Authentication Regulations). The storage of data templates is in safely located servers with no public internet inlet/outlet, and offline storage of original encrypted data (PID blocks). There are safety and security provisions such as audit by Information Systems Auditor. REs are appointed through agreement. REs can enter into agreement with sub-AUA or sub-KUA with permission of the of UIDAI. Whatever identity information is obtained by the requesting entity is based on a specific consent of the Aadhaar number holder. The e-KYC data shared with the RE can only be after prior consent of the Aadhaar holder. Such data cannot be shared and has to be stored in encrypted form. The biometric information used is not permitted to be stored only the logs of authentication transactions are maintained for a short period. Full identity information is never transmitted back to RE. There is a statutory bar from sharing Biometric information [Section 29(1)(a)/ Section 29(4)]. The Data centres of ASA, REs and CIDR should be within the territory of India. (c) Enrolment Agencies and Registrars 210) The enrolment and Authentication processes are strongly regulated so that data is secure. The Enrolment agency, which collects the biometric and demographic of the individuals during enrolment, is appointed either by UIDAI or by a Registrar [Section 2(s)]. The registrar are appointed through MoUs or agreements for enrolment and are to abide by a code of conduct and processes, policies and guidelines issued by the authority. They are responsible for the process of enrolment. Categories of persons eligible for appointment are limited by the Regulations. The agency employees a certified supervisor, an operator and a verifier under Enrolment and Update Regulations. Registrars, enrolling agencies are obliged to use the software provided or authorized by UIDAI for enrolment purpose. The standard software has security features as specified by Authority. All equipment used are as per the specification issued by the authority. The Registrars are prohibited from using the information collected for any purpose other than uploading the information to CIDR. Sub-contracting of enrolment function is not allowed. The Code of Conduct contains specific directions for following the confidentiality, privacy and security protocols and submission of periodic reports of enrolment. Not only there are directions prohibiting manipulation and fraudulent practices but the Act contains penal provisions for such violations in Chapter VII of the Regulations. The enrolment agencies are empanelled by the authority. They are given an enrolling agency code using which the Registrar can onboard such agency to the CIDR. The enrolment data is uploaded to the Central Identities Data Repository (CIDR) certified equipment and software with a digital signature of the registrar/enrolling agency. The data is encrypted immediately upon capture. The decryption key is with the UIDAI solely. Section 2(ze) of the IT Act, which defines secure systems and Section 2(w) of the Act, which defines intermediaries apply to the process. (d) Authentication Service Agency 211) Authentication only becomes available through the Authentication Service Agency (ASA). They are regulated by the Aadhaar (Authentication) Regulations, 2016. Their role and responsibilities are Indian Kanoon - http://indiankanoon.org/doc/127517806/ 143