Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 9. Process of sending authentication requests. (1) After collecting the Aadhaar number or any other identifier provided by the requesting entity which is mapped to Aadhaar number and necessary demographic and / or biometric information and/ or OTP from the Aadhaar number holder, the client application shall immediately package and encrypt these input parameters into PID block before any transmission, as per the specifications laid down by the Authority, and shall send it to server of the requesting entity using secure protocols as may be laid down by the Authority for this purpose. (2) After validation, the server of a requesting entity shall pass the authentication request to the CIDR, through the server of the Authentication Service Agency as per the specifications laid down by the Authority. The authentication request shall be digitally signed by the requesting entity and/or by the Authentication Service Agency, as per the mutual agreement between them. (3) Based on the mode of authentication request, the CIDR shall validate the input parameters against the data stored therein and return a digitally signed Yes or No authentication response, or a digitally signed e-KYC authentication response with encrypted e-KYC data, as the case may be, along with other technical details related to the authentication transaction. (4) In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the input parameters specified in sub-regulation (1) above such that authentication is always reduced to a 1:1 match. (5) A requesting entity shall ensure that encryption of PID Block takes place at the time of capture on the authentication device as per the processes and specifications laid down by the Authority. xx xx xx 18. Maintenance of logs by requesting entity. (1) A requesting entity shall maintain logs of the authentication transactions processed by it, containing the following transaction details, namely: (a) the Aadhaar number against which authentication is sought; (b) specified parameters of authentication request submitted; (c) specified parameters received as authentication response; (d) the record of disclosure of information to the Aadhaar number holder at the time of authentication; and (e) record of consent of the Aadhaar number holder for authentication, but shall not, in any event, retain the PID information. (2) The logs of authentication transactions shall be maintained by the requesting entity for a period of 2 (two) years, during which period an Aadhaar number holder shall have the right to access such logs, in accordance with the procedure as may be specified. Indian Kanoon - http://indiankanoon.org/doc/127517806/ 23