Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 188) The jurisprudence with respect to collection, use and retention of biometric information in the United States differs from the EU. In the US context, there is no comprehensive data protection regime. This is because of the federal system of American government, there are multiple levels of law enforcementfederal, state, and local. Different states have differing standards for informational privacy. Moreover, the U.S. has a sectoral approach to privacy, i.e. laws and regulations related to data differ in different sectors such as health sector or student sector. In most cases, however, the Fourth Amendment which prohibits unreasonable searches and seizures by the government has been read by courts to envisage various levels data protection. 189) At this juncture, we are not entering the debate as to whether the jurisprudence developed in United States is to be preferred or E.U. approach would be more suitable. Fact remains that importance to data protection in processing the data of the citizens is an accepted norm. 190) Observance of this fundamental principle is necessary to prevent a disproportionate infringement of the Fundamental Right of Privacy of a citizen. The question which now needs to be addressed is whether the Aadhaar Act and Rules incorporate these principles of data protection. We have already taken note of the provisions in the Act, which relate to data protection. However, a detailed analysis of the provisions of the Act needs to be undertaken for this purpose having regard to the principles that have emerged from case law in other jurisdiction and noted in paragraph 187 above. Data Minimisation: 191) The petitioners have argued that the Act enables data collection indiscriminately regarding all aspects of a person (biometrics, demographic details, authentication records, meta-data related to transaction) even though such data has no nexus to the purported object of subsidies, thus violating the principle of data minimization. The data collected is sufficient to indicate religion, class, social status, income, education and intimate personal details. Under Section 32 of the Act, authentication records are stored in the central database in the manner prescribed under the Regulations. Regulation 26 of the Authentication Regulations requires UIDAI to store authentication transaction data consisting of: (a) authentication request data received including PID block; (b) authentication response data sent; (c) meta data related to the transaction; and (d) any authentication server side configurations as necessary. The authentication record affords access to information that can be used and analyzed to systematically track or profile an individual and her activities. 192) As per the respondents, Aadhaar involves minimal identity information for effective authentication. Four types of information collected for providing Aadhaar: (i) Mandatory demographic information comprising name, date of birth, address and gender [Section 2(k) read with Regulation 4(1) of the Aadhaar (Enrolment and Update) Regulations, 2016]; (ii) Optional demographic information [Section 2(k) read with Regulation 4(2) of the Aadhaar (Enrolment and Update) Regulations, 2016]; Indian Kanoon - http://indiankanoon.org/doc/127517806/ 137