Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 intermediaries apply to the process. Authentication only becomes available through the Authentication Service Agency (ASA). They are regulated by the Aadhaar (Authentication) Regulations, 2016. Their role and responsibilities are provided by Regulation 19 of the Authentication Regulations. They are to use certified devices. The equipment or software has to be duly registered with or approved or certified by the Authority/agency. The systems and operations are audited by information system auditor. The requesting entities pass the encrypted data to the CIDR through the ASA and the response (Yes/No authentication or e-KYC information) also takes the same route back. The server of the ASA has to perform basic compliance and completeness checks on the authentication data packet before forwarding it to the CIDR. The Act prohibits sharing and disclosure of core biometric data under Section 8 and 29. Other identity information is shared with requesting entity (AUAs and KUAs) only for the limited purpose of authentication. The data is transferred from the requesting entity to the ASA to the CIDR in an encrypted manner through a leased line circuitry using secure Protocols (Regulation 9 of the Authentication Regulations). The storage of data templates is in safely located servers with no public internet inlet/outlet, and offline storage of original encrypted data (PID blocks). There are safety and security provisions such as audit by Information Systems Auditor. Requesting entities are appointed through agreement. They can enter into agreement with sub-AUA or sub-KUA with permission of the UIDAI. Whatever identity information is obtained by the requesting entity is based on a specific consent of the Aadhaar number holder. The e-KYC data shared with the requesting entity can only be after prior consent of the Aadhaar holder. Such data cannot be shared and has to be stored in encrypted form. The biometric information used is not permitted to be stored. Only the logs of authentication transactions are maintained for a short period. Full identity information is never transmitted back to the requesting entity. There is a statutory bar from sharing biometric information (Section 29(1)(a)/Section 29(4)). Data centres of ASA, requesting entities and CIDR should be within the territory of India. There are various other provisions for monitoring, auditing, inspection, limits on data sharing, data protection, punishments etc., grievance redressal mechanism, suspension and termination of services, etc. so that all actions the entities involved in the process are regulated. Regulation 3(i) & (j) of Aadhaar (Data Security) Regulation, 2016 enables partitioning of CIDR network into zones based on risk and trust and other security measures. CIDR being a computer resource is notified to be a Protected System under Section 70 of the IT Act by the Central Government on December 11, 2015. Anyone trying to unlawfully gain access into this system is liable to be punished with 10 years imprisonment and fine. The storage involves end to end encryption, logical partitioning, firewalling and anonymisation of decrypted biometric data. Breaches of penalty are made punitive by Chapter VII of the Act. Biometric information is deemed to be an electronic record, and Sensitive personal data or information under the IT Act. There are further guards under the Aadhaar (Data Security) Regulations, 2016. 152) That apart, we have recorded in detail the powerpoint presentation that was given by Dr. Ajay Bhushan Pandey, CEO of the Authority, which brings out the following salient features: (a) During the enrolment process, minimal biometric data in the form of iris and fingerprints is collected. The Authority does not collect purpose, location or details of transaction. Thus, it is purpose blind. The information collected, as aforesaid, remains in silos. Merging of silos is prohibited. The requesting agency is provided answer only in Yes or No about the authentication of Indian Kanoon - http://indiankanoon.org/doc/127517806/ 122