CAG pulls up UIDAI for poor Aadhaar data records, errors in authentication

The Comptroller and Auditor General of India (CAG) has pulled up the Unique Identification Authority of India (UIDAI), which issues Aadhaar cards, for poor data management, recurring mistakes in authentication and improper archiving among other shortcomings.

The 108-page CAG report said the UIDAI had to cancel over 4.7 lakh Aadhaars due to duplication, pointing out faulty biometric record-keeping by the world’s largest biometric ID system. The CAG report alleged that Aadhaar numbers were generated with incomplete information, improper documentation and poor quality biometrics, resulting in multiple Aadhaar cards issued to the same person.

In a report tabled in Parliament recently, the CAG stated: “All Aadhaar numbers were not paired with the documents relating to personal information of their holders, and even after nearly 10 years the UIDAI could not identify the exact extent of mismatch. There were instances of issue of Aadhaars with the same biometric data to different residents indicating flaws in the de-duplication process and issue of Aadhaars on faulty biometrics and documents.”

On the privacy front, the CAG report stated that UIDAI has failed to ensure that the applications or devices used by agencies or companies for authentication will not be able to store personal information of residents, thus risking the privacy of residents.

Also read: Chennai, Bengaluru, Gurugram among cheapest FDI sites for electronics R&D

The CAG said that UIDAI has not been able to study the reasons for authentication errors and does not have a data archiving policy, considered absolutely necessary for a biometric management system of this scale.

“The Authority had not ensured security and safety of data in Aadhaar vaults. They had not independently conducted any verification of compliance to the process involved,” the CAG told the parliament.

The CAG pointed out that there is no assurance that all the Aadhaar holders in the country are ‘Residents’ as defined in the Aadhaar Act. This because UIDAI has not specified any specific proof, document, or process to confirm if a person applying for Aadhaar has resided in India for the period specified by the Rule.

The CAG wants the UIDAI to come up with a procedure which goes beyond self-declaration for issuing authenticate resident document to every citizen of India.