Aadhaar, DBT and digital public infrastructure

Detail

1. Why this matters for accountability

• Welfare money used to pass through many hands before reaching a poor family. At each step, some could be stolen.
• Leakage means money lost on the way, through ghost beneficiaries (fake or dead people still on the list), duplicate beneficiaries (one person listed twice) and middlemen.
• Digital identity plus payment straight into a bank account cuts out these steps. This makes the state answerable for each rupee.
• The flip side: one central database also raises worries about privacy, surveillance (the state watching people) and exclusion (genuine people denied benefits).

2. UIDAI and Aadhaar: the history

• Unique Identification Authority of India (UIDAI): the body that gives Aadhaar numbers to residents and checks identity when someone uses one.
• January 2009: set up by executive notification, a government order that is not a law passed by Parliament. It sat under the Planning Commission, with Nandan Nilekani as Chairperson.

• 2016: became a statutory body (a body created by an Act of Parliament) under the Ministry of Electronics and Information Technology (MeitY).

• Aadhaar: a 12-digit random number given to a resident, not only to citizens. It is linked to two kinds of data:

• Demographic data: name, date of birth, gender and address.

• Biometric data: ten fingerprints, two iris scans and a face photo.

• 29 September 2010: the first Aadhaar number was given out at Tembhli village, Nandurbar district (Maharashtra).

• Enrolment is now over 140 crore, as of the latest available data.
• Scale of use: Aadhaar authentication passed 150 billion transactions (2025) [10].

3. The Aadhaar Act, 2016

• Full name: the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016.
• Passed as a Money Bill (Article 110). A money bill is a bill only about taxes, government borrowing or spending from the Consolidated Fund.
• The Lok Sabha Speaker certifies a bill as a money bill. Under Article 110(3), the Speaker's decision is final.
• The Rajya Sabha can only make recommendations, within 14 days. The Lok Sabha may accept or reject them.
• Why it was controversial: the government did not have a majority in the Rajya Sabha. Critics said the money bill route was used to get around the Rajya Sabha.

Feature	Money Bill (Art. 110, 109)	Ordinary Bill (Art. 107, 108)
Where introduced	Lok Sabha only, with the President's recommendation	Either House
Rajya Sabha power	Can only recommend, within 14 days	Can amend or reject
Deadlock	Lok Sabha prevails; no joint sitting	Joint sitting possible (Art. 108)
President	Cannot return it for reconsideration	Can return it once

• Key sections

Section	What it says
s.7	Government may require Aadhaar for a subsidy, benefit or service paid from the Consolidated Fund of India (Article 266). If a person has no Aadhaar, another form of ID must be offered.
s.8	Authentication: the system checks the details and gives only a "yes/no" answer. It does not share the person's full data.
s.29	Core biometric data cannot be shared.
s.33(2)	Data could be disclosed for national security on the order of a Joint Secretary.
s.47	Only UIDAI could complain to a court about offences under the Act.
s.57	Any body, public or private, could use Aadhaar under a law or a contract.

• Three ways to check identity:
• Yes/no authentication.
• e-KYC (electronic Know Your Customer): with the person's consent, sends a verified copy of their name, address and photo to a bank or other service.
• Offline verification: through a QR code or a paper or XML file, without contacting UIDAI's central database.

4. Aadhaar and Other Laws (Amendment) Act, 2019

• Why it came: to follow the 2018 Supreme Court judgment.
• First introduced as the 2018 Bill [5].
• Then issued as an Ordinance in 2019 (a temporary law made by the President when Parliament is not sitting, under Article 123).

• Then passed as an Act in 2019.

• Main changes:

• s.57 omitted, so private use under a mere contract ended [5].
• Voluntary use of Aadhaar for KYC by banks (through changes to the PMLA) and telecom companies (through changes to the Telegraph Act), only with the person's consent [5].
• Offline verification was recognised in law.
• Civil penalties: money fines decided by an officer that UIDAI appoints. This is in addition to criminal punishment.
• A child enrolled by their parents can choose to cancel their Aadhaar on turning 18.

5. Good Governance Amendment Rules, 2025

• Full name: the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules, 2025. MeitY notified them in January 2025 [2].
• What changed: both government and non-government entities can now use Aadhaar authentication for public-interest purposes [2]. These purposes include:
• innovation;
• spreading knowledge;
• ease of living for residents;

• better access to services.

• New sectors covered: e-commerce, travel, tourism, hospitality and health services [2].

• How approval works:
• The entity applies to the concerned Ministry or Department of the Union or State government, explaining its need [2].
• Applications go through the Aadhaar Good Governance portal (swik.meity.gov.in) [3].

• MeitY approves on UIDAI's advice.

• Why it matters for exams: after s.57 was struck down in 2018, private use was cut back sharply. These rules partly reopen it, but through approval rules, not through private contracts.

• Face authentication (checking a person's face, often on a phone) is spreading. It helps elderly people and manual workers whose fingerprints have worn out.

6. K.S. Puttaswamy v Union of India (Aadhaar case), 26 September 2018

• Bench: five judges; the decision was 4:1.
• Majority: Sikri J (writing for Misra CJI, Khanwilkar J and himself), with Bhushan J agreeing.

• Dissent: Chandrachud J.

• Background: Puttaswamy (2017), a nine-judge bench, held that privacy is a fundamental right under Article 21 (and Part III as a whole). That 2017 case is the privacy case. The 2018 case tested Aadhaar against it.

• Test used: proportionality. A limit on privacy is valid only if it meets all four steps:
• it is backed by a law;
• it serves a legitimate aim;
• it is necessary;
• it is balanced against the harm it causes.

Outcome	Provision or use
Upheld	The Act as a whole, including s.7 (Aadhaar for welfare paid from the Consolidated Fund)
Upheld	PAN–Aadhaar linking, under s.139AA of the Income-tax Act, 1961
Upheld	Passing the Act as a Money Bill (by the majority)
Struck down	s.57: use by private bodies under a contract. Aadhaar can be required only where a law shows that its use is necessary and proportionate [4]
Struck down	s.33(2): disclosure for national security on a Joint Secretary's order
Read down	s.47: individuals, not only UIDAI, can now complain to a court. "Read down" means the court narrowed the section's meaning instead of striking it out
Not mandatory	Bank accounts: the PMLA (Maintenance of Records) Rules 2005 required this linking; the Court held it failed proportionality and violated privacy [4]
Not mandatory	Mobile SIM linking was held unconstitutional [4]
Not mandatory	School admissions, and CBSE, NEET and UGC exams
Data limit	Authentication logs can be kept for at most 6 months, not the 5 years earlier allowed

• Chandrachud J's dissent:
• Money Bill: passing the Act as a money bill was a "fraud on the Constitution". It skipped the Rajya Sabha, which is part of bicameralism (a Parliament with two Houses).
• Surveillance: the system makes it possible to profile and track citizens.

• Exclusion: biometric failures deny people food and pensions, and the Act gives no proper remedy.

• Later development: Rojer Mathew v South Indian Bank (2019) doubted how the Aadhaar case dealt with the Money Bill question. It referred the matter to a seven-judge bench, which is still pending as of the latest available information.

7. Direct Benefit Transfer (DBT)

• DBT: government benefits (cash or subsidy) are paid straight into the beneficiary's bank account, mostly through Aadhaar-linked accounts. The aim is to remove leakages and middlemen.
• Timeline:
• 1 January 2013: DBT started in selected districts.

• 2015: the DBT Mission moved to the Cabinet Secretariat, so that it could coordinate all ministries.

• Main schemes:

• PAHAL (DBTL) for LPG, 2014–15: the cooking gas subsidy is paid into the bank account, and the cylinder is bought at market price.
• PM-KISAN (2019): direct income support to farmers.
• Scholarships.

• MGNREGA wages, the rural employment scheme.

• Payment rails:

• Aadhaar Payment Bridge (APB): sends money to the bank account linked to a person's Aadhaar number.

• AePS (Aadhaar-enabled Payment System): lets people withdraw cash with a fingerprint at a local banking agent.

• Scale and savings (government figures):

• About ₹3.48 lakh crore saved in total by plugging leakages, according to an assessment by the BlueKraft Digital Foundation (reported April 2025) [6].
• 16-fold growth in the number of beneficiaries covered [6].
• Subsidies fell from 16% to 9% of total government spending [6].

• Over ₹51 lakh crore paid to 176 crore beneficiaries in total, by June 2026 [7].

• Caution: "savings" partly counts people removed from lists. Some of them may have been genuine beneficiaries who failed authentication. This is the exclusion error.

8. The JAM Trinity

• JAM: Jan Dhan bank accounts + Aadhaar + Mobile phones. The term was used in the Economic Survey 2014–15. It is the base on which DBT runs.
• Jan Dhan = a bank account: the place where money arrives.
• Aadhaar = identity: proof of who should get the money.

• Mobile = access: alerts and payments.

• Pradhan Mantri Jan Dhan Yojana (PMJDY) started in 2014.

• Accounts grew from 14.72 crore (2015) to 57.71 crore (March 2026) [7].
• Deposits grew from ₹15,670 crore (March 2015) to ₹2.94 lakh crore (March 2026) [7].

9. Digital Public Infrastructure (DPI) and India Stack

• Digital public infrastructure (DPI): shared digital systems, built as public goods, that anyone can build on. They are open and interoperable (different systems can work together). Public and private services run on top of them, like roads that many vehicles use.
• India Stack: India's set of DPI layers. Each layer offers open APIs (ready-made software links that other apps can plug into). Together they make services work without being present, without paper and without cash.

Layer	Purpose	Main components
Identity	Prove who you are	Aadhaar, e-KYC, eSign (signing a document online using Aadhaar)
Payments	Move money	UPI (2016, run by the National Payments Corporation of India, NPCI), AePS, APB
Data	Share records with consent	DigiLocker (official documents stored online), Account Aggregators (consent-based sharing of financial data; RBI framework 2016, live 2021)

• Design principles:
• The base platforms are open, interoperable and public.
• Private companies innovate on top: payment apps on UPI, fintech firms on Account Aggregators.
• Data is shared only with consent.

• Minimum data is shared; for example, a yes/no answer instead of full details.

• UPI abroad: live in over eight countries, including the UAE, Singapore, Bhutan, Nepal, Sri Lanka, France, Mauritius and Qatar [10].

10. DPI goes global: G20 (2023)

• At the G20 New Delhi Summit (9–10 September 2023), the Leaders' Declaration welcomed the G20 Framework for Systems of Digital Public Infrastructure [9][10].

• It is a voluntary framework for building, running and governing DPI.

• The Digital Economy Ministers' Meeting endorsed three DPI deliverables [10]:

• a framework for building DPI;
• a plan to raise money for DPI in low- and middle-income countries;

• the Global DPI Repository (GDPIR).

• GDPIR:

• The Prime Minister announced it was complete, together with a Social Impact Fund to advance DPI in the Global South (November 2023) [8].
• It lists 54 DPIs from 16 countries, and India has contributed the most [10].

11. Critiques and accountability gaps

• Concentration of data: one central database is attractive to hackers. It also makes it possible to profile people.
• Gaps in the law:
• Aadhaar has its own Act.
• UPI runs under the Payment and Settlement Systems Act, 2007, and RBI rules.
• DigiLocker and some other layers depend mostly on rules and executive orders, not on their own Acts.

• General data protection came only with the Digital Personal Data Protection (DPDP) Act, 2023.

• Accountability of operators:

• NPCI is a not-for-profit company owned by banks. It does not fully come under the RTI Act or direct parliamentary control.

• UIDAI's grievance system has been criticised as weak.

• Exclusion: fingerprints fail, networks fail, or Aadhaar and other records do not match. Welfare can then be denied to the people it is meant for.

• Function creep: a tool built for welfare slowly spreads to many other uses. The 2025 rules for private use are an example.

Prelims Hooks

• UIDAI was first created by executive notification (January 2009) under the Planning Commission. It became statutory under MeitY only through the Aadhaar Act 2016.
• The first Aadhaar was issued on 29 September 2010 at Tembhli, Nandurbar (Maharashtra). Aadhaar is given to residents, not only to citizens.
• Aadhaar Act, s.7 = Aadhaar may be required for subsidies from the Consolidated Fund of India. s.57 = private use under a contract; struck down in 2018 and omitted in 2019.
• Aadhaar case (2018, 4:1):
• Upheld: PAN linking (s.139AA Income-tax Act).
• Struck down: mandatory bank-account and SIM linking.
• Data limit: authentication logs kept for at most 6 months.

• Dissent: Chandrachud J.

• Trap: the 2018 judgment upheld passing the Aadhaar Act as a Money Bill. The doubt was later referred to a seven-judge bench in Rojer Mathew (2019).

• The 2019 Amendment allowed voluntary Aadhaar KYC for banks and telecom companies with consent, and let children opt out at 18.
• The Good Governance (SWIK) Amendment Rules, January 2025 let non-government entities use Aadhaar authentication after government approval through swik.meity.gov.in.
• JAM trinity = Jan Dhan + Aadhaar + Mobile. The term comes from the Economic Survey 2014–15, not a Union Budget. DBT began on 1 January 2013.
• The G20 New Delhi Declaration (2023) welcomed the G20 Framework for Systems of DPI. The Global DPI Repository has 54 DPIs from 16 countries.
• India Stack layers:
• UPI = payments layer (2016).
• Account Aggregator = data layer (RBI framework 2016, live 2021).
• eSign = identity layer.

Mains Points

• Efficiency against rights:
• For: DBT and JAM cut leakages (about ₹3.48 lakh crore claimed savings) and made the state more accountable for welfare spending.

• Against: exclusion errors and the risk of surveillance call for the proportionality test of Puttaswamy (2017, 2018). Every Aadhaar requirement needs a law, a legitimate aim, necessity and balance.

• Using the Money Bill route for the Aadhaar Act:

• It raises questions about bicameralism and how far the Speaker's certificate under Article 110(3) can be reviewed by courts.

• Chandrachud J's dissent and the Rojer Mathew reference show this is still an open constitutional question.

• DPI as a model for governance:

• Strengths: open, interoperable public platforms with private innovation on top. These are a source of soft power after the G20 (2023).
• Gaps: some layers lack their own laws; operators like NPCI face limited RTI and parliamentary oversight.

• Reforms: a statutory base for each layer, independent audit, a strong DPDP Act regulator, and offline fallbacks so that no one is excluded.

• Private use after 2025: the SWIK Rules reopen private authentication through government approval, not contracts. Whether this meets the 2018 judgment's demand for a law that shows necessity is open to debate.