Compliance with Aadhaar Act 2016 and IT Act 2000

[Image omitted. See the official document.]

PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY

PFRDA/2017/20/NPST-REG/1

Date: 05/07/2017

To,

NPS Trust, CRA, Trustee Bank, Govt. Nodal Offices, POPs, Aggregators and other stakeholders

SUBJECT: Adherence to the provisions of the Aadhar Act, 2016 and Information Technology Act, 2000

1. All the intermediaries/Stakeholders under National Pension System are hereby informed that there shall be no public display of AADHAR number of residents in any manner which shall be in violation of Section 29(4) of the 'THE AADHAAR (TARGETED DELIVERY OF FINANCIAL AND OTHER SUBSIDIES, BENEFITS AND SERVICES) ACT, 2016'.

2. It may be further noted that wherein AADHAR number of a subscriber is used /involved for the purpose of any transaction of activity under NPS, or any other pension scheme governed by the provisions of the PFRDA Act, 2013, such transaction/activity shall be undertaken strictly in conformity with the provisions of the 'THE AADHAAR (TARGETED DELIVERY OF FINANCIAL AND OTHER SUBSIDIES, BENEFITS AND SERVICES) ACT, 2016', the relevant rules and regulations notified thereunder, the provisions of the Information Technology Act, 2000, the relevant rules and regulations notified thereunder as also the relevant provisions of the intermediary specific regulations notified under the PFRDA Act, 2013 (as may be applicable for NPS Trust/CRA/POP/Aggregators and other entities having interface with subscribers), relating to maintaining of confidentiality of data of subscribers.

3. In this regard, a list of DO's and DONT's received on onward transmission from the Ministry of Finance, Govt. of India, is also enclosed for guidance in the matter.

4. All intermediaries/stakeholders are requested take notice and observe strict compliance of the above, in respect of activities falling within the jurisdiction of this Authority.

Venkateswarlu Peri (Chief General Manager)

File No.PFRDA/16/02/06/0001/2017-REG-NPST

Receipt No : 2550/2017/REG-NPST

[Image omitted. See the official document.]

GOVERMENT OF INDIA MINISTRY OF FINANCE DEPARTMENT OF FINANCIAL SERVICES "JEEVAN DEEP" 10, PARLIAMENT STREET, NEW DELHI-110 001

F.No.20/2/2010-FI (Vol.II) (C-58530)

Dated the 15.06.2017

To

All CMDs of PSBs/Private Banks/Insurance Companies/FIs.

Subject: Violations of the provision of the Aadhaar Act, 2016 and Information Technology Act, 2000.

Sir,

It may be noted that public display of Aadhaar No. of residents in any manner is violation of Section 29(4) of Aadhaar Act, 2016. Further, financial information such as Bank account details, linked Aadhaar No. which is also being used as financial address are sensitive personal data, the publishing of which is violation of provision of IT Act 2000 and the rules frame there under and constitute a convention under Section 72 of Information Technology Act, 2000. MEITY and UADI have issued guidelines and a list of do's and don'ts regarding usage of Aadhaar, a copy of which is enclosed for ready reference.

Therefore, you are requested to kindly issue instructions to all concerned to ensure compliance of the above mentioned provisions of Aadhaar Act, 2016 and IT Act, 2000 and do's and don'ts regarding usage of Aadhaar.

The receipt of this letter and action taken may please be communicated to the undersigned.

Yours sincerely,

(ANJANA DUBE) Dy. Director General

To:

JS(PJ), JS(AA), JS(MM), JS(MKM), JS(SM), JS(VIK), EA(RND) & EA(NSR)

Copy for information to:

PPS to Secy(FS), PPS to AS(FI) & PPS to AS(FS)

File No.PFRDA/16/02/06/0001/2017-REG-NPST

Receipt No : 2550/2017/REG-NPST

DO'S FOR AADHAAR USER AGENCIES/DEPARTMENTS

1. Read Aadhaar Act, 2016 and its Regulations carefully and ensure compliance of all the provisions of the Aadhaar Act, 2016 and its Regulations.
2. Ensure that everyone involved in Aadhaar related work is well conversant with provisions of Aadhaar Act, 2017 and its Regulations as well as processes, policies specifications, guidelines, circular etc issued by UIDAI from time to time.
3. Create internal awareness about consequences of breaches of data as per Aadhaar Act, 2016.
4. Follow the information security guidelines of UIDAI as released from time to time.
5. Full Aadhaar number display must be controlled only for the Aadhaar holder or various special roles/users having the need within the agency/department. Otherwise, by default, all displays should be masked.
6. Verify that all data capture point and information dissemination points (website, report etc) should comply with UIDAI's security requirements.
7. If agency is storing Aadhaar number in database, data must be encrypted and stored. Encryption keys must be protected securely, preferably using HSMs. If simple spreadsheets are used, it must be password protected and securely stored.
8. Access controls to data must be in place to make sure Aadhaar number along with personally identifiable demographic data is protected.
9. For Aadhaar number look up in database, either encrypt the input and then look up the record or use hashing to create Aadhaar number based index.
10. Regular audit must be conducted to ensure Aadhaar number and linked data is protected.
11. Ensure that employees and officials understand the implications of the confidentiality and data privacy breach.
12. An individual in the organization must be made responsible for protecting Aadhaar linked personal data. That person should be in charge of the security of system, access control, audit, etc.
13. Identify and prevent any potential data breach or publication of personal data.

File No.PFRDA/16/02/06/0001/2017-REG-NPST

Receipt No : 2550/2017/REG-NPST

14. Ensure swift action on any breach personal data.
15. Ensure no Aadhaar data is displayed or disclosed to external agencies or unauthorized persons.
16. Informed consent - Aadhaar holder should clearly be made aware of the usage, the data being collected, and its usage. Aadhaar holder consent should be taken either on paper or electronically.
17. Authentication choice - When doing authentication, agency should provide multiple ways to authenticate (fingerprint, iris, OTP) to ensure all Aadhaar holders are able to use it effectively.
18. Multi-factor for high security - When doing high value transactions, multi-factor authentication must be considered.
19. Create Exception handling mechanism on following lines-
20. It is expected that a small percentage of Aadhaar holders will not be able to do biometric authentication. It is necessary that a well-defined exception handling mechanism be put in place to ensure inclusion.
21. If fingerprint is not working at all even after using multi-finger authentication, then alternate such as iris or OTP must be provided.
22. If the schemes is family based (like PDS system), anyone in the family must be able to authenticate to avail the benefit. This ensures that even if one person is unable to do any fingerprint authentication, someone else in the family is able to authenticate. This reduces the error rate significantly.
23. If none of the above is working (multi-finger, iris, anyone in family, etc.), then agency must allow alternate exception handling schemes using card or PIN or other means.
24. All authentication usage must follow with notifications/receipts of transactions.
25. All agencies implementing Aadhaar authentication must provide effective grievances handling mechanism via multiple channels (website, call-center, mobile app, sms, physical-center, etc.).
26. Get all the applications using Aadhaar audited & certified for its data security by appropriate authority such as STQC/CERT-IN.
27. Use only STQC/UIDAI certified biometric devices for Aadhaar authentication.