 bill no 86 of 2019 the aadhaar  and other laws (amendment) bill, 2019 a billto amend the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016 and further to amend the indian telegraph act, 1885 and the prevention of money-laundering act, 2002be it enacted by parliament in the seventieth year of the republic of india as follows:— part i preliminaryof this act and any reference in any such provision to the commencement of this act shall be construed as a reference to the commencement of that provision part ii5 amendments to the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016amendment of section 218 of 20162 in section 2 of the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016 (hereafter in this part referred to as the principal act),—(i) for clause (a), the following clause shall be substituted, namely:—10'(a) "aadhaar number" means an identification number issued to an individual under sub-section (3) of section 3, and includes any alternative virtual identity generated under sub-section (4) of that section;';(ii) after clause (a), the following clause shall be inserted, namely:—15'(aa) "aadhaar ecosystem" includes enrolling agencies, registrars, requesting entities, offline verification-seeking entities and any other entity or group of entities as may be specified by regulations;'; (iii) after clause (b), the following clauses shall be inserted, namely:—'(ba) "adjudicating officer" means an adjudicating officer appointed under sub-section (1) of section 33b;20(bb) "appellate tribunal" means the appellate tribunal referred to in sub-section (1) of section 33c;'; (iv) after clause (i), the following clause shall be inserted, namely:—'(ia) "child" means a person who has not completed eighteen years of age;'; (v) after clause (p), the following clauses shall be inserted, namely:—25'(pa) "offline verification" means the process of verifying the identity of the aadhaar number holder without authentication, through such offline modes as may be specified by regulations;(pb) "offline verification-seeking entity" means any entity desirous of undertaking offline verification of an aadhaar number holder;'30amendment of section 33 in section 3 of the principal act, after sub-section (3), the following sub-section shall be inserted, namely:—35"(4) the aadhaar number issued to an individual under sub-section (3) shall be a twelve-digit identification number and any alternative virtual identity as an alternative to the actual aadhaar number of an individual that shall be generated by the authority in such manner as may be specified by regulations"4  after section 3 of the principal act, the following section shall be inserted,namely:—insertion of new section 3aaadhaar number of children40"3a (1) the enrolling agency shall, at the time of enrolment of a child, seek the consent of the parent or guardian of the child, and inform the parent or guardian, the details specified under sub-section (2) of section 3(2) a child who is an aadhaar number holder may, within a period of six months of attaining the eighteen years of age, make an application to the authority for cancellation of his aadhaar number, in such manner as may be specified by regulations and the authority shall cancel his aadhaar number5(3) notwithstanding anything in section 7, a child shall not be denied any subsidy, benefit or service under that section in case of failure to establish his identity by undergoing authentication, or furnishing proof of possession of aadhaar number, or in the case of a child to whom no aadhaar number has been assigned, producing an application for enrolment"amendment of section 45 in section 4 of the principal act, for sub-section (3), the following sub-sections shall be substituted, namely:—10"(3) every aadhaar number holder to establish his identity, may voluntarily use his aadhaar number in physical or electronic form by way of authentication or offline verification, or in such other form as may be notified, in such manner as may be specified by regulationsexplanation—for the purposes of this section, voluntary use of the aadhaar number by way of authentication means the use of such aadhaar number only with the informed consent of the aadhaar number holder15(4) an entity may be allowed to perform authentication, if the authority is satisfied that the requesting entity is—(a) compliant with such standards of privacy and security as may be specified by regulations; and20(b)(i) permitted to offer authentication services under the provisions of any other law made by parliament; or(ii) seeking authentication for such purpose, as the central government in consultation with the authority, and in the interest of state, may prescribe25(5) the authority may, by regulations, decide whether a requesting entity shall be permitted the use of the actual aadhaar number during authentication or only an alternative virtual identity(6) every requesting entity to whom an authentication request is made by an aadhaar number holder under sub-section (3) shall inform to the aadhaar number holder of alternate and viable means of identification and shall not deny any service to him for refusing to, or being unable to, undergo authentication30(7) notwithstanding anything contained in the foregoing provisions, mandatory authentication of an aadhaar number holder for the provision of any service shall take place if such authentication is required by a law made by parliament" 6 in section 8 of the principal act,—amendment of section 8(a) in sub-section (2),—35(i) in clause (a), after the words "consent of an individual", the words ", or in the case of a child obtain the consent of his parent or guardian" shall be inserted;(ii) after clause (b), the following proviso shall be inserted, namely:—40"provided that the requesting entity shall, in case of failure to authenticate due to illness, injury or infirmity owing to old age or otherwise or any technical or other reasons, provide such alternate and viable means of identification of the individual, as may be specified by regulations";(b) in sub-section (3), after the words "for authentication,", the words "or in the case of a child, his parent or guardian" shall be insertedinsertion of new section 8a7  after section 8 of the principal act, the following section shall be inserted, namely:—"8a (1) every offline verification of an aadhaar number holder shall be performed in accordance with the provisions of this section(2) every offline verification-seeking entity shall,—offline verification of aadhaar number5(a) before performing offline verification, obtain the consent of an individual, or in the case of a child, his parent or guardian, in such manner as may be specified by regulations; and10(b) ensure that the demographic information or any other information collected from the individual for offline verification is only used for the purpose of such verification15(3) an offline verification-seeking entity shall inform the individual undergoing offline verification, or in the case of a child, his parent or guardian the following details with respect to offline verification, in such manner as may be specified by regulations, namely:—(a) the nature of information that may be shared upon offline verification; (b) the uses to which the information received during offline verification may be put by the offline verification-seeking entity; and(c) alternatives to submission of information requested for, if any20(4) no offline verification-seeking entity shall—(a) subject an aadhaar number holder to authentication; (b) collect, use, or store an aadhaar number or biometric information of any individual for any purpose;25(c) take any action contrary to any obligation on it as may be specified by regulations"8 for section 21 of the principal act, the following section shall be substituted, namely:—substitution of new section for section 21"21 (1) the authority shall appoint such officers and employees as may be required for the discharge of its functions under this actofficers and other employees of authority30(2) the salaries and allowances payable to, and the other terms and conditions of service of, the officers and employees of the authority shall be such as may be specified by regulations" 9  after section 23 of the principal act, the following section shall be inserted, namely:—insertion of new section 23a35"23a (1) the authority may for the discharge of its functions under this act, or any rules or regulations made thereunder, by order, issue such directions from time to time to any entity in the aadhaar ecosystem, as it may consider necessarypower of authority to issue directions(2) every direction issued under sub-section (1) shall be complied with by the entity in the aadhaar ecosystem to whom such direction is issued"4010 for section 25 of the principal act, the following section shall be substituted, namely:—substitution of  new section for section 25fund"25 (1) there shall be constituted a fund to be called the unique identification authority of india fund and there shall be credited thereto—(a) all grants, fees and charges received by the authority under this act; and(b) all sums received by the authority from such other sources as may be decided upon by the central government (2) the fund shall be applied for meeting—5(a) the salaries and allowances payable to the chairperson and members and administrative expenses including the salaries, allowances and pension payable to or in respect of officers and other employees of the authority; and(b) the expenses on objects and for purposes authorised by this act"11 in section 29 of the principal act,—amendment of section 29(a) for sub-section (3), the following sub-section shall be substituted, namely:—10"(3) no identity information available with a requesting entity or offline verification-seeking entity shall be—(a) used for any purpose, other than the purposes informed in writing to the individual at the time of submitting any information for authentication or offline verification; or15(b) disclosed for any purpose, other than purposes informed in writing to the individual at the time of submitting any information for authentication or offline verification:provided that the purposes under clauses (a) and (b) shall be in clear and precise language understandable to the individual";20(b) in sub-section (4), for the words "or core biometric information", the words'',demographic information or photograph", shall be substituted 12 in section 33 of the principal act,—amendment of section 33(i) in sub-section (1),—25(a) for the words "district judge", the words "judge of a high court"shall be substituted;(b) in the proviso, after the words "hearing to the authority", the words"and the concerned aadhaar number holder" shall be inserted;(c) after the proviso, the following proviso shall be inserted, namely:—"provided further that the core biometric information shall not be disclosed under this sub-section"30(ii) in sub-section (2), for the words "joint secretary", the word "secretary"shall be substituted 13 after chapter vi of the principal act, the following chapter shall be inserted, namely:—insertion of new chapter via35 "chapter via civil penalties40penalty for failure to comply with provisions of this act, rules, regulations and directions33a (1) where an entity in the aadhaar ecosystem fails to comply with the provision of this act, the rules or regulations made thereunder or directions issued by the authority under section 23a, or fails to furnish any information, document, or return of report required by the authority, such entity shall be liable to a civil penalty which may extend to one crore rupees for each contravention and in case of a continuing failure, with additional penalty which may extend to ten lakh rupees for every day during which the failure continues after the first contravention45(2) the amount of any penalty imposed under this section, if not paid, may be recovered as if it were an arrear of land revenuepower to adjudicate533b (1) for the purposes of adjudication under section 33a and imposing a penalty thereunder, the authority shall appoint an officer of the authority, who is not below the rank of a joint secretary to the government of india and possessing such qualification and experience as may be prescribed, to be an adjudicating officer for holding an inquiry in such manner as may be prescribed(2) no inquiry under sub-section (1) shall be initiated except by a complaint made by the authority(3) while holding an inquiry, the adjudicating officer shall—10(a) provide the entity in the aadhaar ecosystem against whom complaint is made, an opportunity of being heard;(b) have the power to summon and enforce the attendance of any person acquainted with the facts and circumstances of the case to give evidence or to produce any document which, in the opinion of the adjudicating officer, may be useful for or relevant to the subject matter of the inquiry15 20(4) if the adjudicating officer, on such inquiry, is satisfied that the entity in the aadhaar ecosystem has failed to comply with any provision of this act or the rules or regulations made thereunder or directions issued by the authority under section 23a, or has failed to furnish any information, document, or return of report required by the authority, the adjudicating officer may, by order, impose such penalty under section 33a as he thinks fitappeals to appellate tribunal24 of 199733c (1) the telecom disputes settlement and appellate tribunal established under section 14 of the telecom regulatory authority of india act, 1997, shall be appellate tribunal for the purposes of hearing appeals against the decision of the adjudicating officer under this act25(2) a person or entity in the aadhaar ecosystem aggrieved by an order of the adjudicating officer under section 33b, may prefer an appeal to the appellate tribunal within a period of forty-five days from the date of receipt of the order appealed against, in such form and manner and accompanied with such fee as may be prescribed:30provided that the appellate tribunal may entertain an appeal after the expiry of the said period of forty-five days if it is satisfied that there was sufficient cause for not filing it within that period35(3) on receipt of an appeal under sub-section (2), the appellate tribunal may, after giving the parties to the appeal an opportunity of being heard, pass such orders thereon as it thinks fit, confirming, modifying or setting aside the order appealed against(4) the appellate tribunal shall send a copy of every order made by it to the parties to the appeal and to the adjudicating officer40(5) any appeal filed under sub-section (2) shall be dealt with by the appellate tribunal as expeditiously as possible and every endeavour shall be made by it to dispose of the appeal within six months from the date on which it is presented to it(6) the appellate tribunal may, for the purpose of deciding an appeal before it, call for the records relevant to disposing of such appeal and make such orders as it thinks fitprocedure and powers of the appellate tribunal33d the provisions of sections 14-i to 14k (both inclusive), 16 and 17 of the telecom regulatory authority of india act, 1997 shall, mutatis mutandis, apply to the appellate tribunal in the discharge of its functions under this act, as they apply to it in the discharge of its functions under that act5 of 1908appeal to supreme court of india33e (1) notwithstanding anything contained in the code of civil procedure, 1908or in any other law for the time being in force, an appeal shall lie against any order, not being an interlocutory order, of the appellate tribunal to the supreme court on any substantial question of law arising out of such order5(2) no appeal shall lie against any decision or order made by the appellate tribunal which the parties have consented to(3) every appeal under this section shall be preferred within a period of forty-five days from the date of the decision or order appealed against:10provided that the supreme court may entertain an appeal after the expiry of the said period of forty-five days if it is satisfied that there was sufficient cause for not filing it within that periodcivil court not to have jurisdiction1533f no civil court shall have jurisdiction to entertain any suit or proceeding in respect of any matter which an adjudicating officer appointed under this act or the appellate tribunal is empowered, by or under this act to determine, and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power conferred by or under this act"amendment of section 3814 in section 38 of the principal act, for the words "three years", the words"ten years" shall be substitutedamendment of section 392015 in section 39 of the principal act, for the words "three years", the words"ten years" shall be substituted16 for section 40 of the principal act, the following section shall be substituted, namely:—substitution of new section for section 40"40 whoever,—25| (                                                  | a   | ) being a requesting entity, uses the identity information of an individual   ||----------------------------------------------------|-----|-------------------------------------------------------------------------------|| in contravention of sub-section (                  | 2   | ) of section 8; or                                                            || (                                                  | b   | ) being an offline verification-seeking entity, uses the identity information || of an individual in contravention of sub-section ( | 2   | ) of section 8a,                                                              || penalty for                                        |     |                                                                               || unauthorised                                       |     |                                                                               || use by                                             |     |                                                                               || requesting                                         |     |                                                                               || entity or                                          |     |                                                                               || offline                                            |     |                                                                               || verification-                                      |     |                                                                               || seeking entity                                    |     |                                                                               ||                                                    |     |                                                                               |30shall be punishable with imprisonment which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both" amendment of section 4217 in section 42 of the principal act, for the words "one year", the words"three years" shall be substitutedamendment of section 4718 in section 47 of the principal act, in sub-section (1), the following proviso shall be inserted, namely:—35"provided that the court may, on a complaint made by an aadhaar numberholder or individual take cognizance of any offence punishable under section 34 or 35 or 36 or 37 or 40 or section 41"19 after section 50 of the principal act, the following section shall be inserted, namely:—40insertion of new section 50a43 of 1961exemption from tax on income"50a notwithstanding anything contained in the income-tax act, 1961 or anyother enactment for the time being in force relating to tax on income, profits or gains, the authority shall not be liable to pay income-tax or any other tax in respect of its income, profits or gains"amendment of section 514520 in section 51 of the principal act, for the words "member, officer", the words"member or officer" shall be substituted21 in section 53 of the principal act, in sub-section (2),—amendment of section 53(i) after clause (a), the following clause shall be inserted, namely:—"(aa) the purpose for which the requesting entity may be allowed by the authority to perform authentication under sub-clause (ii) of clause (b) of sub-section (4) of section 4;";5(ii) after clause (g), the following clauses shall be inserted, namely:—"(ga) the qualification and experience of, and the manner of appointment of,  the adjudicating officer under sub-section (1) of section 33b;10(gb) the form, manner, and fee for an appeal to be filed under sub-section (2) of section 33c;"22 in section 54 of the principal act, in sub-section (2),—amendment of section 54(i) for clause (a), the following clause shall be substituted, namely:—15"(a) the entities or group of entities in the aadhaar ecosystem under clause (aa), the biometric information under clause (g) and the demographic information under clause (k), the process of collecting demographic information and biometric information from the individuals by enrolling agencies under clause (m), and the modes of offline verification of aadhaar number holder under clause (pa) of section 2;"; (ii) after clause (b), the following clauses shall be inserted, namely:—20"(ba) the manner of generating an alternative virtual identity under sub-section (4) of section 3;(bb) the manner in which cancellation of an aadhaar number may be carried out under sub-section (2) of section 3a"; (iii) after clause (c), the following clauses shall be inserted, namely:—25"(ca) standards of privacy and security to be complied with by the requesting entities under sub-section (4) of section 4;(cb) the classification of requesting entities under sub-section (5) of section 4;";(iv) after clause (f), the following clauses shall be inserted, namely:—30"(fa) the alternate and viable means of identification of individual under the proviso to clause (b) of sub-section (2) of section 8;(fb) the manner of obtaining consent under clause (a) of sub-section (2), the manner of providing information to the individual undergoing offline verification under sub-section (3), and the obligations of offline verification-seeking entities under clause (c) of sub-section (4), of section 8a;"3523 section 57 of the principal act shall be omittedomission of section 57 part iii amendment to the indian telegraph act, 18854024 in section 4 of the indian telegraph act, 1885, after sub-section (2), the following sub-sections shall be inserted, namely:—amendment of section 4 of act 13 of 1885'(3) any person who is granted a license under the first proviso to sub-section (1) to establish, maintain or work a telegraph within any part of india, shall identify any person to whom it provides its services by—(a) authentication under the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016; or18 of 2016(b) offline verification under the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016; or18 of 2016515 of 1967(c) use of passport issued under section 4 of the passports act, 1967; or(d) use of any other officially valid document or modes of identification asmay be notified by the central government in this behalf10(4) if any person who is granted a license under the first proviso to sub-section (1) to establish, maintain or work a telegraph within any part of india is using authentication under clause (a) of sub-section (3) to identify any person to whom it provides its services, it shall make the other modes of identification under clauses (b) to (d) of sub-section (3) also available to such person15(5) the use of modes of identification under sub-section (3) shall be a voluntary choice of the person who is sought to be identified and no person shall be denied any service for not having an aadhaar number(6) if, for identification of a person, authentication under clause (a) of sub-section (3) is used, neither his core biometric information nor the aadhaar number of the person shall be stored20(7) nothing contained in sub-sections (3), (4) and (5) shall prevent the central government from specifyingfurther safeguards and conditions for compliance by any person who is granted a license under the first proviso to sub-section (1) in respect of identification of person to whom it provides its services2518 of 2016explanation—the expressions "aadhaar number"and "core biometric information" shall have the same meanings as are respectively assigned to themin clauses (a) and (j) of section 2 of the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016' part iv amendment to the prevention of money-laundering act, 200215 of 200230insertion of new section 11a25 in chapter iv of the prevention of money-laundering act, 2002 (hereafter in this part, referred to as the principal act), before section 12, the following section shall be inserted, namely:—| '11a (                                                                         | 1   | ) every reporting entity shall verify the identity of its clients and the   ||---------------------------------------------------------------------------------|-----|-----------------------------------------------------------------------------|| beneficial owner, by—                                                           |     |                                                                             || verification of                                                                 |     |                                                                             || identity by                                                                     |     |                                                                             || reporting                                                                       |     |                                                                             || entity                                                                         |     |                                                                             || 18 of 2016                                                                     | 35  |                                                                             || (                                                                               | a   | ) authentication under the aadhaar (targeted delivery offinancial and       || other subsidies, benefits and services) act, 2016 if  the reporting entity is a |     |                                                                             || banking company; or                                                             |     |                                                                             || 18 of 2016                                                                     |     |                                                                             || (                                                                               | b   | ) offline verification under the aadhaar (targeted delivery of financial    || and other subsidies, benefits and services) act, 2016; or                       |     |                                                                             || 15 of 1967                                                                     |     |                                                                             || (                                                                               | c   | ) use of passport issued under section 4 of the passports act, 1967; or     || 40                                                                              |     |                                                                             || (                                                                               | d   | ) use of any other officially valid document or modes of identification as  || may be notified by the central government in this behalf:                       |     |                                                                             || 45                                                                              |     |                                                                             || 18 of 2016                                                                     |     |                                                                             |provided that the central government may, if satisfied that a reporting entityother than banking company, complies with such standards of privacy and security under the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016, and it is necessary and expedient to do so, by notification, permit such entity to perform authentication under clause (a):provided further that no notification under the first proviso shall be issued without consultation with the unique identification authority of india established under sub-section (1) of section 11 of the aadhaar (targeted deliveryof financial and other subsidies, benefits and services) act, 2016 and the appropriate regulator18 of 2016 5(2) if any reporting entity performs authentication under clause (a) of sub-section (1), to verify the identity of its client or the beneficial owner it shall make the other modes of identification under clauses (b), (c) and (d) of sub-section (1) also available to such client or the beneficial owner10(3) the use of modes of identification under sub-section (1) shall be a voluntary choice of every client or beneficial owner who is sought to be identified and no client or beneficial owner shall be denied services for not having an aadhaar number(4) if, for identification of a client or beneficial owner, authentication or offline verification under clause (a) or clause (b) of sub-section (1) is used, neither his core biometric information nor his aadhaar number shall be stored15(5) nothing in this section shall prevent the central government from notifying additional safeguards on any reporting entity in respect of verification of the identity of its client or beneficial owner20 18 of 2016explanation—the expressions "aadhaar number" and "core biometric information" shall have the same meanings as are respectively assigned to them in clauses (a) and (j) of section 2 of the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016'amendment of section 1226 in section 12 of the principal act, in sub-section (1), clauses (c) and (d) shall beomittedamendment of section 732527 in section 73 of the principal act, in sub-section (2), clauses (j) and (jj) shall beomitted28 (1) the aadhaar and other laws (amendment) ordinance, 2019 is hereby repealedrepeal and savingsord 9 of 2019(2) notwithstanding the repeal of the said ordinance, anything done or any action taken under the said ordinance shall be deemed to have been done or taken under the corresponding provisions of this act statement of objects and reasonsthe aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016 (the aadhaar act) was enacted to provide for good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services, the expenditure for which is incurred from the consolidated fund of india, to individuals residing in india through assigning of unique identity numbers to such individuals and for matters connected therewith or incidental thereto2 on 27th july, 2018 the committee of  experts chaired by justice (retd) b n srikrishna submitted its report "a free and fair digital economy: protecting privacy, empowering indians" regarding various issues related to data protection along with a draft personal data protection bill and also suggested certain amendments to the aadhaar act3 the constitution bench of the supreme court, in its judgment dated the 24th august,2017 in wp 494 of 2012 - justice ks puttaswamy (retd) and another vs uoi and others declared privacy as a fundamental right under article 21 of the constitution further, the supreme court vide its judgment dated the 26th september, 2018 has upheld the constitutional validity of the aadhaar act, with certain restrictions and changes, such as obtaining consent of parent or guardian in case of enrolment of children, providing option to children to cancel their aadhaar number on attaining the age of eighteen years, providing for informed consent for authentication and limiting the authentication only to purposes permitted by law4 with over 122 crore aadhaar numbers having been issued and with the widespread use of aadhaar as a proof of identity for various purposes by the government of india, state governments and other entities, it is essential to have a regulatory framework for the operation of aadhaar the unique identification authority of india (the authority) created under the aadhaar act, therefore, must have powers similar to that of a regulator for taking enforcement actions the aadhaar act, in its present form, does not empower the authority to take enforcement action against errant entities in the aadhaar ecosystem this needs to be addressed with a view to protect privacy and also to ensure the autonomy of the authority5 it is, therefore, proposed to amend the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016, the indian telegraph act, 1885 and the prevention of money-laundering act, 2002 the salient features of the bill are as follows—(a) to provide for twelve-digit aadhaar number and its alternate numbers to be generated by the authority in such manner as may be specified by regulations to conceal the actual aadhaar number of an individual;(b) to give an option to children who are aadhaar number holders to cancel their aadhaar number on attaining the age of eighteen years;(c) to provide for voluntary use of aadhaar number in physical or electronic form by authentication or offline verification or any other mode which may be notified by the central government;(d) authentication of offline verification of aadhaar number can be performed only with the informed consent of the aadhaar number holder;(e) prevention of denial of services for refusing to, or being unable to, undergo authentication;(f) to permit the entities performing authentication only when they are compliant with the standards of privacy and security specified by the authority; and the authentication is permitted under any law made by parliament or the authentication is for such purpose, as the central government may, in consultation with the authority and in the interest of state, prescribe;(g) to lay down the procedure for offline verification of an aadhaar number holder;(h) to confer power upon the authority to give such directions as it may consider necessary to any entity in aadhaar ecosystem;(i) for establishment of unique identification authority of india fund; (j) to enhance the restrictions on sharing of information by requesting entity and offline verification-seeking entity;(k) to provide for civil penalties, its adjudication, appeal thereof and realisation of the sum of penalty as arrear of land revenue;(l) to omit section 57 of the aadhaar act relating to use of aadhaar by private entities;(m) to allow the use of aadhaar number for authentication on voluntary basis as acceptable kyc document under the telegraph act, 1885 and the prevention of moneylaundering act, 2002 6 the notes on clauses explain in detail the various provisions of the bill 7  as parliament was not in session and an urgent legislation was required to be made, the president promulgated the aadhaar and other laws (amendment) ordinance, 2019 (ord 9 of 2019) on 2nd march, 20198 the bill seeks to replace the aforesaid ordinancenew delhi;the 14th june, 2019ravi shankar prasad notes on clausesclause 1—this clause seeks to provide for short title and commencement of the actclause 2—this clause seeks to amend section 2 of the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016 (the aadhaar act) relating to definitions so as to provide for new definitions of certain expressions used in the bill, which, inter alia, include the definitions of "aadhaar number", "aadhaar ecosystem", "adjudication officer", "appellate tribunal", "child", "offline verification" and "offline verification seeking entity"clause 3—this clause seeks amend section 3 of the aadhaar act relating to aadhaar number so as to insert a new sub-section (4) therein providing for "any alternative virtual identity generated by the authority" within the meaning of aadhaar numberclause 4—this clause seeks to insert a section 3a in the aadhaar act which provides for "aadhaar number of children"clause 5—this clause seeks to amend section 4 of the aadhaar act relating to properties of aadhaar number so as to substitute sub-section (3) thereof with five new sub-sections which provide for voluntary use of aadhaar number, conditions under which entities can perform authentication, classification of entities into those that can use aadhaar number and those that can use only alternative virtual identity, offering alternate and viable means of identification and condition for mandatory authenticationclause 6—this clause seeks to amend section 8 of the aadhaar act relating to authentication of aadhaar number  so as to amend sub-sections (2) and (3) to provide for the requirement of obtaining the consent of the parent or guardian before authenticating the aadhaar number issued to a childclause 7—this clause seeks to insert a new section 8a in the aadhaar act so as to provide for offline verification of aadhaar numberclause 8—this clause seeks to substitute section 21 of the aadhaar act relating to officers and other employees of authority so as to provide for appointment of officers and other employees by the authorityclause 9—this clause seeks to insert a new section 23a to the aadhaar act relating to power of authority to issue directions it provides that the authority may issue directions to the entities in the aadhaar ecosystem for the discharge of its functions under the actclause 10—this clause seeks to substitute section 25 of the aadhaar act to provide for constitution of a unique identification authority of india fundclause 11—this clause seeks to amend section 29 of the aadhaar act relating to restriction on sharing information it substitutes sub-sections (3) and (4) thereof so as to provide that identity information is not used for any other purposeclause 12—this clause seeks to amend section 33 of the aadhaar act relating to disclosure of information in certain cases it seeks to amend sub-sections (1) and (2) thereof, inter alia, to provide the individual, whose information is sought to be released, an opportunity of hearing and stepping up disclosure permissions to higher levelsclause 13—this clause seeks to insert a new chapter via in the aadhaar act so as to provide for civil penalties the proposed new section 33a provides for civil penalty which may extend to one crore rupees for each contravention, for failure to comply with provisions of the act, rules, regulations and directions by any entity in the aadhaar ecosystem the proposed new section 33b provides for appointment of an adjudicating officer by the authority and the procedure and powers of such officer the proposed new section 33c provides that the telecom disputes settlement and appellate tribunal established under section 14 of the telecom regulatory authority of india act, 1997 as the appellate tribunal under the act for hearing of appeals against the order of the adjudicating officer the proposed new section 33d lays down the procedures and powers of the appellate tribunal the proposed new section 33e provides for appeal to the supreme court against the orders of the appellate tribunal the proposed new section 33f provides for cases where civil court shall not have jurisdictionclause 14—this clause seeks to amend section 38 of the aadhaar act relating to penalty for unauthorised access to the central identities data repository so as to enhance the punishment from three years to ten yearsclause 15—this clause seeks to amend section 39 of the aadhaar act relating to penalty for tampering with data in central identities data repository so as to enhance the punishment from three years to ten yearsclause 16—this clause seeks to substitute section 40 of the aadhaar act relating to penalty for unauthorised use by requesting entity so as to provide for penalty for unauthorised use by requesting entity and offline verification-seeking entityclause 17—this clause seeks to amend section 42 of the aadhaar act relating to general penalty so as to enhance the punishment from one years to three yearsclause 18—this clause seeks to amend section 47 of the aadhaar act relating to cognizance of offences so as to insert a new proviso therein to provide that the aadhaar number holder or an individual may also file a complaint and initiate proceedings in respect of any offence punishable under sections 34, 35, 36, 37, 40 or 41 of the principal actclause 19—this clause seeks to insert a new section 50a in the aadhaar act relating to exemption from tax on income so as to exempt the authority from tax on income, profits or gainsclause 20—this clause seeks to amend section 51 of the aadhaar act relating to delegation so as to substitute the words "member, officer" with "member or officer"clause 21—this clause seeks to amend section 53 of the aadhaar act relating to power of central government to make rules so as to inserts new clauses in sub-section (2)providing for rules on certain matters proposed under the billclause 22—this clause seeks to amend section 54 of the aadhaar act relating to power of the authority to make regulations so as to insert new clauses in sub-section (2)providing for regulations on certain matters proposed under the billclause 23—this clause seeks to omit section 57 of the aadhaar act relating to act not to prevent use of aadhaar number for other purposes under lawclause 24—this clause seeks to amend section 4 of the indian telegraph act, 1885relating to exclusive privilege in respect of telegraphs, and power to grant licenses so as to insert therein new sub-sections (3), (4), (5), (6) and (7) to provide for the use of aadhaar authentication and offline verification on voluntary basis besides other modes for identification, of persons who receive services from a licenseeclause 25—this clause seeks to insert a new section 11a under chapter 4 relating to obligations of banking companies, financial institutions and intermediaries to the prevention of money-laundering act, 2002 (the pml act) so as to provide for the use of aadhaar authentication and offline verification on voluntary basis besides other modes for verification of identity of a client or beneficial owner by a reporting entityclause 26—this clause seeks to amend section 12 of the pml act relating to reporting entity to maintain records so as to omit clauses (c) and (d) of sub-section (1) thereofclause 27—this clause seeks to amend section 73 of the pml act relating to power to make rules so as to omit clauses (j) and (jj) of sub-section (2) thereofclause 28––this clause seeks to replace the aadhaar and other laws (amendment)ordinance, 2019 and to save the action done during the said ordianance memorandum regarding delegated legislationclause 21 of the bill seeks to amend section 53 of the act which confers power upon the central government to make rules providing for—(i) the purpose for which the requesting entity may be allowed to perform authentication under sub-clause (ii) of clause (b) of sub-section (6) of section 4; (ii) the qualification and experience of, and the manner of appointment of, the adjudicating officer under sub-section (1) of section 33b; and (iii) the form, manner, and fee for an appeal to be filed under sub-section (2) of section 33d2 clause 22 of the bill seeks to amend section 54 the act which confers power upon the authority to make regulations providing for—(i) the entities or group of entities in the aadhaar ecosystem under clause (aa), the biometric information under clause (g) and the demographic information under clause (k), the process of collecting demographic information and biometric information from the individuals by enrolling agencies under clause (m), and the modes of offline verification of aadhaar number holder under clause (pa) of section 2; (ii) the manner of generating alternate aadhaar number under sub-section (4) of section 3; (iii) the manner in which cancellation of an aadhaar number may be carried out under sub-section (2) of section 3a; (iv) standards of privacy and security to be complied with by the requesting entities under sub-section (4) of section 4; (v) the classification of requesting entities under sub-section (5) of section 4; (vi) the alternate and viable means of identification of individual under the proviso to clause (b) of sub-section (2) of section 8; and (vii) the manner of obtaining consent under clause (a) of sub-section (2), the manner of providing information to the individual undergoing offline verification under sub-section (3), and the obligations of offline verification-seeking entities under clause (c) of sub-section (4), of section 8a3 the matters in respect of which the rules or regulations may be made are matters of procedure and administrative detail and it is not practicable to provide for them in the bill itself the delegation of legislative power is, therefore, of a normal character annexure extracts from the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016 (18 of 2016)|     |     |     |     |    ||------|------|------|------|-----|definitions2 in this act, unless the context otherwise requires,—(a) "aadhaar number" means an identification number issued to an individual under sub-section (3) of section 3;8 (1)    4 (1)    properties of aadhaar number(3) an aadhaar number, in physical or electronic form subject to authenticationand other conditions, as may be specified by regulations, may be accepted as proof of identity of the aadhaar number holder for any purpose21 of 2000explanation—for the purposes of this sub-section, the expression "electronic form" shall have the same meaning as assigned to it in clause (r) of sub-section (1) of section 2 of the information technology act, 20008 (1)    8 (1)    (2) a requesting entity shall—authentication of aadhaar number(a) unless otherwise provided in this act, obtain the consent of an individual before collecting his identity information for the purposes of authentication in such manner as may be specified by regulations; and(b) ensure that the identity information of an individual is only used for submission to the central identities data repository for authentication (3) a requesting entity shall inform, in such manner as may be specified by regulations, the individual submitting his identity information for authentication, the following details with respect to authentication, namely:—|     |     |     |     |    ||------|------|------|------|-----|21 (1) the authority may, with the approval of the central government, determine the number, nature and categories of other officers and employees required by the authority in the discharge of its functionsofficers and other employees of authority (2) the salaries and allowances payable to, and the other terms and conditions of service of, the chief executive officer and other officers and other employees of the authority shall be such as may be specified by regulations with the approval of the central government|     |     |     |     |    ||------|------|------|------|-----|other fees and revenues25 the fees or revenue collected by the authority shall be credited to the consolidated fund of india|                |    |                                                                        |     |     |     |     |    ||----------------|----|------------------------------------------------------------------------|------|------|------|------|-----|| 29            | (  | 1                                                                      | )   |     |     |     |    || restriction on |    |                                                                        |      |      |      |      |     || sharing        |    |                                                                        |      |      |      |      |     || information   |    |                                                                        |      |      |      |      |     || (              | 3  | ) no identity information available with a requesting entity shall be— |      |      |      |      |     |(a) used for any purpose, other than that specified to the individual at the time of submitting any identity information for authentication; or (b) disclosed further, except with the prior consent of the individual to whom such information relates (4) no aadhaar number or core biometric information collected or created under this act in respect of an aadhaar number holder shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations     disclosure of information in certain cases33 (1) nothing contained in sub-section (2) or sub-section (5) of section 28 or sub-section (2) of section 29 shall apply in respect of any disclosure of information, including identity information or authentication records, made pursuant to an order of a court not inferior to that of a district judge:provided that no order by the court under this sub-section shall be made without giving an opportunity of hearing to the authority (2) nothing contained in sub-section (2) or sub-section (3) of section 29 shall apply in respect of any disclosure of information, including identity information or authentication records, made in the interest of national security in pursuance of a direction of an officer not below the rank of joint secretary to the government of india specially authorised in this behalf by an order of the central government:provided that every direction issued under this sub-section, shall be reviewed by an oversight committee consisting of the cabinet secretary and the secretaries to the government of india in the department of legal affairs and the department of electronics and information technology, before it takes effect:provided further that any direction issued under this sub-section shall be valid for a period of three months from the date of its issue, which may be extended for a further period of three months after the review by the oversight committee     38 whoever, not being authorised by the authority, intentionally,—(a) accesses or secures access to the central identities data repository; (b) downloads, copies or extracts any data from the central identities data repository or stored in any removable storage medium;penalty for unauthorised access to the central identities data repository(c) introduces or causes to be introduced any virus or other computer contaminant in the central identities data repository; (d) damages or causes to be damaged the data in the central identities data repository; (e) disrupts or causes disruption of the access to the central identities data repository; (f) denies or causes a denial of access to any person who is authorised to access the central identities data repository;(g) reveals any information in contravention of sub-section (5) of section 28, or shares, uses or displays information in contravention of section 29 or assists any person in any of the aforementioned acts;(h) destroys, deletes or alters any information stored in any removable storage media or in the central identities data repository or diminishes its value or utility or affects it injuriously by any means; or(i) steals, conceals, destroys or alters or causes any person to steal, conceal, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which shall not be less than ten lakh rupees21 of 2000explanation—for the purposes of this section, the expressions "computer contaminant", "computer virus" and "damage" shall have the meanings respectively assigned to them in the explanation to section 43 of the information technology act, 2000, and the expression "computer source code" shall have the meaning assigned to it in the explanation to section 65 of the said act39 whoever, not being authorised by the authority, uses or tampers with the data in the central identities data repository or in any removable storage medium with the intent of modifying information relating to aadhaar number holder or discovering any information thereof, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which may extend to ten thousand rupeespenalty for tampering with data in central identities data repository40 whoever, being a requesting entity, uses the identity information of an individual in contravention of sub-section (3) of section 8, shall be punishable with imprisonment which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with bothpenalty for unauthorised use by requesting entity    general penalty42 whoever commits an offence under this act or any rules or regulations madethereunder for which no specific penalty is provided elsewhere than this section, shall be punishable with imprisonment for a term which may extend to one year or with a fine which may extend to twenty-five thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees, or with both    cognizance of offences47 (1) no court shall take cognizance of any offence punishable under this act, saveon a complaint made by the authority or any officer or person authorised by it    delegation51the authority may, by general or special order in writing, delegate to any member,officer of the authority or any other person, subject to such conditions, if any, as may be specified in the order, such of its powers and functions under this act (except the power under section 54) as it may deem necessary    54 (1)    power of authority to make regulations(2) in particular, and without prejudice to the generality of the foregoing power, such regulations may provide for all or any of the following matters, namely:—(a) the biometric information under clause (g) and the demographic information under clause (k), and the process of collecting demographic information and biometric information from the individuals by enrolling agencies under clause (m) of section 2;|     |     |     |     |    ||------|------|------|------|-----|57 nothing contained in this act shall prevent the use of aadhaar number for establishing the identity of an individual for any purpose, whether by the state or anybody corporate or person, pursuant to any law, for the time being in force, or any contract to this effect:act not to prevent use of aadhaar number for other purposes under lawprovided that the use of aadhaar number under this section shall be subject to the procedure and obligations under section 8 and chapter vi|     |     |     |     |    ||------|------|------|------|-----|(15 of 2003)     chapter iv obligations of banking companies, financial institutions and intermediaries12 (1) every reporting entity shall—     reporting entity to maintain records(c) verify the identity of its clients in such manner and subject to such conditions, as may be prescribed;(d) identify the beneficial owner, if any, of such of its clients, as may be prescribed;    73(1)    power to make rules(2) in particular, and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:—    (j) the manner and the conditions in which identity of clients shall be verified by the reporting entities under clause (c) of sub-section (1) of section 12; (jj) the manner of identifying beneficial owner, if any, from the clients by the reporting entities under clause (d) of sub-section (1) of section 12;    ———— a billto amend the aadhaar (targeted delivery of financial and other subsidies, benefits and services) act, 2016 and further to amend the indian telegraph act, 1885 and the prevention of money-laundering act, 2002————(shri ravi shankar prasad, minister of law and justice; communications and electronics and information technology)mgipmrnd—594ls—18-06-2019