Courting Controversy: Protecting fair and democratic elections from Aadhaar’s harvested data!!

Nakul Dewan

“What’s the currency of the world now?………… It’s not gold, it’s data. It’s the information.” American Democratic Political Strategist – Stan Greenberg

Two major electoral verdicts, which left a significant number of people around the world perplexed in 2016-2017, were Brexit, where the United Kingdom chose to leave the European Union, and the election of Donald Trump as the President of the United States.

Both verdicts have been questioned and even considered freak results in recent history. While Brexit impacts more than just the sovereignty of the United Kingdom, the poll is still out on where the United States will be at the end of the Trump regime.

The one common factor in both these has been the influence of the British political consulting firm Cambridge Analytica, which has disgracefully become prominent for violating the privacy of Facebook users, by using data in breach of Facebook’s terms and conditions, to strategize electoral campaigns.

Cambridge Analytica’s influence has run across elections all over the world, including India, where through its business partner Oveleno Business Intelligence, it reportedly assisted the present ruling party in the 2014 general election and the opposition.

The Cambridge Analytica-Facebook controversy could not have blown up at a more appropriate time from an Indian judicial perspective. Having held in K.S. Puttaswamy vs Union of India (2017) 10 SCC 1 (Puttaswamy) that the right to privacy is a fundamental right, the Supreme Court is in the midst of hearing arguments on the Aadhaar case, which is now wading into the government’s submissions justifying the mandatory applicability of Aadhaar.

The controversy throws up four interesting facets, which are relevant for the Supreme Court to consider. The first, that data privacy can be breached on a large scale and there is nothing like fool proof protection of data. The second, that even a large-scale breach may never be disclosed to the persons whose data has been wrongfully taken. The third, that even after the breach has taken place, it is difficult to police the breach and its consequences especially if it has passed on to multiple people, and fourth, that the data, when harvested, can influence outcomes on a large scale, including elections, without the affected persons even being aware about it.

Harvesting of information

In the traditional farming sense, harvesting is the act of removing crops from where it is growing and moving it to a more secure location for processing, consumption, or storage. Where information is the subject matter, the act of removing information from where it is growing and moving it elsewhere for its analytical processing and strategic use, amounts to harvesting of information. While it may not be unethical if removal of information is based on consent, as that would fall into Nariman J.’s compartment set out at paragraph 495 of Puttaswamy that “[i]f a person was to paste on Facebook vital information ….. such information, being in the public domain, could not possibly be claimed as a privacy right after such disclosure”, it would clearly violate a person’s privacy if such removal is done in breach of the terms and conditions that apply to the uploading of the information.

That is precisely where the hard facts from the Cambridge Analytica-Facebook controversy show how big a deal this is. The matter in issue is the use of information of 50 million Facebook users without their knowledge or consent by Cambridge Analytica for strategically determining electoral campaigns.

That is data of approximately double the size of Delhi’s total population and presumably four times the size of its voters. As a company, Cambridge Analytica uses inherent psychological traits to affect voters’ behavior through teams of psychologists and data scientists. One contract which Cambridge Analytica had entered into described the services it provided to be “behavioral microtargeting with psychographic messaging.” To be armed with knowledge about traits of people is, as a founder of Cambridge Analytica stated, “……. supposed to be the arsenal of weapons to fight [a] cultural war.”

Simon Milner, Vice-President of Facebook’s Public Policy for Asia-Pacific admitted on March 22, 2018 before a Select Parliamentary Committee constituted by the Republic of Singapore, that the breach went as far as constituting a breach of trust between Facebook and its users, who expected their data to be protected by Facebook. But in this context, breach of trust between Facebook and its users is only part of the problem. The bigger issue is the time it took for the world to have become aware about the full extent of the breach.

When being questioned by the Select Committee, Mr. Milner accepted that Facebook had become aware as early as 2015 that data had been given to Cambridge Analytica in clear violation of Facebook’s terms and conditions. However, even as late as February 8, 2018, when he appeared before the British Parliament’s Select Committee, Facebook did not publicly acknowledge that in breach of Facebook’s policies, Cambridge Analytica had misused Facebook’s data. In fact, during Mr. Milner’s questioning before the Singapore Select Committee, which was after the Cambridge Analytica news had surfaced, he admitted that with the benefit of hindsight, Facebook had not made a full and frank disclosure before the British Parliament’s Select Committee.

The impact of this is enormous. Harvested information is an extremely essential tool for electioneering once it is fed into an artificially intelligent system with defined parameters.  That is simply because harvested data is not only a key to political persuasion, but when such data is acquired without the knowledge of a group of persons, it allows the acquirer to exploit the vulnerability of that group and lead an election campaign simply exploiting such vulnerability.

Can handing the Aadhar data to the government be the answer towards data protection in a democratic country? At paragraph 328 of Puttaswamy, the Supreme Court stated that “[w]e commend to the Union Government the need to examine and put into place a robust regime for data protection”. That, however, may not be sufficient if it simply seeks to entrust data protection to the government. Clearly the government is an interested party because any harvested Aadhaar data would allow it to exploit the vulnerability of voters in subsequent election campaigns. The government cannot, therefore, be considered as an independent or a neutral protector of the data, because it can potentially harvest the data for its own electioneering benefit. That would go against the concept of free and fair elections, which is a basic tenet of democracy.

Giving data to a private party is also certainly not the answer, given that the conduct of a company as credible as Facebook has been extremely wanting. One might argue that the answer lies in the creation of a completely independent agency for data protection, one which is impenetrable and cannot be influenced. But could such an institution be created, given that it would then potentially be more powerful than any other institution in India because it would have at its fingertips data of each and every individual in India? The magnitude of the power vested in such an institution would make policing it implausible and presumably leave it with no checks and balances.

Aadhaar may have certain values which are laudable. However, the scale at which it is sought to be mandatorily applied in India poses significant threats to which credible answers have not been forthcoming. Till then, the mandatory application of Aadhar for practically everything that is done in India needs to be carefully monitored or even reconsidered.

Nakul Dewan is an Advocate at the Supreme Court of India and Barrister at 20, Essex Street Chambers, Singapore and London