The ‘Legitimacy’ Of Data Driven Elections - II

Introduction

India’s welfare schemes touch the lives of hundreds of millions of citizens. When these citizens sign up for a government benefit, they hand over some form of personal information like their name, Aadhaar number, mobile number, bank account details and/or any other particulars. This data however, often leads into the hands of political parties. In the run up to the 2019 general elections, a Union Minister reportedly stated that “beneficiaries are present in every poor household, and their testimonies are our campaign”, describing welfare scheme beneficiaries as not just targets but a “new addition to our voter base”¹.  This was not an isolated statement. In  2021, Uttar Pradesh’s, welfare scheme beneficiaries were described by a political party as the “biggest voter class cutting across castes and communities”².

We argue that the processing of welfare data, beyond the purpose for which it was taken, to create voter profile and targeted campaigning, is in complete contravention of the parameters and safeguards laid down by the Apex Court in Justice K.S. Puttaswamy v. Union of India³ towards utilization of Aadhar data. 

In Part 1, we covered how this access is even possible and if there has been judicial intervention thus far. We also examined how political parties use digital tools and analytics platforms, for electoral campaigning and concluded that political parties are not “State” under the Digital Personal Data Protection Act, 2023 (“DPDPA”).

This article examines the specific legal framework governing data collected through government welfare schemes, primarily the Aadhaar (Targeted Delivery of Financial and Other Subsidiaries, Benefits and Services) Act, 2016 (“Aadhaar Act”), the safeguards laid down by the Apex Court in Justice K.S. Puttaswamy v. Union of India⁴ and the foundational principles of data privacy laid down under Digital Personal Data Protection Act, 2023, to determine the accountability when such data is processed otherwise and determine the gaps that the current framework fails to address.  

Data protection framework under Aadhaar Act  

The intent of the Aadhaar Act is only for the purposes of targeted delivery of subsidies, benefits and services. There are no provisions in the Aadhaar Act or in any regulation made under, that permits the use of Aadhaar-linked identity information, for any form of electoral campaigning by a political party.

Considering the sensitivity of data processed under the Aadhaar Act for the purposes of welfare scheme, the Apex Court, in Justice K. S. Puttaswamy v. Union of India  (‘Puttaswamy’)⁵ while upholding its constitutional validity, laid down robust privacy measures to be undertaken while processing data under the Aadhaar Act. It is worth noting Justice Chandrachud’s dissenting opinion wherein he held the Aadhaar Act to be unconstitutional in its entirety. He observed that the Aadhaar Act is completely silent on informed consent - it does not inform citizens what their data will be used for, who can access it or what rights they have over it. He observed that informational privacy must be governed by principles of consent, transparency and individual control and that the Aadhaar Act as it stood, met none of these standards. A citizen who enrols for any subsidy and is required to provide their Aadhaar details to do so has, basis Justice Chandrachud’s opinion, consented to very little at all.

The Parliament thereafter, through the Aadhaar and Other Laws (Amendment) Act, 2019, introduced several changes to the Aadhaar Act. It inserted Section 4(4), enabling voluntary use of Aadhaar for identity verification by individuals, and amended the consent provisions to require that authentication be undertaken only with the informed consent of the individual. It also restricted the use of Aadhaar by private entities. While these amendments addressed some of the major concerns, they did not substantively respond to Justice Chandrachud’s opinion that the Aadhaar Act lacks a meaningful, granular consent mechanism that tells citizens specifically regarding the manner of processing. It is against this backdrop that the specific provisions in the Aadhaar Act must be read.

The Aadhaar Act defines “identity information” under Section 2(n) to include the Aadhaar number, biometric information and demographic information of an individual. “Demographic information” under Section 2(k) includes information such as name, date of birth, address and other relevant details. Mobile numbers linked to Aadhaar therefore, evidently fall within the scope of identity information for these purposes.

Under Section 8(3) of the Aadhaar Act, a requesting entity⁶ is strictly bound to use identity information only for the purpose it was disclosed to the individual at the time of authentication and cannot share it further without the individual’s prior consent. Section 29(1) of the Aadhaar Act prohibits Aadhaar-linked identity information, including mobile numbers linked to Aadhar with any entity outside the Unique Identification Authority of India (“UIDAI”)⁷, except for purposes specifically allowed by the Aadhaar Act. Section 29(4) goes further still, providing that identity information collected for Aadhaar enrolment or authentication shall not be used for any purpose other than the generation of Aadhaar numbers and authentication.

Chapter VII of the Aadhaar Act sets out a comprehensive penal framework. The intentional disclosure, transmission or dissemination of identity information to any person not authorized under the Aadhaar Act is a punishable offence under Section 37. Unauthorized access to the Central Identities Data Repository (“CIDR”), which is the database at the heart of the Aadhaar system, attract strict penalties under Section 38. Section 42 provides a residual catch-all for any other contravention of the Aadhaar Act not covered by a specific provision.

Pertinently, the Hon’ble Apex Court in Puttaswamy⁸ specifically warned that the Aadhaar system must be protected from commercial and political exploitation. The Court’s reasoning was grounded on the Right to Privacy, a right that the Court held is violated when data provided for a specific purpose is diverted and repurposed without the knowledge or consent of the individual to whom it identifies.

Despite this seemingly robust framework, enforcement has been shockingly absent. As discussed in Part 1 of the article, the Hon’ble High Court of Madras had sought response from the UIDAI regarding sharing of personal data and tampering of records⁹. This enforcement gap is significant given how visible the problem has become. Welfare beneficiaries have received unsolicited campaign messages through channels they never signed up for, and Government platforms like UMANG have been found to have serious data security gaps. In July 2026, security researchers identified multiple critical security flaws in the Government’s UMANG portal¹⁰ which is a unified platform that integrates thousands of Central and State Government services and is used my millions of citizens. They found that Aadhaar numbers were visible in plain text across several linked services, despite such storage being expressly prohibited under the Aadhaar Act. Exposed data included EPFO Universal Account numbers, LPG cylinder booking details and Aadhaar-linked identifiers. The Ministry of Electronics and Information Technology of India (“MeitY”) did acknowledge the findings and stated that corrective measures were being taken.¹¹ However, the bigger concern here seems to be the fact that when Aadhaar-linked welfare data is poorly secured at the infrastructure level, the question of whether it reaches political campaign systems through deliberate authorization or inadvertent leakage becomes almost secondary.

Legal framework beyond the Aadhaar Act 

The DPDPA clearly states that data collected for one purpose cannot be used for a completely different purpose, often referred to as “purpose limitation”. For example, when a farmer gives their mobile number to enrol in a welfare scheme, they are, in this case at least, giving it to receive crop support payments, not for the data to be sold. ¹² The consent is specific and bounded. This consent, as the law stands, cannot be presumed to cover electoral outreach. When a State Intrumentality collects data to deliver a welfare benefit, that data sits within the ambit of a legitimate use. The moment that data finds its way to any political party, it falls outside that scope. More importantly, the exemption that allows the State to process data without consent is only for the State and its instrumentalities  for delivering the benefit itself. When the data is processed by invoking the principle of “legitimate uses” for purposes beyond legitimate uses, it is in direct contravention of the foundational principle of purpose limitation.

As for electoral rolls, they are public documents under the Representation of the People Act, 1951 (“RPA”). Political parties may access them, and they form the legitimate starting point for any campaign outreach. However, electoral rolls contain limited data including name, age, gender and address. The RPA makes electoral roles publicly available for a specific and bounded reason, which is to enable parties and candidates to identify and reach registered voters. It confers no right, express or implied, to access government welfare databases, or beneficiary records.

Over and above what electoral roll discloses, a welfare scheme database may contain a beneficiary’s Aadhaar number, mobile number, bank account details, caste, etc., as may be relevant to that particular scheme. Taken together, this is just not identifying information but a detailed socio-economic profile of the individual. When this data reaches a political party, they hold a layered profile of each voter’s economic circumstances, government dependencies and other details about the household, none of which the voter ever agreed to being shared and most of which they may not even know has left the government’s database.

Accountability

Under the DPDPA, the entity that decides why and how personal data is processed is called a “Data Fiduciary”, and it bears the legal responsibility for ensuring that data is handled lawfully. When a State Instrumentality collects beneficiary data for a welfare scheme, it is the data fiduciary for that data. If this data then finds its way into a political party’s campaign system, the instrumentality is prima facie in breach of its obligations under the DPDPA.

In practice, however, pinning down accountability is difficult. Data rarely travels directly from a ministry / department / instrumentality, to a political party. It usually passes through middlemen like analytics firms, campaign technology vendors, etc., each of whom can claim they did not know where the data originally came from.

What should change?

The DPDPA’s purpose limitation principle clearly prohibits it. Data collected to deliver a welfare benefit cannot be stretched to cover electoral outreach, and the exemption available to State Instrumentalities, covers only the act of delivering the benefit itself and nothing beyond it. The Aadhaar Act prohibits it with even stricter provisions. It bars the sharing or repurposing of Aadhaar-linked identity information outside permitted channels. The RPA confers no authority for it. What does seem to be missing is the specific legal machinery to enforce this in practice.

The experience of other democracies shows that this is a solvable problem. The EU, the UK and Canada have all drawn a clear line between data collected for public welfare and data used for political advantage by mandating disclosures and sources of data. India’s legal framework is capable of drawing the same line. The DPDPA’s consent and purpose limitation rules already lead to that conclusion, even without explicit language on electoral campaigns. But implicit conclusions are not enough when the stakes are this high. Hence, the following changes may be a necessary start:

1. The law should expressly prohibit the use of data collected through government welfare schemes, Aadhaar enrolment, or any State administered process for electoral campaigning.
2. Political parties should be required to disclose where their campaign data comes from, what platforms are processing it and what consent was obtained. The ECI should be empowered to mandate these disclosures as part of the election expenditure reporting process under Section 77 of the RPA.
3. A clear grievance mechanism should be established, either within the Data Protection Board or the ECI, enabling voters to report and seek redress for the unlawful use of their personal data in election campaigns.

The gaps identified in this article have real consequences for real people, especially farmers, homemakers and daily wage workers whose personal information, shared in good faith to access a government benefit, is being repurposed without their knowledge to influence how they vote. The law, as it stands, already points in the right direction. The DPDPA, the Aadhaar Act and the RPA together make clear that using welfare scheme data for electoral campaigning is unlawful.

Footnotes

^{1 https://www.hindustantimes.com/india-news/beneficiaries-are-our-new-voter-base-says-prakash-javadekar/story-NiRi38Cfw2qcwjPAGnsC2K.html?ref=static.internetfreedom.in}

^{2 https://internetfreedom.in/personal-data-political-campaigning/}

^{3 Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1.}

^{4 Id.}

^{5  Id.}

^{6 Agencies or persons who submit Aadhaar and demographic or biometric information to the CIDR.}

^{7  UIDAI is a statutory body established under the Aadhaar Act responsible for securing and managing the lifecycle of the data collected under the Act, Section 23, The Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits And Services) Act, 2016; https://beta.uidai.gov.in/en/about-uidai}

^{8 Supra at 1.}

^{9 https://www.barandbench.com/news/litigation/madras-high-Court-hearing-plea-alleging-misuse-of-voters-aadhaar-data-by-bjp-puducherry, "Should we postpone the elections?" Madras High Court while hearing plea alleging misuse of voters' Aadhaar data by BJP, Puducherry}

^{10 https://web.umang.gov.in/}

^{11 https://www.indiatoday.in/technology/news/story/umang-portal-flaw-may-have-exposed-aadhaar-linked-data-of-millions-govt-responds-2947356-2026-07-14}

^{12 https://www.indiatoday.in/technology/news/story/pm-kisan-website-found-leaking-aadhaar-data-of-over-110-million-indian-farmers-1962192-2022-06-14}

Read Part I of the article here -  https://www.mondaq.com/india/data-protection/1802076/the-legitimacy-of-data-driven-elections

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.