privacy india
What is the punishment for misusing Aadhar card details in India.?
<p>Some unknown person created an online account with my Aadhar card details and booked a room with that account.  I guess the person is the PG owner to whom I gave my Aadhar card to photocopy as proof of address.  Now he is misusing the address proof for creating fake accounts and booking rooms like this. What should I do now?</p>

<p>Chapter VII of <a href="https://uidai.gov.in/images/the_aadhaar_act_2016.pdf" rel="nofollow noreferrer">The Aadhaar Act of 2016</a> specifies the punishments. Section 40 may be applicable:</p>

<blockquote>
  <p>Whoever, being a requesting entity, uses the identity information of
  an individual in  contravention  of  sub-section  (3)  of  section  8,
  shall  be  punishable  with  imprisonment which may extend to three
  years or with a fine which may extend to ten thousand rupees or, in
  the case of a company, with a fine which may extend to one lakh
  (100,000) rupees or with both.</p>
</blockquote>

<p>and sect. 41 similarly penalizes violation of 8(2) with a lesser prison term of 1 year.</p>

<p>From the definitions in section (2),</p>

<blockquote>
  <p>“requesting  entity”  means  an  agency  or  person  that  submits 
  the  Aadhaar number, and demographic information or biometric
  information, of an individual to the Central Identities Data
  Repository for authentication</p>
</blockquote>

<p>Sect. 8(2) requires that </p>

<blockquote>
  <p>A requesting entity shall—(a) unless otherwise provided in this Act,
  obtain the consent of an individual before collecting his identity
  information for the purposes of authentication in such manner as may
  be specified by regulations; and (b)  ensure  that  the  identity 
  information  of  an  individual  is  only  used  for submission to the
  Central Identities Data Repository for authentication.</p>
</blockquote>

<p>and 8(3) requires that</p>

<blockquote>
  <p>A requesting entity shall inform, in such manner as may be specified
  by regulations, the individual submitting his identity information for
  authentication, the following details with respect to authentication,
  namely:— (a) the nature of information that may be shared upon
  authentication; (b) the uses to which the information received during
  authentication may be put by the requesting entity; and (c)
  alternatives to submission of identity information to the requesting
  entity.</p>
</blockquote>

<p>Note that a "requesting entity" is technically one who submits card data to CIDR for authentication, and there is no guarantee that the suspected copier did so. 
There do not seem to be any general restrictions on civilian use of the card, for example there seems to be no law prohibiting a person from requesting a copy of the card and not actually submitting the information to CIDR.</p>

<p>You are entitled to know about authentication requests, if any were made:</p>

<blockquote>
  <ol start="32">
  <li>(1) The Authority shall maintain authentication records in such manner and for such period as may be specified by regulations. (2)
  Every Aadhaar number holder shall be entitled to obtain his
  authentication record in such manner as may be specified by
  regulations.</li>
  </ol>
</blockquote>

<p>You can apparently do this online via UIDAI's Aadhaar Authentication History (they send you an SMS, you can log on). I do not know if filing a police complaint would be effective. I take it that businesses are using the card informally as identification without the step of authentication.</p>
