A woman has her fingerprints read during the registration process for Aadhaar cards in Amritsar, India, in July. (Narinder Nanu/AFP/Getty Images)

India’s Supreme Court on Wednesday upheld the validity of a giant and controversial government program to collect and store the biometric data of its billion-plus citizens but placed new limits on how the data can be used and stored.

A five-judge panel ruled 4 to 1 that while the government’s flagship Aadhaar program has huge benefits in delivering welfare efficiently, biometric data can no longer be used by private entities such as banks or cellphone operators for authentication purposes, curbing the program’s ambitious scope as a universal ID.

“Aadhaar empowers the marginalized section of the society and gives them an identity,” Justice Arjan Kumar Sikri said in delivering the 1,448-page verdict.

The judgment also noted, however, that “there needs to be balancing of two competing fundamental rights, right to privacy on one hand, and right to food, shelter, and employment on the other hand.”

Aadhaar — meaning “foundation” in Hindi — provides each citizen with a unique 12-digit number, linked to their iris scans and fingerprints. Started in 2009 under India’s previous administration and expanded by Prime Minister Narendra Modi, the Aadhaar program was hailed by the government as a tool to bring India into the digital age and help restructure its tax and welfare system as part of the “Digital India” program.

The government’s original idea was to be able to easily identify people fraudulently claiming government benefits, such as food or fuel rations.

But over the years, it has morphed from a welfare delivery tool to a near-necessity for everyday life in India. Citizens have been asked for their Aadhaar cards to access a host of government and private services, including new bank accounts, school enrollments and airline reservations. 

The Supreme Court’s order will restrict the program’s usage to government services only — Aadhaar will be necessary for collecting food rations or fuel subsidies but no longer for opening a bank account or getting a new cellphone SIM card. Children, upon reaching adulthood, can now opt out of the program, should they no longer need welfare services from the state, the court said. 

“The majority has upheld the goal of Aadhaar and said that it pursues a legitimate state aim,” said Zoheb Hossain, a government lawyer. He added that the state could still pass legislation to allow private organizations to use Aadhaar. 

Prasanna S., a lawyer representing petitioners, said the court delivered a “body blow” to the “vision of the Aadhaar project as a universal and ubiquitous ID.” The order “effectively makes Aadhaar voluntary, not mandatory,” he said.

Over the past decade, more than a billion citizens were enrolled in the government’s database. To reach the remote corners of the country, officials went to tribal villages, setting up pop-up registration centers at schools or going door to door to enter records of more than 2 billion Indian eyeballs and 10 billion fingerprints into a government database. Records of citizens’ bank accounts, addresses, income tax filings and other digital data were compiled and linked. 

But the program’s flaws were evident. Critics say that some of India’s neediest were denied their food rations and other welfare entitlements because of authentication errors or Internet connectivity problems.

Media outlets and online activists also reported vulnerabilities in the technology and the way in which the data is collected — a report by the Center for Internet and Society said government websites may have accidentally leaked details of 135 million citizens.

India’s Tribune newspaper reported that private operators contracted to enroll people offered to sell access to the database for $11, and HuffPost reported that hackers were using a patch to disable security features of the enrollment software and could easily create fraudulent identities.

In 2012, a retired high court judge from the southern Indian city of Bangalore filed the first petition against the program to the Supreme Court, saying that Aadhaar had no statutory basis and violated the right to privacy. 

K.S. Puttaswamy, now 92, was worried that the program could be abused by illegal immigrants from neighboring countries, who might have used their biometric ID cards to claim citizenship.

As the government’s program expanded, the retired judge’s petition swelled into a movement centered on privacy, security and denials of welfare entitlements due to authentication problems. More than two dozen petitioners raised problems with Aadhaar, including a retired army general and the scientist who helped create eLocutor — Stephen Hawking’s single-button electronic voice machine. 

They said that Aadhaar was a dangerous “Big Brother” program and could be used to keep tabs on how citizens spend money, where they travel and whom they call. “As the Snowden revelations show, if the state has the power, there is always a temptation,” said Nachiket Udupa, one of the petitioners, referring to former National Security Agency contractor Edward Snowden, who leaked details of the U.S. government’s electronic surveillance programs. 

Government lawyers disputed claims that privacy was at stake, saying that the data was kept in “silos” — so a bank would never know if someone had claimed monthly rations or filed taxes.

The lawyers filed reports demonstrating how fraud — double-dipping, ghost beneficiaries and counterfeit identities — added enormous strain to the country’s stretched welfare system. Trillions of rupees were allocated by the government for the welfare program, and more than half the money never reached beneficiaries, Attorney General K.K. Venugopal said.

This was the heart of the quandary facing the five-judge panel: the state’s duty to provide welfare services to India’s huge population so it can have a dignified existence versus citizens’ right to privacy. 

Though the program will continue, Apar Gupta, a lawyer for the petitioners, said the verdict was an “incremental victory” for privacy activists. “The court only commented on constitutionality, but during this hearing, the public policy benefits of Aadhaar have also been called into question.”