When you put the cart before the horse, you are unlikely to achieve much movement. When your horse bolts without being hitched to the cart, the purpose of having a horse is lost.

This is the story of the Unique Identification Authority of India’s (UIDAI’s) Aadhaar project, which has promised to give every Indian a unique identity by collecting everybody’s biometrics without any law to back it.

So when Nandan Nilekani, the former UIDAI chairman and now Congress candidate from Bangalore South, boasts that he has delivered 600 million Aadhaar numbers to Indian residents, the right response is: so what? While he claims that he has delivered what he promised, the reality is he has compromised the citizen’s privacyin the bargain. His speed has done damage. The 600 million Aadhaar number recipients have little legal protection now if the data falls into the wrong hands.

The Indian Express, in fact, tells us today (19 March) that the post-Nilekani UIDAI is now pleading with the Supreme Court to ban the use of Aadhaar data in criminal probes since that is not why the biometrics were collected in the first place. Shouldn’t this have been legislated in the first place instead of allowing the courts to take a call in this case or that?

So while Nilekani told The Telegraph the other day that “Aadhaar is absolutely a legal project” and that the lack of a law “is really about creating a regulatory body for Aadhaar, not about its existence,” the fact is he has now left those who have given their biometric data to UIDAI at the mercy of the law enforcing authorities and the courts.

The UIDAI has recently petitioned the Supreme Court to reject a Central Bureau of Investigation (CBI) request for UIDAI data to identify likely culprits in a Goa rape case, which has been upheld by a local court. The Bombay High Court has asked the Central Forensic Science Lab to check if Aadhaar database is usable for crime probes.

UIDAI says the high court’s order is wrong, as UIDAI is “for civilian use and for non-forensic purposes”. The lower Goa court had asked UIDAI for the biometrics of all Aadhaar holders in order to find finger-prints that match the rape perpetrators.

In short, without a law to protect the citizen’s privacy, the police and the courts can well set out on a fishing expedition to scour the biometrics of the entire population and compromise our rights.

The UIDAI petition is scary in showing just how the Aadhaar scheme has compromised us. The Express report quotes its statement to the apex court as indicating that though there was only a 0.057 percent chance of false identification, when the whole database of 60 crore people is matched, it could result in hundreds of false identifications.

The petition noted:  “This means any such random search, which was now being demanded by Respondent No1 (CBI), even if implemented in the current system, would put lakhs of innocent people under the scanner.” It added: “Building a system that can search using latent fingerprints, quite like criminal database searches, is not within the constitutional and legal mandate and scope of UIDAI and fundamentally against the core reason residents have provided their data voluntarily to UIDAI.”

A three-judge Supreme Court bench, with Justices BS Chauhan, J Chelameswar and MY Eqbal,  is separately hearing a public interest litigation (PIL) filed by several anti-Aadhaar groups claiming that the scheme violates basic rights and raises serious privacy concerns.

The Economic Times quotes senior advocate Shyam Divan, one of the prime movers of the PIL, as telling the court: “The project is arbitrary and illegal as it allows private dominion over biometrics without governmental control, thereby compromising personal security and national security.”

The UIDAI’s petition in the Goa rape case shows that it at least partially now agrees with this view – though for different reasons.

Unwittingly, Nilekani has given a powerful weapon in the hands of the state without waiting for legislative safeguards. By putting the card issuing horse before the legal horse, he has done the cause of personal freedom and privacy an injustice.