India Has Been Collecting Eye Scans and Fingerprint Records From Every Citizen. Here’s What to Know

Wednesday marked a significant milestone for the world’s largest biometric ID system, India’s Aadhaar program.

When the program launched in 2009, India set out to achieve a world-first: giving every citizen a unique, biometrically-verifiable identification number. Those biometrics (iris scans and fingerprint records) would be linked to a person’s Aadhaar number, which would in turn be used in all interactions with the state—weeding out fraud, making taxation more efficient, and ultimately saving money, the government said.

Countries around the world looked on to see if it would work. Today, 1.2 billion Indians—including over 99% of the adult population—are enrolled.

But critics said that the scheme, while supposedly voluntary, had imposed itself increasingly onto citizens’ private lives. It became near impossible in India to buy a cellphone contract or open a bank account, for example, without providing an Aadhaar number.

On Wednesday, that began to change. India’s Supreme Court, in a landmark ruling, said that private companies could no longer require users to provide their Aadhaar details as a condition of service.

The same court also upheld the legality of the system as a whole, saying it does not violate Indians’ right to privacy and could therefore continue to operate. “Aadhaar gives dignity to the marginalized,” the judges on the Court’s bench said. “Dignity to the marginalized outweighs privacy.”

Here’s what to know about the Aadhaar system.

What is Aadhaar?

Aadhaar, which means ‘foundation’ in Hindi, centers around a 12-digit identity number, linked to fingerprints and iris scans. Each user receives a card with that number on it, which can be cross-referenced with the biometric data held in a database.

An Aadhaar card is not a proof of citizenship—but citizens are required to provide it to receive welfare payments and social services.

The idea behind Aadhaar was to create a centralized system for the whole of India reliant on one form of recognizable ID, rather than the old, decentralized system of birth certificates and ration cards which were vulnerable to loss and damage, and which left marginalized people—particularly the rural poor—struggling to obtain state services

Increasingly, private companies began using Aadhaar numbers to quickly and cheaply ‘onboard’ new customers. In other words, instead of going through the lengthy and expensive process of logging people’s identities and then having to verify their accuracy, banks, e-wallet providers and insurance companies could just compare a customer’s Aadhaar card to the readings from a fingerprint machine, and sign people up for services that might have been prohibitively expensive before.

“The project was initially seen as a cost-effective and ‘modern’ way of bringing an enormous and often poorly documented population into a single database,” says Professor Edward Simpson, the director of the South Asia Institute at London’s School of Oriental and African Studies.

Does it work?

Broadly, yes. The technology behind the system works for the majority of Indians. Aadhaar has so far saved the Indian government as much as $12.4 billion, according to an official from the Unique Identification Authority of India, which administers the program.

But it has also come in for criticism. “Teething problems, corruption, and the emergence of Aadhaar brokers have impeded the smooth implementation of the project,” says Simpson. Making an Aadhaar number compulsory to access government services was meant to remove complexity from the system, but for some it added extra barriers.

For example, there have been reports of migrant and rural children who never received birth certificates being disallowed from school enrolment because of not being able to prove their identity in order to sign up for an Aadhaar card. There have been other reports of leprosy sufferers with no fingers or eyes having their state benefits cancelled because fingerprints and iris scans are mandatory.

Further questions were raised by privacy advocates. In January, India’s Tribune newspaper announced that one of its reporters had managed to purchase personal information leaked from the Aadhaar database from a broker for just 500 rupees ($7).

And others have raised concerns that biometric information is a poor basis for an identity system. “Any compromise of such a database is essentially irreversible for a whole human lifetime,” writes the lawyer Mishi Choudhary for the BBC. “No one can change their genetic data or fingerprints in response to a leak.”

“On one hand, Aadhaar is seen as an intervention in everyday practices of corruption, a mechanism for the equitable and accurate distribution of social welfare,” Professor Simpson tells TIME. “At the same time, Aadhaar has been seen as a violation of privacy, an intrusion by the state into the private lives and affairs of citizens, and as a way of strengthening surveillance techniques.”

What did the Supreme Court say?

The Supreme Court said, effectively, that Aadhaar could continue to be used by the state, but that private companies could no longer use Aadhaar for easy ‘onboarding.’

“We have come to the conclusion that Aadhaar Act is a beneficial legislation which is aimed at empowering millions of people in this country,” the Court said. “At the same time, data protection and data safety is also to be ensured to avoid even the remote possibility of data profiling or data leakage.”

While that might look like a defeat for the government’s plan for a wide-ranging identification system, it could actually work to their advantage. As part of opening the Aadhaar database up to private companies, the government exposed over 1 billion Indian citizens’ data to innumerable outsiders. That openness, many suspected, was the cause of the damaging leaks from January.

“The decision is a victory for those who see Aadhaar as a form of intrusion or surveillance,” says Professor Simpson.

What did observers say?

Nandan Nilekani, who previously led the department responsible for Aadhaar, said the Supreme Court had made “a landmark judgement in favor” of the program. The decision, he said, “validated the founding principles of Aadhaar.”

Others were more critical. Sanjay Nirupam, a former lawmaker, criticized the ruling BJP, saying it should apologize to “those whose mobile and bank accounts have been forcefully and illegally linked with their Aadhaar under pressure.”

As with other Supreme Court-related disagreements, this debate is shaped by more than a hint of partisan politics. The Modi government sees Aadhaar as a way to to accelerate development and eradicate poverty. “Aadhaar has added great strength to India’s development,” Modi said in January. In May, Modi cited Aadhaar as an example of how the BJP is ahead of rival parties when it comes to technology. (Aadhaar was launched in 2009 by the Congress Party, the rival to Modi’s BJP that held power until 2014, but has been greatly expanded under the Modi government.)

Opponents of the ruling BJP, however, often point out that “development” is often used as an excuse to enrich the richest in society while—in the case of Aadhaar—forcing the majority into a system of surveillance and further marginalizing the minority who are excluded.

What does this mean for the rest of the world?

In some ways, this particular form of centralized identification system is unique to India, which has long struggled to ensure its massive and diverse population is treated equitably by the central state.

But other countries have flirted with the idea of similar systems as biometric technology has become cheaper and more widespread. Countries routinely integrate fingerprints and iris scans into passports, but none has tried as hard as India to make it the basis of citizen-state interaction. That might change in the future.

India’s ruling indicates that, for democracies at least, integrating state ID systems with the market is always likely to spark privacy and data security concerns—which in turn may lead ID systems to be curtailed by privacy laws. More authoritarian states like China, however, will not have to overcome such a barrier.

“The questions raised by the Aadhaar debate do not only belong to India,” says Professor Simpson. “They are global questions concerning identity, data and the rights of individuals, corporations and governments.”