The Unique Identification Authority of India (UIDAI) on Wednesday put in place a two-layer security mechanism to reinforce privacy protection for Aadhaar ID number holders.

It introduced a virtual identification for the ID holders so that the actual Aadhaar number need not be shared to authenticate identity. It also places more restrictions on the storage of the Aadhaar number within various databases.

UIDAI has been under the scanner over the past few months over allegations of access of personal information by random entities without the consent of individual Aadhaar holders.

The virtual ID will be a 16-digit random number mapped with the Aadhaar number. It can only be generated, replaced or revoked by the Aadhaar number holder from time to time.

“It will not be possible to derive the Aadhaar number from the virtual ID,” a circular issued by UIDAI said.

Till now, a person had to give his/her 12-digit identity number along with other attributes (demographic and/or biometrics and/or through a one-time password) during authentication or e-KYC (know your customer) for accessing various benefits and services from service providers such as banks or telcos.

UIDAI also introduced the concept of a limited KYC category which does not access the Aadhaar number. To enable this, UIDAI has introduced two categories of an Authentication User Agency (AUA) an entity engaged in providing Aadhaar-enabled services.

The limited KYC category is a ‘Local AUA’, compared with a ‘Global AUA’ which will have access to e-KYC using the Aadhaar number.

An AUA may be a government, public or a private legal agency registered in India, using Aadhaar authentication services provided by UIDAI.

The idea behind the changes is to address privacy concerns which have resulted not only due to legal challenge to Aadhaar in the Supreme Court, and to also prevent potential misuse of an individual’s Aadhaar details after Tribune News Service exposed available of Aadhar accounts for Rs 500