During the budget presentation on 29 February 2016, Finance Minister Arun Jaitley announced that a bill will be introduced within a week which will provide legislative support to the Aadhaar. On 3 March 2016, the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Bill, 2016 was introduced in the Parliament as a money bill by Jaitley as it fulfilled Article 110's provisos - 110(1)(c), 110(1)(d) and 110(1)(e) of the Constitution of India. The decision to introduce it as a money bill was criticised by the opposition parties. Ghulam Nabi Azad, an INC leader, wrote in a letter to the Jaitley that the ruling party BJP was trying to bypass the Rajya Sabha, as they did not have the majority in the upper house. A money bill is only required to pass in the lower house Lok Sabha. Jyotiraditya Scindia of INC asked why a new bill was introduced when the National Identification Authority of India Bill, 2010 was still pending in the Rajya Sabha.
The bill was passed on the 11 March 2016 by the Lok Sabha by a voice vote after a brief debate. Tathagata Satpathy of Biju Janata Dal (BJD) had raised concerns that the project could be used for mass surveillance or ethnic cleansing in the future. He also raised questions about why a new identity card project was created despite having several identity card systems. He also questioned why the bill was introduced as a money bill. He also said that although the bill allows the sharing of biometric under the circumstances of national security, no concrete definition of national security was included.
Bhartruhari Mahtab of BJD requested that the bill should not be rushed and referred to a parliamentary panel. Mallikarjun Kharge of INC said that they supported the bill but wanted some suggestions to be discussed. Rajeev Satav of INC reminded the house that initially the ruling-party BJP had opposed the Aadhaar during the reign of United Progressive Alliance (UPA), before turning around and supporting it. During the debate, Finance Minister Arun Jaitley assured the house that the Aadhaar project will not be misused. Jaitley stated that 97% of the adult and 67% of children had already been registered under the project. He also said that the definition of national security is up to the courts to define.
On 15 March 2016, Shumsher K. Sheriff, Secretary of the Rajya Sabha, formally notified the house that the bill has been passed in the Lok Sabha. During the debate spanning over two days, Naresh Agrawal of Samajwadi Party (SP) said that the bill doesn't fit into the definition of a money bill. P. J. Kurien, Deputy Chairman of Rajya Sabha, said that it was the decision of Lok Sabha Chairperson Sumitra Mahajan to allow the bill, so it should not be questioned. Sitaram Yechury of Communist Party of India (Marxist) (CPI-M) argued that the bill was unconstitutional as the Constitution guarantees the freedom of life and liberty and privacy comes under it. Jaitley responded to Yechury by saying that privacy is not an absolute right and it can be restricted by the law. Jairam Ramesh of INC said Aadhaar should be limited to subsidies only and not made mandatory for any purpose.
On 16 March 2016, the bill was returned to the Lok Sabha by the Rajya Sabha with some suggested amendments. The Lok Sabha was free to accept or reject the amendments. But, Lok Sabha rejected the amendments and passed the bill.
Most of the provisions of the Bill have been borrowed from the previous National Identification Authority of India Bill, 2010. The major difference is that the three-member committee called the Identity Review Committee of the previous bill was removed in the new bill.
The Clause 2 (g) defines "biometric information" as photograph, finger print, iris scan, or "other such biological attributes" of an individual. The Clause 2 (k) defines "demographic information" as name, date of birth, address and "other relevant information" of an individual. It explicitly excludes race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. The Clause 2 (v) defines "resident" as an individual who has resided in India for a period or periods amounting in all to 182 days or more in the 12 months immediately preceding the date of application for enrolment.
The Clause 3 (1) states that every resident is entitled to obtain an Aadhaar number by submitting their biometric and demographic information. The central government may however in future require other categories of individuals to enrol by releasing a notification. According to Clause 3 (2), at the time of registration the enrolling agency must inform the resident about the manner in which the data will be used, with whom it will be shared and procedure of access. The UIDAI will issue an Aadhaar number to the resident after verifying the data. According to Clause 4, it should be unique and random. The Clause 6 states that the UIDAI may require Aadhaar number holders to submit additional biometric and demographic information, or update the information in the future.
The Clause 7 states that the central or state government may require a person to possess an Aadhaar number if he/she is receiving some subsidy. If he/she is does not possess an Aadhaar number, they will be required to apply for other, in meantime the government will provide them the subsidy using an alternate mean of identification. According to Clause 8, UIDAI may perform verification of Aadhaar for other private and public agencies on request in exchange for a fee. The requesting must obtain the consent of the Aadhaar holder for verification, and inform him/her of nature of the information that will be shared upon verification. The Clause 8 (4) states that UIDAI may share identity information, but it cannot share the biometric information. The Clause 9 states that Aadhaar is not a proof of citizenship or domicile.
The Chapter IV details the functions and powers of the UIDAI. The Clause 23 (2) states that the UIDAI has the power to specify the demographic and biometric information that must be collected for registration. It can issue Aadhaar numbers to residents and perform verifications. It can also specify the subsidies and services for which Aadhaar will be required.
The Clause 12 states that the UIDAI will consist of a chairperson, two part-time members and a chief executive officer. The Clause 13 states the chairperson and members must have experience and knowledge of at least 10 years in matters relating to technology, governance, law, development, economics, finance, management, public affairs or administration.
The Clause 25 states that any fees collected and revenue generated by the UIDAI will be deposited in the Consolidated Fund of India. The Clause 27 (2) states that the UIDAI must submit an annual report to the central government detailing its activities of the past year, revenues and expenditures of the past year, and plans for the upcoming year.
The Clause 28 (1) states that the UIDAI must ensure the security of identity information and authentication records. The authentication records has been as "record of the time of authentication and identity of the requesting entity and the response provided" in Clause 2 (d). The Clause 32 states that the UIDAI must maintain the authentication records for the specified period. The Aadhaar number holder may access his authentication records subject to regulation. The UIDAI is not required to maintain the record of the purpose of authentication.
The Clause 33 (1) states that a District Judge or higher court may force the UIDAI to reveal a person's identity information, i.e. Aadhaar number, photograph and demographic information, and authentication records, but not the core biometric information. The Clause 33 (2) states that an official with the rank of Joint Secretary or higher may access a person's identity information including core biometric information, if the official has an order issued in the interest of national security by the central government.
The Clause 34 states that providing false information in an attempt to impersonate carries a maximum penalty of 3 years in prison and/or a fine of ₹10,000. The Clause 38 states that unauthorised access to the Central Identities Data Repository, causing damaging to it or leaking the information stored on it carries a maximum penalty of 3 years in prison and/or a minimum fine or ₹100,000. The Clause 47 states that the complaints under this law must be tried under a Chief Metropolitan Magistrate or a Chief Judicial Magistrate, or a higher court. No court can recognise a complaint under this law unless filed by the UIDAI or a person authorised by it.
The Clause 48 states that the central government may supersede the UIDAI for a period of up to 6 months, if it fails to performs its duties or due to a public emergency. The Clause 57 states that state or private agencies may use Aadhaar for verifying the identity of a person for any purpose.
Nandan Nilekani, the former chairman of UIDAI, welcomed the bill. He used Clarke's third law to describe the project. He also said that this technology will allow India to develop into a modern welfare state. He argued that this technology will give Indian residents a secure digital ID to access the internet and prevent "digital colonization" by foreign firms. He also this will check wastage of public funds, corruption, fake degrees and improve matching of jobs to employees in the labour market.
Jean Drèze, development economist, said that the bill was designed to evade Supreme Court orders restricting the usage of Aadhaar. He also said that bill was presented as a money bill to prevent debate. He argued that despite declaring it voluntary the government had created practical compulsions for enrolment, and an intervention of the Supreme Court was need to end the "doublespeak".