A major problem with Aadhaar is how UIDAI has completely discounted the fact that Aadhaar will be used by people who have zero idea about technology/computers. "Most" of the scandals with Aadhaar has been social engineering to gain access or clueless government officials printing the data and putting it up publicly on their department websites.

99% of the cases I see is humans being completely inept at handling data - most of them probably don't even realize the implications of such a central repository of data.

Fortunately, UIDAI has made some improvements. You can lock your biometric authentication and every request to verify will fail until you unlock for 10-15 mins. They have implemented a virtual ID over Aadhaar which can be used for verification without handing over your original number - but here's the problem, institutions have no idea that these numbers are valid too!

I do believe that a system like Aadhaar is necessary for India BUT govt institutions like UIDAI cannot and should not declare their end of responsibilities at just the technical level (which UIDAI frequently does by claiming that data is housed in secure vaults and encrypted and blah blah). If you build a system which will be responsible for a billion lives, you are also responsible for teaching people safety and enforcing requirements which minimise, if not eliminate, social engineering.

At the end of the day, you are a government institution, not a company.