Data privacy in school system

 Adherence to the principles of data privacy and data minimisation is particularly pertinent given the sensitive nature of children’s personal data

The Indian school education system 

1 is one of the most expansive ecosystems in the world. 

2 Composed of approximately 15 lakh schools, 97 lakh teachers, and nearly 26.5 crore students enrolled from the pre-primary to higher secondary levels.

 3 it boasts of stakeholders from varied socioeconomic backgrounds.

Collecting information

UDISE+ platform in 2018

1 To realise its objective of managing the wide-ranging education system in India in a sound manner, the Ministry of Education conceived of the UDISE+ platform in 2018. 

2 The UDISE+ plays a crucial role in collecting and exchanging real-time information on 

• school infrastructure, 
• teachers, 
• student enrolment, 
• and academic performance. 

3 This allows the Ministry to curate outcome-based policies to enhance the quality of education in India.

4  Mapping educational trend 

By improving the process of resource allocation and the monitoring of educational programmes, UDISE+ is also notably utilised to map educational trends. 

5 Administration and service delivery 

The objective of strengthening administration and optimising service delivery is charted out as the ultimate goal of this exercise.

Automated Permanent Academic Account Registry identification (APAAR)

1 In terms of the National Education Policy 2020, the Ministry also introduced the Automated Permanent Academic Account Registry identification (APAAR).

2  This serves as a unique identifier of a given student. 

This facilitates the collation of academic credentials of students at one place. 

The demographic information per user so collected includes Aadhaar information, obtained vide a voluntary consent-based mechanism.

APAAR and UDISE+. What we are seeing 

Measures are being introduced to enhance ease of schooling, which necessitate linking of APAAR and UDISE+. 

Steps to automate student admissions, in turn, to reduce dropout rates during the transitional phases and enhance opportunities for continuing education, fall within the umbrella of such ease of schooling measures.

Entities such as DigiLocker and ed-tech companies 

1 they Are frequently collaborate with State governments. 

2 Interlinking of UDISE+ and APAAR, in the manner explained above, exposes student data amassed to such actors in the educational ecosystem. 

Data sharing policy by gov 

1 The Education Ministry commendably formulated a data-sharing policy for school education and literacy in 2020. 

2 However, this is yet to be updated to reflect the regulatory overhauls post the enactment of the Digital Personal Data Protection (DPDP) Act, 2023. 

3 In the absence of clear regulations or minimum standards (importantly, for ed-tech players), their compliance with the Act comes under question.

non-compliance example in data sharing

 1 For instance, there is limited guidance on what constitutes verifiable parental consent. Consent from parents for minors’ data, sought under the UDISE+/APAAR regime, may violate this requirement. 

2 DPDP Act 

emphasises the importance of collecting personal data for specified legitimate purposes only. 

Sharing children’s data under UDISE+ for a purpose incremental to the authorised one could violate this statutory requirement. 

3 Benefits for gov in data sharing 

The Ministry acknowledged the benefits of sharing student data at a national scale — for instance, to track intra- and/or inter-State student migration. 

4 voluntary based consent is not good 

DPDP Act sanctions a specific and voluntary consent-based mechanism. The specific and voluntary nature of consent required (for purposes like the above) is clinching.

The three-part test

Right to privacy as a fundamental rights -

The Supreme Court recognised the right to privacy as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India (2018) and laid down the three-part test against which state action must be adjudged. 

Aadhaar integration in APAAR/UDISE+ must comply with these three prongs

(i) there exists a legitimate state interest in restricting the right; 

(ii) such restriction is necessary and proportionate to achieve the interest; and

 (iii) the restriction is imposed/effected by law. 

The need for specific protocols

liability affixation standpoint 

Regarding exchange of personal data of children for an unspecified purpose, integration of third parties (such as entities like DigiLocker, etc.) could also raise doubts on the role thereof.

 Identification of actors who qualify as data fiduciary, data processor, and data principal, would be required from a liability affixation standpoint

unmentioned purpose may require specific protocols, which are absent

 

This is a complex task and is presently not being undertaken. Although the privacy policy for APAAR dictates certain data security, aggregation, third party integration, retention requirements, sharing of personal data of children for an unmentioned purpose may require specific protocols, which are absent.

absence of any legal liability of the Ministry 

both the data policy and the annual report emphasise on the absence of any legal liability of the Ministry in respect of disclosure/accuracy of the data shared onto UDISE+.

grievance officer

However, there is no clarity on the manner in which the legal liability is affixed or practically incurred.

 This exhibits a blatant lack of a grievance redressal forum and mechanism for the data principals whose personal data is collected and exchanged under APAAR.

way forward 

अंतर-संचालन, सहमति और शिकायत निवारण के बारे में प्रश्न बहुत हैं। व्यापक शासन ढांचे के तहत तकनीकी और कानूनी दोनों तरह की मानक संचालन प्रक्रियाएं एक अहम प्राथमिकता हैं। 

ऐसे प्रोटोकॉल डेटा की प्रामाणिकता के संरक्षण और संबंधित हितधारकों के लिए कानूनी दायित्वों के निर्धारण में सुविधा प्रदान करेंगे। 

आशा है कि इससे बच्चों के व्यक्तिगत डेटा को कानूनी और सुरक्षित तरीके से साझा करने, उपयोग करने और बनाए रखने के प्रति कार्यकर्ताओं में कर्तव्यनिष्ठ भावना विकसित करने में भी मदद मिलेगी।

Source the hindu