Keep learner, research, and institutional files governable

Section 9 of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary, before processing any personal data of a child or of a person with disability who has a lawful guardian, to obtain verifiable consent of the parent or lawful guardian in such manner as may be prescribed. Sub-section (2) provides that a Data Fiduciary shall not undertake processing that is likely to cause any detrimental effect on the well-being of a child, and sub-section (3) provides that a Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. Entry 3 of the Schedule provides a penalty that may extend to two hundred crore rupees for breach of the additional obligations in relation to children under Section 9.

Section 8(5) of the same Act requires a Data Fiduciary to protect personal data in its possession or under its control, including in respect of any processing undertaken on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. Section 8(6) requires intimation of a personal data breach to the Board and to each affected Data Principal. Entry 1 of the Schedule provides a penalty that may extend to two hundred and fifty crore rupees for breach of the safeguards duty, and Entry 2 a penalty that may extend to two hundred crore rupees for breach of the notification duty. Learner, guardian, faculty, and applicant records sit inside those obligations.

Section 8(7) of the same Act provides that a Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force, erase personal data upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and cause its Data Processor to erase any personal data made available for processing. Cohorts, applications, and closed programmes are exactly where education estates accumulate personal data past the purpose that justified it.

The Ministry of Education's advisory of 23 December 2021, issued after the Department of School Education and Literacy noted practices by some ed-tech companies, tells parents and students to read the terms and conditions before acknowledging acceptance of learning software or a device, because an IP address or personal data may be tracked; to avoid adding data such as emails, contact numbers, card details and addresses online, as the data may be sold or used for later scam attacks; and not to share any personal videos and photos, using caution before turning on the video feature or joining video calls on an unverified platform. It is guidance to citizens rather than a rule imposed on institutions.

The Automated Permanent Academic Account Registry, published by the Ministry of Education, describes the APAAR ID as a lifelong academic identity assigned as a unique and permanent 12-digit ID to every student, consolidating degrees, scholarships, awards, and other credits. Its published process records that schools provide a provisional APAAR, that parental consent is required in the case of a minor, and that the ID is added to DigiLocker on successful verification. Institutions that feed and consume those records still hold the underlying documents in their own systems.

Section 3 of the Public Examinations (Prevention of Unfair Means) Act, 2024, published in the Gazette of India as Act No. 1 of 2024 after receiving the assent of the President on 12 February 2024, provides that unfair means relating to the conduct of a public examination include, for monetary or wrongful gain, leakage of question paper or answer key or part thereof, participating in collusion with others to effect such leakage, accessing or taking possession of a question paper or an Optical Mark Recognition response sheet without authority, tampering with any document necessary for short-listing candidates or finalising merit or rank, and tampering with the computer network or a computer resource or a computer system.

Section 5(2) of the same Act provides that no person authorised, engaged or entrusted with the duties to conduct a public examination shall, before the time fixed for opening and distribution of question papers, open, leak, possess, access, solve or seek assistance to solve such question paper or any portion or copy thereof in an unauthorised manner for monetary or wrongful gain, or give confidential information related to it. Section 9 makes all offences under the Act cognizable, non-bailable and non-compoundable. Section 10(2) provides that a service provider shall also be liable to a fine up to one crore rupees, that proportionate cost of examination shall be recovered from it, and that it shall be barred from being assigned responsibility for the conduct of any public examination for four years.

In its judgment of 2 August 2024 in Vanshika Yadav v. Union of India, reported as 2024 INSC 568, the Supreme Court of India set out the chain of custody described by the National Testing Agency for NEET (UG) 2024 and directed a committee of experts to review and suggest enhancements for the processes for the setting, printing, transportation, storage, and handling of question papers, which may include tamper-evident packaging and using secure logistics providers to prevent unauthorised access and leaks during critical phases. Under the heading of data security and technological enhancements, the Court recorded that the committee should research and suggest advanced data security protocols, including encryption and secure data transmission methods, and recommend systems to monitor and track digital footprints related to examination materials, which might include digital watermarking and tracking technologies to trace the origin of leaked documents.

The University Grants Commission (Promotion of Academic Integrity and Prevention of Plagiarism in Higher Educational Institutions) Regulations, 2018, notified on 23 July 2018 and published in the Gazette of India, apply to students, faculty, researchers and staff of all higher educational institutions in the country. Regulation 6 requires each institution to develop and publish a plagiarism policy, to submit to INFLIBNET soft copies of all Masters and research programme dissertations and theses within a month after the award of degrees for hosting in the digital repository under the Shodh Ganga e-repository, and to create an institutional repository on the institute website including dissertations, theses, papers, publications and other in-house publications.

The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate, and Government organisations to report the cyber incidents listed in Annexure I within six hours of noticing them or being brought to notice about them. Annexure I expressly includes unauthorised access of IT systems or data, data breach, and data leak, which is the category a compromised student information system, examination repository, or research share falls into.

Article 32 of Regulation (EU) 2016/679 requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and names pseudonymisation and encryption of personal data among them. Article 83(4) places infringements of Article 32 in the tier of administrative fines up to 10 million euro, or up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. This reaches an Indian institution or platform through European exchange students, staff, alumni, and research partners.

Article 8(1) of the same Regulation provides that where information society services are offered directly to a child, processing based on consent is lawful where the child is at least 16 years old, and that where the child is below that age such processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility, with Member States able to provide by law for a lower age not below 13 years. Article 8(2) requires the controller to make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility, taking into consideration available technology. Learning platforms offered to school-age users in Europe sit inside that provision.

Section 99.33(a) of Title 34 of the Code of Federal Regulations, the FERPA regulations, provides that an educational agency or institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student, and that the officers, employees, and agents of a receiving party may use the information but only for the purposes for which the disclosure was made. Section 99.33(d) requires the institution to inform a party to whom disclosure is made of that requirement. This reaches Indian institutions and platforms through United States campuses, exchange programmes, and district customers rather than directly.

Section 312.8 of Title 16 of the Code of Federal Regulations, the COPPA Rule, requires an operator to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children, to maintain a written information security program, and, before allowing other operators, service providers, or third parties to collect or maintain children's personal information on its behalf, to take reasonable steps to determine that those entities are capable of maintaining confidentiality, security, and integrity, and to obtain written assurances to that effect. Section 312.10 provides that such information may not be retained indefinitely and requires a written data retention policy setting a timeframe for deletion.

The Information Commissioner's Office's Age Appropriate Design Code, a statutory code of practice for online services likely to be accessed by children, is described by the Commissioner as a set of 15 flexible standards under which settings must be high privacy by default unless there is a compelling reason not to, only the minimum amount of personal data should be collected and retained, children's data should not usually be shared, and geolocation services should be switched off by default. Standards 8 and 9 address data minimisation and data sharing. Indian platforms encounter the code through United Kingdom learners rather than directly.