Grades to Gains

A privacy-based analysis of GoI's APAAR initiative

Back at Ashoka, during my Digitalization and Privacy course, I was asked to critically analyze a ‘Digital Public’ good. Somehow, most of my peers were inclined towards either healthcare or finance and payments while I was attracted towards education. I had always been exposed to the education sector (mostly the instructions aspect) through my mother. So, I started reading articles about how the global education sector is slowly converting into the EdTech (education-technology) sector with the constant incorporation of digital goods.

So, I got digging. That’s when I came across APAAR: a parallel to Aadhar which was aiming to streamline transfer and access to higher educational sector in the country. Why was this important? Well, our education sector has three sections primarily: elementary, secondary and higher education; the lowest rate of enrolment is recorded in higher education, and this was one way to tackle it. Sounds like a solid idea, right?

But just like Aadhar, APAAR would face scrutiny based on similar guidelines. So, why not unpack that?

However, before we unpack, let us understand why was there a need for a robust system like APAAR. One was to monitor dropout and enrolment rates. Second, was a rise of ‘farzi’ and ‘chor-bazar’ graduates among scholars. Verification was a tedious process that required you to visit multiple offices and have connections within the documents’ issuers. Third, was the evident communication gap between public and private educational institutions, where transfer of academic credits is often impossible and students have to repeat courses or do entire programmes again.

Like how we solved a problem of duplicate IDs and verified a majority of the citizens with the introduction of Aadhaar in 2012, we came up with another system of organizing important documents using DigiLocker in 2015. Although, DigiLocker only solved the storage problem for educational documents, it only helped in streamlining the verification problem, and the problem of cross-entity transfers still existed.

How can we streamline this as well? So, we came up with another system called APAAR and ABC, where the APAAR ID would serve as sufficient proof of academic achievements. 

What exactly is APAAR?

Automated Permanent Academic Account Registry (APAAR) is a specialized identification system designed for all students in India, introduced under the National Education Policy (NEP), 2020. It aims to provide a unique 12-digit identification number called the Academic Bank of Credits (ABC) ID to students. ABC is an actual bank of credits (well, academic credits). It is a digital storehouse that contains information about the credits earned by individual students throughout their learning journey. It acts as a reference point for faculty to check students’ credit records, promoting student-centric education and learner-friendly teaching. These academic credits would include everything from degrees and diplomas to training details as well as co-curricular accomplishments. These credits earned are valid for up to seven years, offering students flexibility in choosing courses and institutions. 

When will it be implemented?

Unlike Aadhaar, the timeline for the implementation of this system in India has not been officially announced by the GoI since it is a voluntary system. However, it is expected to be rolled out in this term (hopefully!). Certain states such as Madhya Pradesh and Andhra Pradesh are expecting to enroll all their student population on APAAR and ABC by 2025. 

[Update (on 29-08-2024): Government announced its complete rollout by 2026-27 with all students to be onboarded by this year]

Who will make it work?

So, every system requires some stakeholders to contribute to its successful implementation.

Here, we have:

1. Students: Students are beneficiaries who obtain a lifelong digital record of academic achievements through their unique APAAR ID.

2. Educational Institutions: Educational institutions including, but not limited to, universities, schools and upskilling institutions, maintain the integrity of students’ credits within the ABC.

3. Government: The GoI, particularly the Ministry of Education (MoE), oversees APAAR’s conceptualization and implementation. Common Service Centres (CSCs) facilitate registration, especially in rural areas while the National Academic Depository (NAD) manages certificate issuance and award records.

4. AICTE: The All India Council for Technical Education (AICTE) ensures smooth operation, emphasizing the future’s reliance on digital certificates. All these stakeholders come together to ensure the smooth functioning of the APAAR system. 

So, the State or GoI is heavily involved in the implementation of APAAR. There is also integration with other governmental initiatives like the National Skills Qualification Framework (NSQF) which amplifies its utility, offering students access to related services and benefits. The cross-integration of APAAR would allow for smoother and faster execution.

APAAR and ABC have standard Privacy Policies and Terms of Use.

Disclaimer: If you understand general privacy policy and terms of use, you can skip this section and move to the section ‘What about my privacy then?’

Apart from gathering consent from any individual who wishes to use the platforms and create an account, ABC also gathers consent from Higher Education Institutions (HEI). By providing consent and using the platforms, users agree to the collection, processing and storage of their personal information and academic data as detailed in their privacy policies. This includes account information, educational records, technical information about the user’s device and internet connection, and any other relevant data required for their services.

Users essentially consent to APAAR handling their data in accordance with the stated privacy practices and terms of use. This includes personal information provided during the registration process, such as demographics, contact details, authentication credentials and any educational records or academic achievements shared by the user or authorized educational institutions.

Both collect data directly from the users during the account registration and authentication process, including their Aadhaar number. In addition, ABC requires someone to be a nodal person and uses their personal Aadhar for registration.

APAAR may retrieve academic data from integrated platforms like DigiLocker and the ABC as well as from authorized educational institutions that share the user’s credentials and achievements. The data collected can be accessed by authorized ABC personnel and integrated platforms like APAAR and DigiLocker, who may have access to the data for facilitating credit verification, accumulation, transfer, redemption and degree authentication services.

The privacy policy states that access is restricted, and APAAR employs industry-standard security measures, including encryption, to protect user data from unauthorized access or disclosure. The explicitly mentioned purposes for processing user data on the platforms include:

1. account management (creating, maintaining and providing access to user accounts)

2. communication with users regarding important updates and notifications

3. facilitating the storage and retrieval of academic records, integration with platforms like DigiLocker and ABC for academic verification, credit accumulation and degree authentication

4. research or statistical analysis using anonymized and aggregated data for enhancing educational services

However, it also allows third-party organizations to use this data in a confidential manner for aiding the State to formulate welfare schemes. 

What about my privacy then?

In India, the Right to Privacy has been guaranteed under Article 21 of Part III of the Indian Constitution. In order to formalize this, the Digital Personal Data Protection (DPDP) Act, 2023 was passed in the parliament.

DPDP is mentioned in the terms of use and privacy policy of ABC and APAAR. However, there are a few provisions in the DPDP Act, 2023 that could potentially be exploited while processing the collected data.

1. It provides broad exemptions for government agencies from consent and other requirements for data processing in the interests of security, integrity, public order, etc. (Sections 17(1)(c) and 17(2)(a)). Since the APAAR and ABC are considered government initiatives, they could be potentially exempted from certain data protection requirements outlined in the Act under the broad umbrella of welfare.

2. It gives the GoI wide discretionary powers to exempt any data fiduciary or class of data fiduciaries from provisions of the Act for up to 5 years after commencement (Section 17(5)). This could potentially equip the government to exempt the nodal agencies of APAAR as well to ensure smooth implementation. 

3. The government has broad rule-making powers under the Act, including exempting classes of data fiduciaries from certain requirements like notice, accuracy, consistency, etc. (Section 17(3)). It could potentially use these powers to create exemptions benefiting the academic initiatives.

4. It allows processing of personal data without consent if necessary for fulfilling legal obligations to disclose information to the state (Section 7(d)). If the academic initiatives have a legal backing mandating disclosure of data, this could enable processing without consent under the pretext of legitimate state interest. 

Can the State violate my privacy under “legitimate state interest”?

There are three scenarios that I can think of that I discuss further. This is rather extensive — but please bear with me.

Article 21A: Right to Education vs Article 21: Right to Privacy

The Right to Education (RTE) Act in India was implemented under Article 21A in 2009 which mandates free and compulsory education for all children between the ages of 6 and 14. It prohibits denial of admission or discrimination based on various factors, including socio-economic status, and aims to ensure equal access to quality education. On the other hand, Justice K.S. Puttaswamy vs the Union of India judgment upheld the right to privacy as a fundamental right under Article 21 of the Constitution. The court ruled that the Aadhaar scheme, while legal, cannot be made mandatory for availing welfare schemes and services. 

The primary concern with APAAR is linking the proposed unique ID with Aadhaar could potentially violate both the RTE Act and the Puttaswamy verdict. If the APAAR system becomes mandatory or is linked to Aadhaar in a way that infringes on students’ privacy rights, it could create barriers to accessing education, which would go against the spirit of the RTE Act. For instance, if parents or students choose not to provide consent for the APAAR ID due to privacy concerns, they may face discrimination or denial of educational services or entitlements, which would be a violation of the RTE Act.

Moreover, if the APAAR system collects and stores sensitive personal information about students, including biometric data, without adequate safeguards and consent mechanisms, it could be seen as a violation of the right to privacy as per the Puttaswamy judgment.

The implementation of the APAAR system needs to strike a careful balance between the legitimate state interest of maintaining academic records and monitoring education progress, and upholding the fundamental rights of students to education and privacy. Clear guidelines, consent processes, and robust data protection measures would be necessary to ensure that the system does not inadvertently create barriers to education or infringe on students’ privacy rights.

Monitoring of Dropout Rates

One of the purposes of the APAAR system is to enable tracking education progress and monitoring drop-outs by government agencies. While monitoring dropout rates can be a legitimate state interest, as it can help identify areas or communities where students are more likely to drop out, and potentially enable targeted interventions or support programs, there are concerns about the potential for surveillance and violation of privacy rights.

Privacy concerns rise due to continuous tracking and monitoring individual students’ academic progress and attendance could be seen as an invasion of privacy, especially if done without explicit consent or robust data protection measures. There is also a potential for misuse. If the data collected through APAAR is not properly secured and regulated, there is a risk that it could be misused for purposes beyond just monitoring dropouts, such as profiling students or communities based on their academic performance or other factors.

A major concern would be the stigmatization and discrimination that could transpire as a result of labeling or singling out students as potential “dropouts” based on their academic records or other data could lead to stigmatization and discriminatory treatment, which could further exacerbate the problem of dropouts rather than solve it. Moreover, academic performance and attendance alone may not accurately reflect the complex reasons behind students dropping out, such as socio-economic factors, family circumstances, or other personal issues. Relying solely on data from APAAR could lead to incomplete or flawed interventions.

Creation of welfare schemes

Since the APAAR system will allow retrieval of academic records for transfer of government benefits, it can be interpreted that the data collected through APAAR could be used for creating welfare schemes or targeted benefits for students based on their academic records and other data.

Based on the academic records and performance data in APAAR, one could identify and award scholarships to meritorious students, especially from underprivileged backgrounds. Remedial education programs can be designed for students struggling in specific subjects or areas that could be identified through APAAR data and provided with targeted remedial education or tutoring support. Similarly, mid-day meal programs can be implemented better since students from economically disadvantaged families could be identified and enrolled in school meal programs or provided with food subsidies based on their socio-economic data in APAAR. 

Students without access to digital devices or internet connectivity could also be identified and provided with subsidized devices or data plans to support their online learning needs. Lastly, APAAR data could be used to identify students’ strengths and interests, and provide targeted career counseling or skill development programs accordingly.

There will also be potential risks and concerns. The use of personal and academic data for creating welfare schemes raises privacy concerns, especially if the data is not adequately secured or if consent is not properly obtained for this purpose. Similar to identifying dropout rates, if the welfare schemes are not designed and implemented carefully, they could lead to discrimination, labeling or stigmatization of certain students or communities based on their socio-economic status, academic performance or other factors.

The creation of targeted welfare schemes based on APAAR data could also lead to inequitable distribution of resources or benefits, potentially exacerbating existing disparities in the education system. The use of academic data for welfare schemes could inadvertently also create perverse incentives or unintended consequences, such as students or parents manipulating data for personal gain or schools prioritizing academic performance over holistic development.

To mitigate these risks and maximize the positive impact of welfare schemes created using APAAR data, the design and implementation of these schemes would have to involve stakeholder consultation, sensitivity training and ongoing monitoring to ensure equity, fairness and for the best interests of students.

Do APAAR and ABC pass the legitimate state interest tests?

APAAR and ABC seem to have a legitimate state interest in maintaining academic records and facilitating the transfer of credits between educational institutions. However, there are concerns about potential violations of privacy rights and disproportionate data collection that need to be carefully evaluated against their stated purposes. Hence, assessing them based on three legitimate state interest tests of purpose, necessity and balance will allow us to further understand whether the State’s interest is justifiable. 

Purpose Test

The purpose test examines whether there is a legitimate interest behind the processing of personal data. In the case of APAAR and ABC, the stated purposes seem to align with legitimate state interests in the education sector. Why?

1. maintaining a centralized digital repository of academic records from pre-primary to higher education levels can streamline access to educational information and reduce reliance on physical documents. This serves the legitimate interest of efficient administration and record-keeping in the education system.

2. facilitating the digital transfer of academic credits between educational institutions promotes flexibility and mobility in higher education, aligning with the objectives of the National Education Policy 2020 and can benefit students by reducing barriers to pursuing education across different institutions.

3. by offering a single, reliable reference for educational institutions to verify academic credentials, APAAR and ABC aim to enhance the integrity of the education system by preventing fraudulent practices related to certificates and degrees, serving the legitimate interest of maintaining credibility and trust in the education system. 

4. the reduction of physical documentation and the ability to digitally store and access academic records can make the educational experience more convenient for students, improving the efficiency and user-friendliness.

5. if APAAR and ABC gain global recognition, it could potentially enhance students’ access to employment and educational opportunities abroad, facilitating international mobility and recognition of Indian academic qualifications.

6. APAAR and ABC can enable tracking of educational progress and monitoring of dropout rates, which could help identify areas or communities where targeted interventions or support programs may be needed, aligning with the state’s interest in improving educational outcomes and addressing dropout rates.

While these stated purposes seem to serve legitimate state interests in the education sector, it is crucial to evaluate whether the means employed (extensive data collection, integration with Aadhaar, and sharing with third parties) are necessary and proportionate to achieve these purposes.

Necessity Test

The necessity test examines whether the processing of personal data is necessary and proportionate to achieve the stated legitimate purposes. In the case of APAAR and ABC, the necessity of collecting and processing extensive personal and academic data needs to be critically evaluated.

The necessity of collecting and processing extensive personal and academic data through APAAR and ABC is debatable. While a centralized system may facilitate credit transfers and record-keeping, the extent of data collection and integration with platforms like Aadhaar and DigiLocker raises concerns about necessity and proportionality. APAAR will collect personal information like name, date of birth, gender, contact details, Aadhaar number and extensive academic records including marksheets, transcripts and certificates.

Additionally, APAAR and ABC may share or transfer personal and academic data with third-party organizations, educational institutions and government agencies, potentially beyond the stated purposes. While the necessity of a centralized system is understandable, the necessity of collecting and sharing such extensive personal and academic data, especially with third parties, needs to be carefully evaluated against the stated objectives.

The necessity of continuous monitoring and tracking of individual students’ academic progress and attendance raises concerns for privacy of the student. The necessity test also requires considering whether the stated purposes can be achieved through less intrusive means or by processing less personal data. For example, instead of collecting extensive academic histories, a more targeted approach could be adopted where only necessary credits and credentials are stored and transferred.

Balancing Test

The balancing test, which weighs the legitimate interests against individuals’ rights and freedoms, becomes critical in determining the overall compliance with the legitimate state interest tests. The proposed APAAR and ABC systems may face significant challenges in passing the balancing test due to concerns over potential privacy violations and the risk of discrimination outweighing the legitimate state interests they aim to address.

First and foremost, there are worries about infringing on individuals’ right to privacy, particularly regarding the mandatory linkage of APAAR with Aadhaar numbers, contradicting the voluntary nature upheld by the Supreme Court. Also, the extensive collection and sharing of personal and academic data without robust safeguards could further compound these privacy concerns. 

Students may reasonably expect their academic data to be securely stored and shared for legitimate educational/employment purposes with their consent. However, concerns about data misuse, privacy violations, and potential mandatory linking with Aadhaar raise questions about infringing on reasonable expectations. APAAR and ABC also provide options for individuals to access, update, and delete their data, which is positive. However, the potential mandatory linking with Aadhaar could undermine individual control over data sharing. While APAAR and ABC claim to follow security standards, the risk of data breaches or misuse by third parties cannot be ruled out (Snowden Attack), which will violate individuals’ control over their data.

What can we finally say?

Okay, I think the primary reasons why APAAR and ABC can be beneficial include:

1. streamlining and digitizing academic records for easier access and mobility

2. enabling seamless credit transfers between institutions —> promoting flexibility in higher education

3. enhancing the integrity of the education system by preventing fraud and duplication of certificates

4. facilitating the creation of targeted welfare schemes and support programs based on academic data

However, there are reasons for concern:

1. potential violations of privacy rights and lack of robust data protection measures

2. risks of data breaches, misuse, or surveillance if data is not adequately secured

3. undermining individual control and consent by potentially mandating Aadhaar linking

4. unintended consequences, such as discrimination, stigmatization, or perverse incentives if the data is misused or welfare schemes are not carefully designed

Okay, but should I trust it?

The core objectives of APAAR and ABC are commendable and could potentially benefit the education system if implemented properly. However, the current proposed implementation raises obvious concerns regarding privacy, data protection and the potential infringement of fundamental rights. So, what can be done about it?

Potentially, a decentralized or more privacy-centric approach that prioritizes individual control and consent can achieve similar objectives while mitigating the risks associated with a centralized system. Alternatively, if a centralized system like APAAR/ABC is deemed necessary, it should be accompanied by a strong legal framework that enshrines data protection principles, establishes clear consent processes and empowers individuals with control over their data (this seems to far-fetched with how long it takes to implement reforms in our country).

End Note

If you made it till here, I applaud you. This was an extensive blog. I have rambled a lot. I only hope that I made some level of sense.

On that note, here’s an anecdote:

When I presented this research to my professor, he asked me “I see no problems with this system. You probably wasted your time on this project”. I replied, “Well, not everything the government does must be criticized. You wanted me to analyze a digitalized public good — I did.”

Nevertheless, I am truly excited to see what happens with APAAR and how its integration will work out for a country with the highest population and almost 20% being young students like me.

References:

1. The Digital Person by Daniel J Solove

2. K.Puttaswamy Judgment, 2017

3. Digital Personal Data Protection Act, 2023

Webiology:

1. https://www.iitms.co.in/blog/what-is-academic-bank-of-credit.html

2. https://www.eklavvya.com/blog/academic-bank-credits/

3. https://services.india.gov.in/service/detail/academic-bank-of-credits-1

4. https://aucuetug2023.cbtexam.in/Home/ABC%20ID%20generation_steps.pdf

5. https://www.abc.gov.in

6. https://byjus.com/free-ias-prep/right-education-act-rte/

7. https://righttoeducation.in/know-your-rte/about

8. https://en.wikipedia.org/wiki/Right_of_Children_to_Free_and_Compulsory_Education_Act,_2009

9. https://timesofindia.indiatimes.com/readersblog/igoravsharma/what-is-right-to-education-act-rte-act-32034/

10. https://www.careindia.org/blog/right-to-education-act-2009/

11. https://www.freepressjournal.in/education/apaar-id-unique-student-identification-raises-concerns-about-data-safety

12. https://timesofindia.indiatimes.com/city/indore/over-15-crore-school-students-to-get-apaar-id-by-2025/articleshow/108339488.cms

13. https://apaar.education.gov.in/

14. https://www.hindustantimes.com/education/news/education-ministry-launches-apaar-in-remote-villages-across-the-country-101707472228019.html

15. https://pib.gov.in/PressReleasePage.aspx?PRID=2003802

16. https://smcs.ac.in/sites/default/files/2024/ABC%20Awareness%20ppt.pdf

17. https://www.education.gov.in/nep/ncrf-apaar

18. https://www.drishtiias.com/daily-updates/daily-news-analysis/apaar-one-nation-one-student-id-card

19. https://www.geeksforgeeks.org/apaar-id-card-a-complete-guide/

    22. https://inc42.com/features/decoding-apaar-id-indias-new-aadhaar-like-student-id-system-to-secure-verify-academic-credits/

20. https://gitgovindacademy.com/automated-permanent-academic-account-registry-apaar/

21. https://www.studyiq.com/articles/one-nation-one-student-id-initiative/

22. https://bestcolleges.indiatoday.in/news-detail/apaar-id-to-be-a-global-document-dharmendra-pradhan

23. https://zapmoney.in/unlock-your-academic-journey-with-the-apaar-id/

24. https://optimizeias.com/automated-permanent-academic-account-registryapaar-id/

    28. https://www.hindustantimes.com/education/news/education-ministrylaunches-apaar-in-remote-villages-across-the-country-101707472228019.html

25. https://www.ugc.gov.in/KeyInitiative?ID=UCL6fMspL2LJS89kv++N3A%3D%3D

26. https://rdunijbpin.mponline.gov.in/Site/Upload/News/143b9aa6-3029-4f4d-b5a8-544a5494c510.pdf

27. https://cleartax.in/s/apaar-id-card