Experts flag APAAR risks as institutes push enrollment

With educational institutes pushing for enrollment of students under the APAAR ID, experts have raised concerns around potential privacy risks associated with a centralised database and on the efficacy of the ID in obtaining verifiable parental consent (VPC) under the Digital Personal Data Protection Act (DPDPA).

APAAR, or Automated Permanent Academic Account Registry, is a unique 12-digit ID that has been so far assigned to around 315.6 million students in India, as per the education ministry’s website, to digitally store and manage academic records. The ID functions as a permanent digital identity for students and eliminates the need for physical certificates.

The draft DPDP Rules were released on January 3 for consultation. When finalised and notified, they will provide teeth to the DPDPA notified in the gazette on August 12, 2023. Under the DPDPA, companies need to obtain parental consent that can be verified before their child’s data can be processed.


Also Read: Personal data breach notification, verifiable parental consent, dominate data rules consultation

Under the draft DPDP Rules, a data fiduciary shall check that the individual identifying as the parent is an adult, who is in turn identifiable by voluntarily provided details of identity and age, or a virtual token mapped to the same.

These virtual tokens can be issued by an entity entrusted by law, the Central government or a State Government and made available by a digital locker service provider.

While obtaining parental consent is a requirement for creating an APAAR ID for minors, experts raised concerns about how this consent is being obtained and the potential privacy risks associated with such a centralised database.

Mishi Choudhary, founder of the Software Freedom Law Centre (SFLC.in), argued that APAAR ID enrollment is being enforced through "arm-twisting tactics" despite the ministry of education stating it is voluntary. She emphasised the lack of clear data privacy standards and the vulnerability of such a vast repository containing sensitive student information.

Disha Verma, a technology researcher, highlighted the absence of a legal framework governing data collection, storage and sharing within APAAR. However, Praneet Mungali, trustee and secretary of Sanskriti Group Schools, proposed APAAR ID as a potential solution for VPC mandated by the DPDPA.

Mungali argued that APAAR ID's pre-validated parental consent system can streamline compliance for data processors by eliminating the need for repeated verification. He also pointed out that the linking of APAAR ID with DigiLocker, a government-owned cloud-based digitisation service, could enable parental identity and age verification for processing children's data.

As per the education ministry website, upon successful verification, the APAAR ID is created and added to DigiLocker for secure online access.

Aparajita Bharti, founding partner of TQH Consulting, emphasised the need for a clear demonstration of APAAR ID-based parental consent workflow to allow industries to integrate with the system. She also highlighted the importance of addressing potential vulnerabilities in such large databases.

While APAAR ID offers potential benefits for streamlining student data management and obtaining VPC, concerns regarding its voluntary nature, data privacy and lack of clear guidelines need to be addressed, experts said.

The successful implementation of APAAR ID hinges on establishing a robust legal framework, ensuring transparency in data handling practices and prioritising data security, they said.

Further discussions and consultations are needed to ensure APAAR ID functions in accordance with data protection laws and safeguards the privacy of students, they said.

Also Read: Social media companies yet to take a final call on mechanics of parental consent