One nation, One student ID, zero law or policy to back it up #WhatAreYouVotingFor

Help us sustain the work we do

tl;dr

The Ministry of Education’s “one nation, one student ID” scheme, namely the APAAR ID, presents a range of privacy and data protection concerns, which we have previously flagged to the Ministry. However, the implementation of the scheme is picking up pace, and we suspect it is being rolled out without any law or policy behind it. We note a lack of accountability and transparency from the implementing bodies, which is also making it difficult to know about the legal propriety and procedure operating the framework. Further, the APAAR ID is following the dangerous “voluntary-mandatory” design notoriously associated with Aadhaar, exacerbating its existing privacy and legality concerns. Moreover, 100% implementation of APAAR is now being pushed as a key governance promise by the BJP in the 2024 Lok Sabha elections, which may have catastrophic consequences for the data privacy and dignity of students across India.

Background

In July 2023, the Ministry of Education (“MoE”) introduced a ‘one student, one unique ID’ scheme comprising the Automated Permanent Academic Account Registry (“APAAR”) and the National Credit Framework (“NCrF”) through a panel discussion on the implementation of the 2020 National Education Policy (“NEP 2020”). The vision? To issue unique IDs to students based on their Aadhaar number and store life-long longitudinal records of their educational scores, achievements, and related statistics, against it.

The enrollment process began in October 2023, when MoE wrote to state chief secretaries asking schools to persuade students into creating APAAR IDs, which will be based on and authenticated through their Aadhaars. We could not find a copy of this missive through public portals, but some schools have uploaded it to their websites and we have archived it here. In line with globally recognised legal principles, schools require parental consent to enrol students into the registry as the students are minors, i.e. under the age of 18. Thus the MoE Secretary, through the letter, also persuaded schools to hold a “special” parents’-teachers’ meetings (“PTM”s) for three consecutive days, “to get the consent of parents” to enrol their children into the APAAR framework. To date, well over 25 Crore APAAR IDs have been created across India.

What’s worse: two powerful actors, namely the incumbent MoE as well as the Bharatiya Janata Party (“BJP”), are heavily backing this scheme and promising to achieve 100% implementation either in their official press statements or 2024 election manifestos. In this blog, we will lay out the evidence we have on the lack of policy and messy governance mechanisms, and argue that the APAAR ID needs to be withdrawn completely.

What’s the harm?

Simply put, the APAAR ID collects and permanently stores personal data of students, i.e. minors, against their Aadhaar details. This is an exercise being implemented pan-India without addressing questions about data collection, usage, storage, and sharing, all the while being mandatorily linked with Aadhaar. Moreover, global standards dictate that personal records of children require added layers of data security and additional processing obligations apart from mere parental consent. 

Shortly after news reports about the implementation of the APAAR ID started trickling in, we deeply analysed the framework in this blogpost and noted a) the legality of making Aadhaar mandatory for creating an ID, b) the unaddressed privacy and data protection concerns with the framework, and c) most alarmingly, the complete lack of publicly available law/policy documents that may be backing the initiative. We also wrote to the MoE outlining these concerns. The Ministry had started widespread collection of student data in October 2023 and initiated plans to process, store, and potentially share such data without having released any law or policy documents backing the APAAR framework. There are no press releases, frameworks of implementation, data use or privacy policies, or any official notification of the initiative – yet, states began rolling out APAAR IDs in public and private schools back in October. Till date, they have achieved vast implementation numbers, and some even plan to achieve 100% seeding by 2025.

Further, India’s overarching data protection legislation, the Digital Personal Data Protection Act, 2023 (“DPDPA”) is not in effect yet. Any collection, processing, storing, or sharing of student data during this time is being done without an overarching data protection law or any remedies and safeguards against harm in place. This concern is exacerbated by the fact that the data belongs to children, which according to the Supreme Court in JJ (Retd) K.S Puttaswamy v. Union of India [(2019) 1 SCC 1], necessitates additional safeguards and airtight data protection measures.

So, what do we know?

Well, who needs an instrument of law when you have a 03:38:18 hour long video of the Minister of Education and school principals talking about how great APAAR is and how quickly they have rolled it out (by hook and by crook) in their own schools? APAAR-t from informal documents like this video and an earlier panel discussion, this is what we know about the status, operations, and governance of the framework:

A hush-hush job

First, we must talk about how while APAAR ID may have become a PR darling for MoE, the Ministry does not want to talk about it much when asked. We have been making inquiries into the APAAR framework and implementation plan for public and private schools across India through Right to Information (“RTI”) requests. We filed our first RTI on October 19, 2023 seeking a copy of the letter from the Department of School Education and Literacy, MoE (“Education Department”) to all state chief secretaries and education commissioners for the creation of APAAR IDs, and received no response. We filed our second and third RTIs later in October with MoE asking about the status of the scheme, its backing law and/or policy documents, and other details of enrollment. We, again, received no response.

We filed a fourth RTI with the Education Department on November 2, 2023 asking the same questions again, and stressing on the law/policy document the authorities are using to implement the APAAR ID and framework. This time, we received a response on December 1, 2023, noting: “for implementation of APAAR, detailed plan covering all aspects such as framing up of policies, guidelines, criteria for empanelment of schools etc are under development stage.” Note that by this stage, about 2.2 Crore students had been enrolled for the APAAR ID without a law/policy in place. Then we filed a fifth RTI asking for the earlier order sent to chief secretaries, and finally received a copy.

We sustained our transparency efforts by filing a sixth RTI (sigh) on December 28, 2023 with MoE, asking once again about the grounding law/policy for this initiative, only to receive the same response again: “for implementation of APAAR, detailed plan covering all aspects such as framing up of policies, guidelines, criteria for empanelment of schools etc are under development stage.” We made it our lives’ mission to get hold of the law/policy behind it, whatever it takes!

So on February 16, 2024, we made another (but by no means last) attempt to get these questions answered, and received the most interesting response to date. The RTI, which was transferred by the Education Department to Digital India Corporation, Ministry of Electronics and IT (“MeitY”), read:

“[t]he Ministry of Education (MoE) will inform about the Standard Operating Procedure (SoP) and policy for creating/ verifying the APAAR IDs. However, the Ministry of Electronics and Information Technology (MeitY), the implementing body, has developed the portal and follows the Data Privacy and Protection Act (DPDA). It is important to note that since students/ learners are minors (below 18 years of age), parental/ guardian consent is necessary for the authentication/ creation of the APAAR ID.”

The surprise cameos almost made the wait worth it—hiiiii MeitY, did not expect to see you here! And nice to meet you, mystery legislation ‘Data Privacy and Protection Act’! As confusing and utterly evasive as this RTI response was, it made two things clear: 1) APAAR ID is being aggressively implemented without any law or policy written down to back it, which as we argued in our previous post makes the framework unconstitutional, and 2) the Ministries are simply shedding all accountability when it comes to questions about privacy and legality, and are claiming to use legislations that have not even been enacted yet. We recently also filed an RTI with MeitY asking what law/policy document they are following in implementing the scheme, since MoE has conveniently shrugged off the responsibility of answering that question. We await replies. 

Voluntary? Mandatory? Voluntary-mandatory?

This horror movie does not end with the secrecy of APAAR ID’s legality and implementation. As a scheme that is ‘voluntary’ on paper, it seems to be following in the footsteps of its grandparent, the mysterious Aadhaar, in actually being ‘mandatory’ in practice.

The October 2023 missive sent by the MoE Secretary to states is a clear directive to schools from the Union that they pretty much *have* to adopt the APAAR framework. The letter goes as far as to instruct schools on how to do this (by providing an Aadhaar consent form and suggesting “special PTMs”). APAAR ID is voluntary on paper, but this makes it crystal clear that it is pretty mandatory for schools to follow. 

Further, stakeholders too hold the opinion that APAAR is only optional on paper, but will lead to arm-twisting or exclusion if they choose not to opt for it. Educationists believe that, much like Aadhaar verification, schools will be forced to ensure the participation of all students and parents. Teachers also think APAAR will eventually be thrust on them as an administrative overhead, whether they want it or not—and they are already too burdened with non-academic school tasks to carry this out. Schools also wonder why there is a need for such an ID, given they store similar Aadhaar-linked information on the UDISE+ database—an internal management system for schools tracking teachers, students, and staff, the legality of which is currently sub-judice. 

Even if it becomes mandatory for schools, APAAR is, again at least on paper, optional for students (and parents, whose consent is paramount to enrol them). Under Section 6(1) of the DPDPA, as under other established global principles on data processing, any consent taken for processing data must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action.” Further, Section 6(4) clearly notes that data processors (here, parents and children) shall have the right to withdraw their consent at any time, with “the ease of doing so being comparable to the ease with which such consent was given.” We see that with the roll-out of APAAR ID, this is not the case. Consent being taken from parents does not seem to be free or informed, but rather a mere formality. 

However, parents seem to either not know they have an option, or are not given an opportunity to say “no”. Some parents have pointed out that there is no option to deny consent on the Aadhaar consent form handed to them as part of the APAAR enrollment. Schools are also reported to be grappling with the uncertainty of how to proceed if a parent refuses to complete the form. The MoE Secretary had instructed schools to hold “special” parent-teachers’ meetings to educate parents on the benefits of APAAR initiative and encourage them to give consent towards creating students’ APAAR IDs. This “encouragement” can easily take the form of arm-twisting, coercion, or taking consent without providing enough information. 

Schools enjoy a definite upper-hand in making parents comply with institutional mandates and demands—as admissions have gotten competitive in the past decade, parents have been bowing down to schools’ paperwork requests, including creating their children’s Aadhaar cards even for pre-nursery admissions. Bigger schools may enjoy even more bargaining power since their admission rates are slim. So it is not far-fetched to think that parents will eventually feel pressured to give consent for APAAR IDs just so their child can access quality education. As schools are pressured into meeting certain implementation targets for the APAAR framework, they may also increasingly resort to coercion or force to get parents to give their consent. 

Further, in the 3+ hour video posted by MoE on achievements of the APAAR ID, the Education Minister claimed that they will push to enrol more and more students from rural and remote areas on the APAAR framework to allow them to reap its benefits. However, this might cause problems for parents in rural areas who may not completely understand the consequences of giving consent due to low data or tech literacy, and may end up easily giving consent because they were told to do so by teachers.

This is also harshly juxtaposed by the reality that millions of rural, nomadic, destitute, or marginalised students do not have access to education or are thrown out of schools for not possessing an Aadhaar card. By making rural schools implement an Aadhaar-based student ID, there is a risk of vast exclusion. This will also undermine the Supreme Court’s 2018 ruling in JJ (Retd) KS Puttaswamy v. Union of India (Constitutionality of Aadhaar Act), which categorically notes that educational institutions like CBSE, NEET, JEE, UGC etc. cannot make the requirement of Aadhaar mandatory for basic entitlements under the Right to Education Act, 2015 like securing admission in schools or taking board examinations. 

At present, much like its foundational Aadhaar, the APAAR framework holds a *voluntary on paper, mandatory in practice* status which will only get more pervasive in the coming years as MoE guns for 100% implementation by 2026-27.

Manifesto-ing 100% implementation

Not only the MoE, but the BJP is also gunning for the universal adoption of this problematic framework. BJP’s manifesto for the 2024 Lok Sabha election states:

“Implementing One Nation, One Student ID: We will achieve 100% implementation of ‘One Nation, One Student ID’ through the Automated Permanent Academic Account Registry (APAAR) to store academic qualifications, credit scores and certificates, among others for students from pre-primary to higher education.”

We worry that given the current state of affairs, where a highly privacy-intruding scheme is being implemented aggressively without proper data protection laws (or any law) in place, a 100% implementation goal can be catastrophic for the privacy and autonomy of students across India.  We believe that the way that this framework is created is invasive by design and should be rolled back. But the BJP manifesto promises the opposite, which is to achieve universal implementation. Now is a good time to ask ourselves and each other: #WhatAreYouVotingFor?

Important documents:

1. IFF’s post on APAAR ID dated October 27, 2024 (link)
2. IFF’s Letter to the Ministry of Education on the APAAR ID (link)
3. BJP’s 2024 Election Manifesto (link)
4. Ministry of Education’s Thematic Session on NCrF and APAAR (Powerpoint Presentation) (link)
5. Ministry of Education’s Thematic Session on NCrF and APAAR (Final Report) (link)