Disclosing names and particulars of students admitted under the economically weaker section (EWS) quota would invade children’s privacy since “the information about names and particulars of students is personal information [that is] held by the school in a fiduciary capacity”, the Central Information Commission ruled. The Commission, which rules on second appeals filed under the Right to Information Act, 2005, held that specific information including students’ names, their parents’ names and similar information is barred from public disclosure under Section 8(1)(j) of the RTI Act that exempts personal information of private citizens from being disclosed in response to an RTI application. SCC Online first reported this.

The Information Commissioner Yashvardhan Kumar Sinha was ruling on a second appeal filed by Anita Chaudhary under the RTI Act on July 19, 2018. Under the RTI Act, Chaudhary had sought the names, parents’ names and the copies parents’ income certificates of all students admitted under the EWS quota in classes 8 and 12 of Baptist Convent Senior Secondary School in Delhi in the year 2017-18. The second appeal was heard by the Commission in June 2020.

The Information Commissioner instead directed the concerned public information officer (PIO) in the Delhi government’s Department of Education to give Chaudhary information about the total number of students, if any, admitted under EWS quota in classes 8 and 12 of the school.

The PIO argued that he had given no information to Chaudhary under the RTI Act because data about online registration of students was available from 2018-19 onwards and she had sought details related to the 2017-18 academic year. He also said that students are not admitted under the EWS quota in classes 8 and 12, and thus the data was not readily available.

The Commission called the lack of information about admissions under EWS quota “totally unacceptable” and said that the Department of Education was the regulatory authority of all educational institutions and could not “remain oblivious nor avoid questions relating to such crucial information which involves implementation of the Right to Education Act”.

This is a significant recognition of children’s privacy rights as well as the fiduciary duties of schools, even in the absence of a privacy law. As it is, under the Personal Data Protection Bill, 2019, schools would be considered data fiduciaries, and by virtue of processing large volumes of personal data of children, they would be considered guardian data fiduciaries as well. Hence, without the consent of students’ guardians, the schools would be unable to share personal data of the children with any third party, including the Department of Education. However, government-run schools may be regulated differently if the Data Protection Authority classified them as a “service provided by a government” under Section 12(a)(i) of the Bill. Section 12 gives grounds for processing personal data without consent.

“Government schools do perform a public function which is why there is the possibility of an exemption that may be claimed by them under section 12. However, to my mind there is no exemption from the requirements of section 16 and 16(2) mandates prior consent of guardians,” Rahul Narayan, a Supreme Court lawyer, said. Section 16 of the Bill bars guardian data fiduciaries — a special category of data fiduciaries that primarily deal with children’s data — from profiling, tracking or behavioural monitoring children or targeting ads at them. Under the Section, consent must be taken from parents or guardians before processing children’s data, and children’s age must be verified.

“When private schools administer the EWS quota, they may be performing a ‘public function’ but to my mind, 12(a)(1) refers to the provision of a service by the state and private schools are not a ‘state’. As such, I don’t think based on the text of the statute that private schools can take advantage of section 12 to process or share data without consent.  

Since the Bill is still pending consideration, perhaps this aspect may be further clarified in parliamentary discussions and the language of the statute,” Narayan further said.

Read more: How will India’s Personal Data Protection Bill, 2019, impact schools?

***Update (August 24, 2020 11:50 am): Updated with Rahul Narayan’s comments. Originally published on August 22, 2020 at 11:43 am.