We urge CBSE to consider the pandemic as a time for care for students, not violations of their privacy.

tl;dr

On January 21, 2021 we had sent a representation to the Central Board of Secondary Education (CBSE) asking them to cease use of facial recognition technology (FRT) for allowing students to access their digital documents. Prior to this we had also made RTIs seeking further information on this FRT deployment. On April 8, 2021 we received a reply from them however they failed to adequately respond to any of our concerns. Read our analysis of their reply below.

Actions to prevent FRT systems on students

Today there is an ongoing conversation on the need to postpone CBSE examination as we see a surge in Covid cases across the country. Here, some proposals have been made for the conduct of these examinations through remote means. This may bring up the worrying prospect of deployment of facial recognition as an authentication technology. We have good reasons to fear such outcomes that may threaten the privacy of students all over India. It connects to our prior work, for which we have several updates to provide you on the basis of responses from CBSE.

We first became aware that CBSE is using facial recognition technology to provide access to digital documents to students by a news report published in the Indian Express on October 22, 2020. The application enables students to download their digital academic documents of classes 10 & 12 after a live image of the student is matched with the photograph on the CBSE admit card already stored in the repository. Spurred into action from this news report, we filed a Right to Information request with CBSE bearing reference no. CBSED/R/E/20/03761 on October 28, 2020 asking them to provide information about the scope and nature of the project. In its reply dated November 24, 2020 bearing reference no. CBSED/R/E/20/03761/3176, CBSE stated that it was not using facial recognition technology, instead it was using face matching technology, in an attempt to create a measure of difference between the two.

As a result, we filed another RTI request on December 10, 2020 bearing reference no. CBSED/R/E/20/04158 asking CBSE to explain how the face matching technology operates. In its reply dated January 27, 2021, CBSE failed to respond to our queries satisfactorily. In our request to them we had asked them to share with us a step by step process of the working of the “face matching technique”. However, the reply failed to provide us with any details about how the face matching takes place as well as how it is distinct from facial recognition.

In addition to filing RTI requests for information on the application, we also sent a representation to the CBSE dated January 21, 2021. In our representation, we highlighted our concerns related to privacy and exclusion. In light of these concerns, we recommended that CBSE cease use of facial recognition irrespective of the nomenclature being used for it as face matching for any of its deployments.

What did the CBSE say in its reply to our representation?

In its reply dated April 8, 2021, the CBSE has again reiterated that it is only employing a “face matching technique” and not using FRT. However, CBSE hase once again failed to convey any meaningful distinction between the two processes. We believe that this is just a tactic to dilute the issue through use of confusing nomenclature.

Then, the reply moves on to responding to our analysis of the program based on the Hon’ble Supreme Court's decision in Justice K.S. Puttaswamy vs Union of India (2017) 10 SCC 1. While we commend the CBSE for trying to reason within the existing privacy standards as set by the Supreme Court, we find it’s justification to be erroneous for the following reasons.

Legality

CBSE asserts that since it does not retain the data collected from the “face matching technique”, it does not need to show legality of the program or the existence of a law which allows them to regulate the program. This understanding is incorrect since the intrusion into the privacy of the students takes place the moment the photograph is uploaded into the facial recognition database. Privacy does not only arise from data at rest, but also when personal data is used for processing. Further, in the absence of any legal basis which mandates non-retention of biometric data under the program, it cannot be proven that no data is being retained since there is no Data Protection Authority to verify such assurances. It is important to consider that such data may also be shared with third parties who may be private organisations, hence verification becomes essential.

Proportionality

Additionally, the use of FRT by CBSE fails to satisfy the proportionality requirement of Puttaswamy, since, according to the reply sent to us by CBSE, FRT is just one of the authentication mechanisms being used under the multi-factor authentication process in place and is voluntary. Therefore, it is clear that CBSE does have alternatives to the use of FRT which are less invasive to the privacy of students.

Procedural guarantees to check against the abuse of State interference

Finally, there are no procedural guarantees in place to ensure that misuse of the technology does not take place thereby increasing the risks related to its use. The CBSE has only responded in part to how the data is secured against breaches but has failed to respond to how internal misuse will be curbed.

The second wave is a time for care

We note how the CBSE responded positively accounting for the care of students by cancelling examinations for the 10th standard and deferring those for the 12 standard till June, 2021 as we see a surge in Covid cases across the country. Here, some proposals have been floating for the conduct of these examinations through remote means. This again may bring up the worrying prospect of deployment of facial recognition as an authentication technology. We have good reasons to fear such outcomes that may threaten the privacy of students all over India. It connects to our prior work, for which we have several updates to provide you on the basis of responses from CBSE. We urge the CBSE to consider these risks keeping the welfare and the rights of students in mind. This includes safeguarding them from invasive technologies such as FRT systems.

Project Panoptic

While we thank CBSE for engaging with us on this issue, its responses remain unsatisfactory. At the same time such engagement is a step in the right direction towards improving institutional practices around personal data and sensitive public officials and decision makers against the deployment of FRT systems. Under Project Panoptic, we have been tracking all ongoing use of facial recognition technology in the country.

What can you do? Add your voice to more than 500 concerned Indians who have called for a complete ban on the use of FRT by the government entities, police and other security/intelligence agencies. Read and sign the petition today!