Digital education systems promise portability, administrative efficiency and better recognition of learning achievements. Yet, when these systems collect and consolidate children's personal and academic information, efficiency must be balanced against privacy, autonomy and the risk of exclusion. India's Automated Permanent Academic Account Registry (APAAR), introduced under the vision of “One Nation, One Student ID” and aligned with the National Education Policy (NEP), 2020, illustrates this challenge. APAAR creates a lifelong digital academic identifier intended to facilitate the storage, retrieval and transfer of students' records across educational institutions.
In July 2026, proceedings before the Supreme Court brought a crucial question into focus: can parental consent be considered meaningful when families believe that refusing an educational identification system may affect their children's access to schooling or examinations? The issue extends beyond the design of a consent form to the constitutional responsibility of the State to ensure that digital public infrastructure serves children without making their privacy rights conditional on participation.
APAAR: EDUCATIONAL PORTABILITY AND THE EXPANSION OF DATA COLLECTION
APAAR is designed to consolidate students' academic achievements, including marksheets, certificates, qualifications and other educational credentials, within a digital framework. Integrated with the Academic Bank of Credits ecosystem, it aims to simplify transfers between institutions, reduce duplication, facilitate credit recognition and improve the continuity of educational records. These benefits are particularly relevant to students whose families migrate between States or whose educational pathways involve multiple institutions.
However, the system's utility depends on the collection and accurate matching of personal information. The official APAAR process identifies details such as the student's name, date of birth, gender, parental information, Permanent Education Number and Aadhaar-related information among the requirements for generating an ID. A consolidated academic identity can improve service delivery, but it also creates a longitudinal digital record of a child. Errors in identity matching, unauthorised access, excessive retention or use beyond the original educational purpose could affect the child's privacy and future opportunities.
The policy question is therefore not whether educational technology should be used, but whether its design incorporates data minimisation, purpose limitation, security and effective accountability. The more widely an identifier is used across institutions and services, the greater the need to prevent educational data from becoming an unrestricted source of profiling or surveillance.
THE JULY 2026 PROCEEDINGS: WHEN CONSENT BECOMES A FORMALITY
In Abhishek Baxi v. Union of India, the Supreme Court considered a challenge to the APAAR scheme brought by parents concerned about student registration, Aadhaar requirements and the adequacy of parental consent. The petitioners argued that the scheme was described as voluntary while school-level practices could make participation appear compulsory. They also questioned whether the prescribed consent form adequately explained the purposes, scope, retention and sharing of children's information. The Court's order dated 20 July 2026 addressed the central problem of whether parents could meaningfully refuse participation.
The Court directed that the Orissa High Court's earlier safeguard requiring an express option to refuse or withhold consent be implemented on a pan-India basis. It also clarified that the administrative character of APAAR did not exempt authorities from their obligations under applicable data-protection law. Personal information collected through the scheme must be processed lawfully, securely and for authorised purposes; disclosure to private entities or third parties must comply with the law and remain within legally permitted purposes.
The significance of the proceedings lies in the difference between obtaining a signature and securing informed consent. If parents are not told what data will be collected, why it is required, who may access it and whether refusal is possible, consent risks becoming a procedural formality. If schools communicate that an ID is necessary for admission, examination registration or other educational services without a clear legal basis, the practical freedom to refuse may be undermined. A meaningful safeguard must therefore operate in everyday school administration, not merely in the wording of a central policy.
CHILDREN'S PRIVACY, PARENTAL AUTHORITY AND CONSTITUTIONAL PROTECTION
Children require heightened protection in digital systems because they may not fully understand the long-term implications of data collection, profiling or information sharing. Parents and guardians play an important role in decisions involving minors, but their consent cannot substitute for the State's obligation to establish fair, proportionate and secure systems. Nor should the child's interests be treated as identical to administrative convenience.
In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right under Article 21 and the broader constitutional guarantees of liberty. State action affecting privacy must satisfy the applicable requirements of legality, legitimate purpose, proportionality and adequate safeguards. Applied to educational technology, these principles require a demonstrable relationship between the information collected and the educational purpose pursued. They also require safeguards against unnecessary collection, unrestricted secondary use and disproportionate consequences for families who decline participation.
The Digital Personal Data Protection Act, 2023, establishes a statutory framework for personal-data processing, including provisions concerning children's data. Its requirements must be applied in accordance with the Act's commencement arrangements, applicable rules and any relevant exemptions. The constitutional analysis remains important because administrative efficiency cannot independently justify every form of personal-data collection. A public programme should demonstrate why particular information is necessary, how its use is constrained and what remedies are available when those constraints are breached.
THE RISK OF EXCLUSION IN DIGITAL PUBLIC SERVICES
A digital identity system can improve access for students who frequently move between schools, but it can also create new barriers. Differences in Aadhaar records, spelling, dates of birth or school databases may delay ID generation. Families with limited digital literacy may struggle to understand consent documents or correct errors. Children from migrant, disadvantaged or otherwise vulnerable households may face particular difficulties if institutions interpret technical or registration problems as non-compliance.
The distinction between digital inclusion and compulsory digitisation is crucial. A system intended to make educational services more portable should not inadvertently make those services harder to access. If refusal to enrol in a scheme results in denial of an unrelated educational benefit without lawful justification, the system risks turning a convenience into a gatekeeping mechanism. Such consequences require scrutiny even where the underlying programme has legitimate objectives.
Effective safeguards should include a clear refusal mechanism, accessible explanations in appropriate languages, simple procedures for correcting records, strict limits on data sharing and transparent grievance redressal. Educational institutions should also be instructed not to invent additional penalties for non-participation. No child should lose access to education merely because a parent cannot understand a digital form, disputes unnecessary data collection or encounters a technical error, unless a specific legal requirement validly provides otherwise.
BUILDING TRUSTWORTHY EDUCATIONAL TECHNOLOGY
The way forward is not to abandon digital academic records, but to ensure that technological integration remains proportionate to the public purpose. First, consent forms should clearly identify the information collected, the purpose of each category of data, the entities authorised to process it, the retention arrangements and the available rights. The option to refuse must be prominent and usable, rather than hidden within a document that presumes agreement.
Second, data governance must be designed around privacy by design and purpose limitation. Access should be restricted according to official functions, records should be protected through appropriate technical and organisational measures, and retention should not extend indefinitely without a lawful basis. Any integration with other public or private systems should be subject to clearly defined legal authority and safeguards against unrelated use.
Third, accountability must extend beyond policy declarations. Parents and students need accessible channels to seek correction, challenge improper processing and lodge complaints. Schools and education authorities must receive clear instructions on voluntary participation and must not use enrolment targets to pressure families into consent. Independent scrutiny, security audits and transparent reporting of data breaches can strengthen confidence in the system.
Finally, the State should assess whether the benefits of collecting particular data justify the risks and administrative burden. A trustworthy digital education system is measured not only by the number of IDs generated, but by the fairness, security and freedom of choice it preserves.
UPSC DIMENSION
|
Constitutional provision or governance concept |
Relevance to APAAR and children's digital privacy |
|
Article 21 — Right to life and personal liberty |
Provides the constitutional foundation for privacy and requires safeguards against unjustified intrusion into children's personal information. |
|
Articles 14 and 21 |
Require public programmes to operate fairly and consistently, including where digital systems risk arbitrary exclusion or unequal treatment. |
|
Article 21A — Right to Education |
Raises concerns where access to elementary education could be affected by unnecessary digital-registration requirements. |
|
Article 15(3) |
Permits special provisions for women and children, supporting the case for heightened safeguards for minors. |
|
Justice K.S. Puttaswamy judgment, 2017 |
Establishes privacy as a fundamental right and informs the assessment of legality, legitimate purpose, proportionality and safeguards. |
|
Digital Personal Data Protection Act, 2023 |
Provides a statutory framework for personal-data processing, including children's data, subject to commencement arrangements and applicable rules. |
|
National Education Policy, 2020 |
Supplies the broader policy context for academic flexibility, credit portability and technology-enabled education. |
|
Digital governance and interoperability |
APAAR demonstrates how common identifiers can reduce duplication while increasing the need for strict access controls and purpose limitation. |
|
Transparency and informed consent |
Requires clear information, a genuine option to refuse and protection against coercive school-level implementation. |
|
Accountability and grievance redressal |
Makes it possible for families to correct records, challenge misuse and seek remedies for unlawful processing. |
|
Digital divide and social justice |
Highlights the risks faced by migrant families, disadvantaged households and people with limited digital literacy. |
|
Proportionality and public-service delivery |
Requires the educational benefits of collecting data to be weighed against privacy risks and the possibility of exclusion. |
CONCLUSION
APAAR reflects the promise and the risks of India's expanding digital public infrastructure. Portable academic records can reduce administrative friction, support student mobility and make educational achievements easier to verify. Yet the legitimacy of such a system depends on whether children and their families retain meaningful protection over personal information. The Supreme Court's July 2026 intervention reinforces the principle that consent must include a genuine option to refuse and that administrative schemes remain subject to data-protection obligations.
The wider lesson is that digital governance cannot be judged solely by efficiency, coverage or the number of users enrolled. It must also be judged by the safeguards available to those whose data is collected. In education, where children cannot always assess or challenge institutional demands, the responsibility to prevent coercion and misuse is especially strong. Technology should make educational opportunity more accessible, not make privacy the price of participation.
RELATED READING
PRACTISE QUESTIONS FOR GS2 MAINS
PRACTISE QUESTIONS FOR PSIR
