Privacy experts question Telangana’s app-based degree admissions system: Here’s why

For the academic year 2020-21, the Telangana government is seeking selfies of students as a part of their Degree Online Telangana Services. However, citizens and researchers have raised concerns over the unregulated use of facial recognition by the state government. 

A selfie feature ‘T-App Folio,’ an app-based admission system for Bachelor’s degrees in Telangana, is collecting the facial data of minor candidates who use the app. The terms of use of the app suggest that consent is taken from those above the age of 18. However, several of the app users are, in fact, below 18 years of age. The state government does not take consent of the parents in such cases, and the app assumes that its users are of legal age. 

Even though government officials consider the technology a solution to ease the admission process, advocates point out that in the absence of robust privacy laws, there is no means to govern how the state government uses the student’s data. 

T-App Folio has been designed and developed by the Centre for Good Governance for the Degree Online Services Telangana (DOST) portal and is overseen by the Telangana State Council of Higher Education (TSCHE). The DOST portal introduced the real-time digital face recognition system where students are required to upload their selfies in 2020. The admission portal came into existence in 2016 and began use of biometrics in 2017. The registration under the DOST portal through the app commenced on August 24. 

The ‘Terms of Use’ of the T-App Folio app, where the selfies are taken or uploaded, state that the application will collect data which includes the student’s browser history and settings, the type of browser used and the geolocation. It also states that the application will collect information, which either individually or in combination with other information, can be used to identify the student. 

According to the revised rules for admission, students getting admissions through DOST must have successfully completed their intermediate. The facial recognition technology is applicable only for students who have passed the Telangana State Board of Intermediate Education (TSBIE) exams. 

However, not all those who write the TSBIE exams are of the age of 18, the age of candidates often range between 16 and 18 by the education department’s own admission.  

The app requires the users to register their fingerprints at the MeeSeva centres by submitting their intermediate pass certificate and Aadhaar number. After keying in their Aadhaar number, phone number and the TSBIE hall ticket number, the portal will authenticate their data, in turn, generating a DOST ID. Students then proceed to choose from the options of courses and colleges using this ID.

Professor R Limbadri, Convenor, DOST and Vice-Chairman-I, Telangana State Council of Higher Education, told TNM, “Facial recognition is not a temporary measure. We will try and add new technological features every year.” 

Srinivas Kodali, an independent researcher and advocate for privacy laws, noted that the data of these students often gets exchanged between departments without any legal basis. For the DOST platform to work, the TSBIE shares student data with TSCHE. 

“This kind of exchange is illegal as they don’t seek the approval of the parents before sharing the data and also do not actively inform them of the data being shared,” said Kodali, who questioned as to why people are not informed of this exchange of data. 

Kodali called it “brazenly illegal and an act against Supreme Court orders.” In 2018, a five-judge bench headed by Dipak Misra had held that the right to privacy cannot be impinged without a just, fair and reasonable law. Hence, it asked the Centre to bring in a robust law. However, the Data Protection Bill is yet to be passed by the government. 

He noted that the state government has already started using facial recognition when it comes to pension schemes, driver’s licences and the recently held municipal elections.

Srinivas also drew attention to the Real-Time Digital Authentication of Identity (RTDAI) developed by the Telangana government to authenticate citizens without the need for any hardware at the user’s end. “All of this is done using facial recognition that has no legal sanction,” he added.