Biometric Surveillance And Informational Privacy In Educational Institutions: A Comparative Critique Of India’s DPDP Act And The EU’s GDPR

Author(s): Dr. Sanya Agrawal

Paper Details: Volume 4, Issue 5

Citation: IJLSSS 4(5) 36

Page No: 473 – 486

ABSTRACT

With the advent of technology, schools and universities have replace traditional roll calls with facial recognition turnstiles and fingerprint scanners, calling it a ‘more efficient’ way. What campus administrations pitch as seamless “efficiency” is, in reality, a profound structural shift to breach of privacy rights, through the routine collection of permanent, unalterable biological data as a prerequisite for education or employment. This paper tackles a pressing constitutional crisis like constitutional validity of the act of mandating taking of biometric data from students and employees of an institution from the prospective of Right to Privacy. Referring to the Puttaswamy judgment and the Digital Personal Data Protection (DPDP) Act, 2023 along with the European Union’s GDPR, this study exposes the illusion of choice in hyper-hierarchical spaces. While GDPR bans biometric tracking for mundane administrative tasks by recognizing that a dependent student or employee cannot give “free consent,” DPDP Act takes a riskier path. By erasing the distinction for sensitive data and carving out sweeping exemptions for employers under Section 7(i), the Indian DPDP Act leaves individuals highly vulnerable to state and corporate overreach. Tracking the real-world dangers of function creep, data breaches, and institutional coercion, this article outlines immediate, realistic regulatory firewalls that Indian policy-makers must implement before tracking becomes completely unchecked.

Keywords: Biometric Attendance, DPDP Act 2023, Educational Surveillance, EU GDPR, Facial Recognition, Power Asymmetry, Proportionality, Right to Privacy.

I. INTRODUCTION

Educational Institutes are the spaces of intellectual freedom, open debate, and a kind of civic sanctuary. But over the last decade, a quiet but radical shift has turned these campuses, into heavily monitored digital panopticons, especially in India. The low-tech paper attendance register is quickly becoming a relic of the past and is replaced by an array of computerized tracking tools like facial recognition cameras, fingerprint readers, and iris scanners installed across the campus for the purpose of guarding classroom doors, library gates, and campus entrances.^[1] What administrative bodies originally pitched as a harmless way to streamline record-keeping, check teacher’s absenteeism, and prevent students from signing in for their absent friends (proxy) has hardened into something far more rigid. Today, surrendering your biological data has become mandatory and non-negotiable for attending the classes, sit in the exams or just for keeping your job.

Using permanent biological markers to fix routine administrative problems creates a massive legal and ethical mess. In case of a password, a keycard, or an RFID (radio-frequency identification) badge, when you leave the institute or if you lose it or if it gets in the hands of anyone else, it can easily be erased or changed/ modified or a new card too can be issued. However, your biometrics are unalterable pieces of your physical and informational identity.^[2] If a university’s database is hacked, leaked, or sold, a student or professor cannot simply reset their face, alter their fingerprints, or reconfigure their eyes and hence, the impact can be manifolds, because the stakes are so high and the damage is entirely irreversible. Hence, forcing people to hand over this data requires an incredibly heavy burden of proof and demands absolute legal justification, a genuine public necessity, and a strict commitment to data minimization as was also clarified by the apex court in Puttuswamy Judgment.^[3]

This paper cuts through the administrative convenience to examine whether biometric attendance systems in schools and colleges are actually legally and constitutionally valid. By looking at both public universities and private schools, this study evaluates the impact on two vulnerable groups: the students (both adults and minors) and the staff (including professors and administrative employees). By comparing India’s Digital Personal Data Protection Act, 2023 (DPDP Act) with the European Union’s General Data Protection Regulation (GDPR), this paper exposes the severe gaps in contemporary Indian privacy laws and offers concrete, realistic regulatory firewalls to protect academic spaces from unchecked surveillance.

II. THE CONSTITUIONAL THRESHOLD

This section compares the relevance of privacy rights before Puttuswamy judgment and the paradigm shift after the judgement and the following laws. Moreover, the constitutional prospective of protecting the private rights of individuals and the state’s right to protect public interests and security of the state, has also been discussed. The proportionality tests and the exception to right to privacy given by Justice D.Y. Chandrachud and the rationale behind it aligning it with constitutional rights and balancing the private and public rights is discussed in detail to analyze if the act of educational institutes falls within the proportionality test and can justify the violation of private right to privacy of students and employees for greater public good or better services.

A. THE PUTTASWAMY PROPORTIONALITY TEST

India’s modern privacy laws changed forever with the Supreme Court’s historic, unanimous nine-judge bench ruling in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017).^[4] The apex court outrightly rejected the idea that privacy is a luxury and gave it the status of a fundamental right woven directly into the fabric of Article 21’s Right to Life and Personal Liberty, as well as the broader freedom guarantees of Part III of the Constitution.^[5] While writing the judgment, Justice D.Y. Chandrachud divided the privacy rights into three distinct, non-negotiable pillars: spatial privacy, bodily privacy, and informational privacy. The scope of this paper doesn’t include the detailed discussion of types of privacy hence, only the informational privacy will be discussed here as being crucial for this study.

Informational privacy gives an individual the ultimate say over their own data, (protecting the information that are private to them and should not be shared with anyone including their DNA, fingerprints etc.) preventing the state or private actors from tracking, profiling, or slicing up a person’s life into algorithms without their explicit control. However, while protecting the privacy rights, the Puttaswamy judgment made it clear that it is not an absolute right, but at the same time, the state cannot simply trample over it for administrative ease. Any government intrusion, if any, must satisfy a strict, four-point test of proportionality^[6]:

1. “Legality: The encroaching measure must be backed by an express, enacted statutory law, rather than ad-hoc executive fiats or administrative circulars.
2. Legitimate State Aim: The limitation must serve a legitimate, well-defined public objective.
3. Suitability and Rational Nexus: The nature and extent of the encroachment must bear a direct, rational connection to the stated objective.
4. Necessity and Least Intrusive Means: The measure must represent the least restrictive and least intrusive mechanism available to achieve the desired goal, without disproportionately burdening the citizen.”

When you put the mandatory biometric attendance systems in public educational institutions against this four-point constitutional test of proportionality, the state’s justification falls apart. While recognizing that keeping tabs on teacher absenteeism or ensuring student’s attendance is a legitimate institutional goal but the real breakdown happens at the ‘necessity’ and ‘least intrusive means’ stages. Marking attendance is a minor administrative task, which can be handled perfectly well by using attendance logbooks/ registers, encrypted local sign-ins, or simple RFID identity badges. However, mandating students and faculty to surrender permanent, unchangeable biological templates just to resolve basic absenteeism issue, is the legal equivalent of using a sledgehammer to crack an acorn. It is a massive, disproportionate overreach that inflicts a direct constitutional wound on an individual’s right to informational privacy.

B. THE AADHAAR FRAMEWORK AND JUDICIAL PRECEDENTS

In a subsequent ruling by the Supreme Court’s Constitution Bench on validity of Adhaar Act and its provisions, in the case of Justice K.S. Puttaswamy (Aadhaar-5J) v. Union of India (2019)^[7], the court struck down Section 57 of the Aadhaar Act, 2016^[8], which had given private corporations a free hand to mandate biometric authentication onto individuals through standard commercial contracts. The Bench made it clear that letting private employers or commercial entities compel people to hand over their biometric information, without a clear, formal statute backing was entirely ultra vires to the Constitution. Additionally, the court also struck down the mandatory Aadhaar ID requirements for school admissions. The judges pulled no punches here, observing that a child cannot be locked out of their fundamental right to education under Article 21A^[9] just because they or their parents refuse to provide their biological information or Aadhaar card details.^[10]

Yet, despite these crystal-clear constitutional boundaries set forth by the apex court, educational regulators across India continue to look the other way persistently, forcing Aadhaar-Enabled Biometric Attendance Systems (AEBAS) and facial recognition tracking onto campuses. On one side of the coin, state health departments and the National Medical Commission (NMC) issued aggressive directives forcing biometric and GPS tracking on medical college faculty, this intrusive policy was actually upheld by the Patna High Court in 2026, calling it a step towards ‘good governance’ to stop government doctors from running private clinics during official hours, which is not legally allowed.^[11]

On the other side, however, the Delhi High Court and the Supreme Court have taken a far more skeptical stance. Higher courts have increasingly questioned regulators over heavy-handed circulars like the Bar Council of India’s (BCI) 2024 mandate forcing blanket biometric surveillance and campus-wide CCTV monitoring across all law schools affiliated with it. These courts are beginning to call out what institutional administrations ignore: that wrapping an academic campus in a digital dragnet exerts a severe, suffocating chilling effect on the very intellectual debate and political dissent that universities are supposed to protect.^[12]

III. STATUTORY PROVISIONS: INDIA’S DPDP ACT, 2023 V. THE EU GDPR

The comparison between the statutory provisions of India’s DPDP Act and EU’s GDPR can be shown clearly through a table. This table shows how the laws of EU focus more on the protection of biometric information of the individuals by categorizing it as ‘Special Category Personal Data’, while in India there is no such division or classification between the data which is collected using biometric information and the personal data i.e. same protection is given to the passwords set by any individual with the biometric information. However, the protection provided to the minors are better in India, by keeping a uniform age of minority through-out the laws of the country.^[13]

Table 1

A. THE GDPR PARADIGM: CATEGORICAL PROHIBITION AND STRICT ENFORCEMENT

The European framework operates on a foundational, precautionary aspects of biometric tracking. Under Article 9(1)^[14] of the GDPR, processing biometric data to uniquely identify a human being is flatly prohibited by default. It is not an open door but a locked gate but with certain exceptions. For an educational institution to walk past this prohibition, it must fall under the exhaustive list of exceptions mentioned in Article 9(2), these include: proving a ‘substantial public interest’ backed by specific member state’s domestic laws under Article 9(2)(g)^[15], or securing ‘explicit consent’ under Article 9(2)(a)^[16]. Even the application of these exceptions are done strictly and rarely institutes get permissions for use of biometric information.

European data regulators and administrative courts have consistently weaponized these strict standards against over enthusiastic educational institute’s boards, routinely striking down campus biometric attendance systems as illegal overreaches. Two of such cases has been discussed in this paper for a better understanding:

The first case is commonly known as ‘the Skellefteå High School Decision’ (Sweden, 2019)^[17]. This was Sweden’s very first financial penalty case under the GDPR, the Swedish Data Protection Authority (IMY^[18]) slapped a 200,000 SEK^[19] fine on a municipal school board^[20] for running a facial recognition pilot project to track 22 students as a trial, for over a short three-week window.^[21] The school board argued they had collected parental consent forms, but the regulator flatly rejected this argument. The IMY ruled that because of the huge, structural power disparity between a school administration and its students, consent can never be considered “freely given” as provided under Article 4(11) and Recital 43^[22] of GDPR. On top of that, the authority made it clear that facial scanning completely mocked the data minimization principle under Article 5(1)(c)^[23], since a teacher/ faculty simply doing a traditional roll call was a perfectly effective, non-intrusive alternative.

Another case on the similar lines was, ‘the Nice and Marseille Lycées Ruling^[24] (France, 2020). In late 2019, France’s data protection watchdog, the CNIL^[25], stepped in to block a local municipal council’s plan to install biometric facial recognition turnstiles at the main entrances of two high schools – Lycée Les Eucalyptus in Nice and Lycée Ampère in Marseille^[26]. The CNIL held that building biometric gates to manage mundane student traffic was wildly disproportionate to the actual problem. Later in February 2020, when the Administrative Court of Marseille formally struck down the project. The court ruled that the inherently coercive nature of guarding a school entrance damages any claim that the students were offering genuine, voluntary consent.

B. THE DPDP ACT, 2023: STRUCTURAL LOOPHOLES AND REGULATORY GAPS

While the GDPR builds high defensive walls around biological markers, India’s Digital Personal Data Protection (DPDP) Act, 2023 takes a sharp turn in the opposite direction. The law completely abandons the tiered approach pioneered by the Justice B.N. Srikrishna Committee Draft (2018)^[27], which had spent considerable effort defining and protecting ‘sensitive personal data’. Instead, under Section 2(t)^[28], the DPDP Act flattens the entire landscape, treating all digital personal data with the exact same broad brush. This horizontal flattening is highly problematic as it creates a bizarre legal fiction where a person’s routine email address or phone number is textually equated with their permanent, algorithmic facial vector.

By stripping biometrics of its inherent biological gravity, the DPDP Act carves out some loopholes within the daily operations of schools and universities:

• The Section 7(i) against the employees: For university faculty and administrative staff, the right of choice is entirely stripped away by Section 7(i). This clause grants institutions as ‘Data Fiduciaries’ a safe harbor by allowing them to process personal data without any consent whatsoever if it is used for “the purposes of employment” or to “safeguard the employer from loss or liability.” With this, educational managements now hold unfettered legal leverage as they can simply claim that facial scanning turnstiles are a vital business necessity to prevent ghost faculty or salary fraud. Because the statute bypasses consent entirely, professors and staff are left with no legal standing to object, let alone demand less intrusive options like RFID cards.
• The Section 9 Mirage for School Students: Theoretically, Section 9(1)^[29] looks like a fortress for minors, mandating schools to secure verifiable parental consent before touching any data belonging to someone who is a child/ minor. Furthermore, Section 9(3)^[30] puts an absolute statutory ban on tracking, profiling, or behavioural monitoring of children. But when a school mount an automated facial recognition camera to scan hallways or mark attendance, it is engaging in continuous, algorithmic surveillance of students, which is a clear violation of Section 9(3). However, the real problem lies in the enforcement because schools and colleges are rarely designated as ‘Significant Data Fiduciaries’^[31] under Section 10, and hence, they are completely exempt from conducting mandatory Data Protection Impact Assessments (DPIAs) or appointing dedicated Data Protection Officers (DPOs). So, even if the law bans the behaviour of the institutions, it still exempts the institutions from the very auditing tools needed to catch it.

IV. POWER ASYMMETRY AND ILLUSON OF CONSENT

The absolute biggest flaw in how both private colleges and state universities justify biometric tracking is the legal fiction of “voluntary consent”. If you look at foundational constitutional and contract theory, valid consent is not just a signature on a dotted line. It requires true individual autonomy, relatively equal bargaining power and most importantly, the realistic ability to say ‘no’ without any severe consequences.

However, looking at the educational institutions, that genuine choice completely vanished when someone takes admission or employment. For students, refusing to hand over a fingerprint or a facial template isn’t just a minor administrative choice but it frequently triggers severe, heavy-handed sanctions. Students who object are marked absent, locked out of examination halls, stripped of state scholarships, or denied campus housing. These consequences or the possibility of them, puts a student in a state of deep vulnerability and subordination to the university administration as the power balance is entirely one-sided.

Looking at the same position from prospective of teachers, professors, lecturers, and administrative staff, the story is the same. For them, submitting to biometric capture is jammed into employment contracts as an unalterable condition of service. If a faculty member stands up for their privacy, the response is swift and financial including unfavourable working environment, salary deductions, disciplinary memos, or outright termination. Hence, in these hyper-coercive settings, biometric enrolment cannot be termed as “freely given”, or considered as “affirmative action”. It completely hollows out the spirit of Puttaswamy and reduces a landmark fundamental right to a dead letter on a page.

V. ARCHITECTURAL DANGERS ACROSS THE INSTITUTIONS

Normalizing biometric systems across schools and colleges is not merely a simple digital upgrade to the morning roll call. When an institution forces its community to exchange biological templates for administrative access, it locks them into a flawed technological architecture plagued by different vulnerabilities.

Biometric information captured for a small task like proving a student’s attendance in a lecture hall or a professor clocked in on time inevitably expands into other administrative areas. Institutes generally use a third-party software-as-a-service (SaaS) like EdTech firms, AI-driven exam proctoring programs etc. and share the information with them as well. Now, because India lacks strict, legally binding data-siloing mandates, these permanent biological signatures can easily be turned into commercial tracking assets or tools for state surveillance. This expanding surveillance web is facing growing resistance in higher education. In Prakruthi Jain v. Bar Council of India (2026), the Supreme Court took up a direct constitutional challenge against regulatory circulars that forced law universities to deploy mandatory biometric attendance, campus-wide CCTV networks, and third-party criminal background checks. The petitioners argued that passing student data to outside commercial intermediaries creates a highly volatile ecosystem with zero structural safeguards. The apex court noted that these intrusive measures demand intense constitutional scrutiny because they risk turning open university campuses into closed surveillance zones.

Educational institutions across India are notorious for operating on underfunded, fragile IT infrastructures. When the biometric registries are available unencrypted to the local servers or are managed by unregulated third-party contractors, the loss can be irreversible as with breach of password, it can be changed but that is not possible with biometrics and the individual can be exposed to crimes like identity theft, synthetic deepfake impersonation, and fraudulent biometric spoofing across banking networks and state welfare platforms.

Additionally, facial recognition models carry documented error rates and biases, especially when scanning darker skin, diverse gender identities, and evolving facial structures and if due to this technical glitch someone gets rejected, it can result into humiliation, denial to sit for examination, midday meal, or trigger some disciplinary investigation. The Supreme Court also warned in the landmark Aadhaar-5J (2019) decision that state cannot use broad anti-fraud measures to treat every ordinary citizen as a suspect. Mounting biometric cameras inside an educational institution, without any evidence of misconduct, represents a wildly disproportionate response that violates the basic dignity of students and teachers alike. Similarly, in Mrs. R. Annal v. State of Tamil Nadu (2019)^[32], a government schoolteacher attempted to use the fundamental right to privacy to opt out of the Aadhaar-Enabled Biometric Attendance System (AEBAS). The Madras High Court flatly rejected her plea, ruling that the right to privacy cannot be used by public servants to block state efforts to improve school administration. The court declared that implementing biometric tracking to ensure teachers are actually in their classrooms qualifies as a reasonable measure of “good governance”. This creates a sharp jurisprudential divide: while the apex court remain deeply concerned about systemic data leaks and the erosion of campus freedoms, different high courts frequently protect biometric tools if they are framed as simple instruments for workplace accountability.

VI. RECOMMENDATIONS FOR INDIA

To prevent Indian campuses from permanently turning into unchecked surveillance hubs under the vague provisions of the DPDP Act, 2023, the Union Government, the University Grants Commission (UGC), and school regulatory bodies must establish clear regulatory guidelines. Some of the recommendations are suggested by the author below to improve the path of India’s educational landscape:

• The UGC and the Ministry of Education must issue a joint binding circular declaring that biometric tracking cannot be made a mandatory condition for admission or employment and no adverse actions should be taken against a student or employee opting out from method of giving up their biological data. Institutions must provide equally efficient, non-surveillance alternatives without any professional or academic penalty.
• Alternatives that can be opted by the institutions are: (i) scanning of a localized, encrypted rolling QR Codes in classrooms using a privacy-focused campus app. This code updates every 10 seconds and verifies presence via localized Bluetooth or campus Wi-Fi, without collecting permanent facial vectors; (ii) cryptographic RFID smartcards: which log entry without saving physical templates in a central database.
• Under Section 10 of the DPDP Act, the Central Government has the power to label specific entities as Significant Data Fiduciaries (SDF) based on the volume of data they handle and the potential risk to public order. Any university system, state education board, or K-12 school chain^[33] that manages more than 10,000 active students or staff should be automatically classified as an SDF. This will force big institutes to conduct independent, annual Data Protection Impact Assessments (DPIAs), hire an external Data Auditor, and appoint a Data Protection Officer (DPO). This checks schools from deploying cheap, unencrypted third-party facial recognition software without considering the long-term privacy risks.

• If an institution absolutely insists on using biometrics for specialized security areas like high-clearance research labs or women’s hostels, it must ban the use of centralized biometric databases because these servers act as massive digital targets for hackers. Instead, Indian regulations should mandate a Decentralized Edge-Storage Architecture, commonly known as Match-on-Card technology. In this, the student’s mathematical fingerprint or facial template is encrypted and stored exclusively on a physical microchip embedded inside their personal identity card, when the student swipes their card at a door, the scanning terminal performs a local comparison on the card itself. So, the university database never sees, collects, or stores the biological signature hence, if the university’s network is hacked, zero biometric data is exposed because there is no central database to steal.
• Section 9(3) flatly prohibits any data processing that involves tracking or monitoring the behaviour of children. The National Commission for Protection of Child Rights (NCPCR) must issue a clear directive stating that mounting automated facial recognition cameras in school corridors, playgrounds, or classrooms constitutes unlawful behavioural tracking. The only legally compliant path for schools under Section 9 is a complete ban on continuous facial monitoring, limiting any student tracking to legacy roll-calls or basic tap-in identity cards.
• To prevent historical data accumulation and the commercial monetization of student records, data retention must be strictly capped. Regulatory bodies must enforce a mandatory “Right to be Forgotten” upon institutional separation. When a student graduates, drops out, or an employee resigns, the institution must completely delete their digital and biometric profile from all active files and backups within 30 days and must issue a verified, legally binding certificate of deletion to the departing individual. This ensures that a person’s biological template does not sit indefinitely on an unsecured university server years after they have left the campus.

VII. CONCLUSION

The normalization of biometric surveillance within schools and universities represents a profound, worrying shift in how young citizens learn to interact with authority. When educational institutes condition a student’s education or a professor’s livelihood on the surrender of their biological markers, they are doing something far worse than just updating their record. They are conditioning an entire generation to accept continuous, invasive surveillance as an inevitable, unquestioned tax on modern life. While the European Union has recognized this psychological and democratic peril under the GDPR, India currently stands at a critical, defining crossroads. To truly honour the constitutional pledge laid down in Justice K.S. Puttaswamy, Indian data jurisprudence must abandon its uncritical, dangerous infatuation with administrative efficiency. True governance cannot be built on the backs of stolen privacy. By enforcing a rigorous, unforgiving application of the proportionality doctrine, carving out explicit statutory protections for biological signatures, and legally guaranteeing non-intrusive, privacy-respecting alternatives, India can ensure its centres of learning remain what they were always meant to be: vibrant nurseries of democratic freedom, rather than quiet incubators for a dystopian surveillance state.

[1] Internet Freedom Foundation (IFF), ‘Privacy Marked Absent: Biometric Surveillance in Indian Educational Institutions’ (Policy Report, October 2024).

[2] European Data Protection Supervisor (EDPS), ‘Guidelines on Facial Recognition in Public and Educational Spaces’ (2020/C 64/04).

[3] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (Supreme Court of India).

[4] Id.

[5] The Constitution of India 1950.

[6] Modern Dental College and Research Centre v. State of Madhya Pradesh, (2016) 7 SCC 353 (Affirmed in Puttaswamy).

[7] Justice K.S. Puttaswamy (Aadhaar-5J) v. Union of India, (2019) 1 SCC 1 (Supreme Court of India).

[8] Act not to prevent use of Aadhaar number for other purposes under law: Nothing contained in this Act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or anybody corporate or person, pursuant to any law, for the time being in force, or any contract to this effect.

[9] The State shall provide free and compulsory education to all children of the age of six to fourteen years in such manner as the State may, by law, determine.

[10] Mrs. R. Annal v. The State of Tamil Nadu, Writ Petition (MD) No. 8990 of 2019 (Madras High Court).

[11] Bihar State Medical Teachers Association v. State of Bihar, 2026 LiveLaw (Pat) 42 (Patna High Court).

[12] Delhi Prosecutors Welfare Association v. Government of NCT of Delhi, 2026 LiveLaw (Del) 784 (Delhi High Court).

[13] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR).

[14] Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

[15] Paragraph 1 shall not apply if one of the following applies: processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

[16] Paragraph 1 shall not apply if one of the following applies: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject.

[17] In re Skellefteå Municipality Upper Secondary Education Board, Swedish Data Protection Authority (Datainspektionen), Case No. DI-2019-2226 (20 August 2019).

[18] Integritetsskyddsmyndigheten – this is the official name of the privacy protection authority of Sweden.

[19] Sweedish Krona (1 SEK = 9.75 Indian Rupees, on 20 September 2026).

[20] Skellefteå Municipality Upper Secondary Board.

[21] Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY), ‘Decision on Facial Recognition Used to Monitor the Attendance of Students in Skellefteå Municipality’, Ref. No. DI-2019-2221 (20 August 2019).

[22] ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

[23] Personal data shall be: adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)

[24] La Quadrature du Net, Ligue des Droits de l’Homme v. Région Provence-Alpes-Côte d’Azur, Tribunal Administratif de Marseille [Administrative Court of Marseille], Case No. 1901490 (Feb. 27, 2020).

[25] National Commission on Informatics and Liberty.

[26] Commission Nationale de l’Informatique et des Libertés (CNIL), ‘Délibération relative à l’expérimentation de la reconnaissance faciale dans les lycées de Nice et Marseille’, Décision No. 2019-138 (28 October 2019); Affirmed by Administrative Court of Marseille, Judgment No. 1901249 (27 February 2020).

[27] Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, ‘A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians’ (Ministry of Electronics and Information Technology, Government of India, 2018).

[28] “Personal data” means any data about an individual who is identifiable by or in relation to such data.

[29] The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.

[30] A Data Fiduciary shall not undertake tracking or behavioral monitoring of children or targeted advertising directed at children.

[31] Section 2(z): “Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10.

[32] Mrs. R. Annal v. State of Tamil Nadu, (2019) SCC OnLine Mad 1272.

[33] K-12 school chain is a corporate or managed network of multiple private schools operating under a single brand, centralized administration, and standardized curriculum, covering education from Kindergarten (K) through the 12th grade.