NHRC asks ministries, states to inquire into ‘risks’ to children’s privacy in AI tie-up
NEW DELHI: The National Human Rights Commission has issued notices to all states and Union territories, as well as certain central government departments, over alleged risks to children’s privacy arising from a collaboration between a US-based artificial intelligence company and an Indian NGO.
The action follows a complaint which raised concerns regarding a collaboration between the US-based Anthropic and Pratham, an NGO working with children in India, involving the use of an artificial intelligence (Al) system to process children’s handwritten responses and academic data through the “Anytime Testing Machine (ATM)”.
The complainant alleged potential vulnerabilities relating to the collection, processing, storage and possible cross-border transfer of minors’ personal data, raising concerns of data breach and inadequate safeguards. The intervention of the Commission in the matter was sought, as the complainant requested for data protection and appropriate safeguards in the interest of children.
The complaint is filed by the NAMO Foundation, which submitted a report titled “Children’s Privacy at Stake? Assessing Data Breach Risks in the Pratham–Anthropic AI Collaboration under India’s DPDP Act”.
The complaint arises from apprehended risks to children’s privacy and data protection under the Digital Personal Data Protection (DPDP) Act, 2023.
The bench of the Commission, presided over by Member Priyank Kanoongo, observed that while it is important to work on new AI systems, such initiatives must take into consideration the existing education system and comply with education policies and laws in force in India.
Referring to Section 5(2) of the DPDP Act, 2023, the Commission noted that where consent for processing personal data was obtained before the commencement of the Act, the data fiduciary is required, as soon as reasonably practicable, to inform the data principal about the personal data processed, the purpose of processing, the manner in which rights may be exercised and the process for lodging complaints.
The National Human Rights Commission (NHRC) has directed its registry to issue notices to all chief secretaries and UT administrators to inquire into the allegations and ensure that no data collected by Pratham or any other NGOs working with or for the government is misused.
The states and UTs have also been asked to ensure that no data of children violates any provision of the DPDP Act, 2023, or any other Indian law, and to review any memoranda of understanding or alliances entered into with such NGOs.
Notices have also been issued to the secretaries of Department of Higher Education, Department of School Education and Literacy, and the secretary, Ministry of Electronics and Information Technology.
The Commission has sought an ‘action taken’ report within two weeks from the date of receipt of the notice.
Network for Access to Justice and Multidisciplinary Outreach Foundation, in its report had also flagged similar concerns and questioned that from a rights-based perspective, “the questions become whether it is necessary to expose children’s personal data to potential risk of violating their fundamental rights, and who are the ultimate beneficiaries of such collaboration? Apparently not the children”. (PTI)
