NEET data of 2.5 lakh students compromised: Who's responsible?

Of the 1.3 million candidates who appeared for the National Eligibility Cum Entrance Test (NEET) this year, data for 2,50,000 students is available for anyone willing to shell out lakhs of rupees for access to this data.

Photograph*: Phil Noble/Reuters

In yet another case of potential breach of privacy, data of students who took the National Eligibility Cum Entrance Test this year is available for buyers through a website.

The website (name withheld till it's taken down) claims to have access to records of 2,50,000 students along with their gender, roll numbers, rank in the exam as well as their mobile numbers.

NEET is administered by CBSE as the entrance exam for medical colleges across the country.

More than 1.3 million candidates appeared for the exam this year out of which data for 2,50,000 students is available for anyone willing to shell out lakhs of rupees for access to this data.

Even as this raises serious concerns about privacy and data protection rights of students whose data is being sold along with their phone numbers, the person behind the website claims that he runs a legitimate business and owns this data.

Praveen Chowdary, chief executive officer of the company, spoke to Business Standard and explained the process of collecting data. He said that the company collects data directly from students through various means among which social media advertising is the biggest source of data.

The company claims to run ads on Facebook where students are encouraged to provide their details to get help from career counsellors.

Chowdary said that students are more than happy to provide their ranks as well as their contact details in order to get free help from career experts about their future.

However, what's left unsaid in this transaction is that Chowdary's company uploads this data on their website for people to see and those who pay Rs 1,00,000 are able to access the complete database with phone numbers unmasked. 

"We get a lot of demand from education companies who are seriously into the business of helping students or selling them their test preparation products. These companies use our service to contact these students through text messages which are enabled through our platform," Chowdary said.

The company's online dashboard access costs Rs 1,00,000 to view all records of NEET.

After that, the buyer of the data can choose to send mass promotional messages to phone numbers listed in the data through the company's service. People can even drill down their target market by state and choose to contact students from only specific states. Nari Technologies offers 100,000 free SMS after which one needs to pay Rs 14,000 more to buy another 100,000 messages.

Chowdary said that the company moved to this SMS model after facing backlash last year for providing phone numbers freely which could be misused even by companies not in the education space.

"People online can only see seven out of ten digits of students' phone numbers and even after signing up, they can't copy this data but can only send SMS through our platform. That's how we make money," he said.

At a time when the debate on privacy and data protection is on full steam in the country with a panel headed by Justice Srikrishna set to draft a privacy bill, the website's use of people's private information comes as a major threat to privacy, experts say.

"This is absolutely wrong. You need to ensure that people know that their data will be sold before they provide it. There aren't enough laws to act against these instances and that's why people have been asking for a privacy law," said Raman Chima, Policy Director, AccessNow.

Chima said these instances are potentially covered by bits of existing laws but someone needs to complain and seek damages but that rarely happens now.

"The legal framework is not good enough right now even though this activity is in direct contravention of Trai regulations as well as the right to privacy," he said.

Chowdary also accepted that he doesn't seek explicit permission from people before collecting their data to sell it to commercial entities.

"To be honest, we don't ask people if they are okay with their data being sold commercially to other entities but it is understood by everyone that if they are providing their data, it will be given to specific people who may contact them offering their services," Chowdary said.

This is not the only source of data for the company. Chowdary said that he collects data at school level too by offering free mock tests to students. These mock tests require students to provide their contact details and other information which is used by the company to build and aggregate databases even as students are unaware that their data will eventually be sold for lakhs of rupees.

"Students are happy to provide their information because our mock tests are free and we even mark those tests and get back to them with their results," Chowdary said.

The company boasts of many other databases such as a repository of final year students of engineering across the country. It also provides services such as "transactional SMSes" which can reach even those people who have registered for the do-not-disturb service, in direct contravention of guidelines issued by the Telecom Regulatory Authority of India.

*Lead image used for representational purposes only.