Education Sector Hotline
September 23, 2021
Blockchaining Education - Legal Nuances to Know!
The last few years have seen an unprecedented increase in the use of technology across sectors. The education industry in particular has adapted well to this change. It has integrated technology almost seamlessly into its existing frameworks, both for the delivery of course content and ancillary objectives like administrative tasks and solutions for paying fees. One such new, upcoming and revolutionary technology is blockchain, which offers potentially great solutions to the education sector, for storing certificates, verification of credentials, rewarding students for task completion and intellectual property management, et al.
What is blockchain?
Fundamentally, a blockchain is a decentralised network facilitating transactions between multiple participants usually across different locations. It stores a record of all transactions which occur on it in separate “blocks”. It is ‘decentralised’ because these records are distributed across devices of each participant in the network, and no single entity controls the network, unlike traditional databases. In the case of public blockchains, this data can be accessed by anyone with an internet connection, while private blockchains generally require participants to provide a security key before they can access the blockchain database.
Blockchain offers a unique way for securing data through a decentralized system, and this storage is immutable in nature, meaning that data once stored on the blockchain cannot be removed, tampered with or altered by third parties. For instance, if a document is stored on a blockchain network in block “A”, a change made to this document would create an entirely different block “B”, making it possible to identify and track all changes made to the document in a secure manner.
Although blockchain came into vogue primarily as part of cryptocurrencies like Bitcoin, the distributed manner of storing information used by blockchain systems has several other uses which go much beyond payments and trading.
How can it be used in the Education Sector?
The need to expand use blockchain technology in the education sector has been acknowledged by the government in the National Education Policy, 2020 (“NEP”). The NEP lists blockchain as one of the emerging technologies which will likely gain prominence in the education sector in the near future.1
Legal and Regulatory Challenges
Privacy and Data Protection
Widescale adoption of blockchain technology will certainly revolutionise the existing framework of the education sector. However, considering that this will involve the storage of highly sensitive personal data of students on a decentralised network, educational institutions should ensure that they take all possible measures to protect the information of their students on the blockchain. The current regulatory landscape on data protection in India is governed by the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (“SPDI Rules”). The SPDI Rules define sensitive personal data to include information such as financial information, medical records, biometric information, etc. Under the SPDI Rules, body corporates which collect, receive, possess, store, deal or handle sensitive personal data of others, in an electronic form, must follow the requirements under these rules, which inter alia include obtaining consent for collecting such data from the providers of information and refraining from retaining the sensitive personal data for longer than required for the purpose of such collection.
The SPDI Rules will likely be applicable where data about student identities and degree certificates is made available on the blockchain. This is because such data is could include , biometric information and financial data, which is treated by the SPDI Rules as “sensitive personal data
The SPDI Rules also mandate that certain reasonable security practices are to be established when sensitive personal data is collected. The SPDI Rules further provide certain examples of standards which would be considered sufficiently reasonable.10 Where universities are relying heavily on the blockchain to store student data, there is no clarity if such standards under the SPDI Rules can be considered to be satisfied. This is because these requirements under the SPDI Rules have been targeted at systems which store personal data in a single location. However, data on blockchains are stored in a decentralised and distributed manner, meaning that it may be practically impossible to implement these specific security standards in the systems of all participants on the blockchain network.
Spill-over effects of a potential cryptocurrency ban
Recently, it was reported that, pursuant to an Inter-Ministerial Committee recommendation of 2019, the Indian government is considering a ban on dealing with all private cryptocurrencies.11 However, in this context, the latest statement of the Finance Minister has been that “a futuristic thing can’t be shut out”.12 The matter is reportedly pending consideration of the Union Cabinet.13 A ban on cryptocurrencies may affect digital assets, including those generated by MOOCs such as BitDegree to reward students completing tasks successfully, as well as a pioneering program like that of the MSBSD, as discussed above.
Experts have opined that it may be difficult to separate blockchains from cryptocurrency.14 This is because blockchains usually reward participants on the chain for expending energy to authenticate transactions by giving them crypto assets. Without such crypto assets, participants on the chain may not be incentivised to validate entries in the distributed blockchain ledger. Hence, a potential ban on cryptocurrencies may severely limit the use of blockchain technology for many of the purposes outlined above.15 One such example of a system which may be negatively impacted by a ban on cryptocurrency is that of the recent solution for certificate verification introduced by the Maharashtra State Government discussed above. Since this solution uses Ethereum, a public blockchain which relies on cryptocurrency to function, a crypto ban is likely to impede this initiative and restrict access to the certificates uploaded on the blockchain.
Though the data storage and verification on the blockchain has been touted to be one of the most secure means ever devised, cybersecurity vulnerabilities are not entirely eliminated. For instance, there have been several recent situations where hackers gained unauthorised access to information on the chain, and exploited the information contained therein.16 Though this is technically more difficult to achieve than by hacking traditional centralised systems, blockchain networks do have some vulnerabilities which may be exploited. For example, where blockchain networks rely on a majority consensus mechanism (meaning that a transaction on the blockchain is authenticated if more than 50% of the computing power of the network has authorised it), it would be possible for hackers to take over this system by gaining control of more than half of all the computing power on the network. This could have disastrous results where universities and other educational institutions rely on the blockchain to store and authenticate student information especially where the personal data of students is concerned
To manage the risks presented by such eventualities, universities should implement strong cybersecurity frameworks including negotiating contractual protections with other participants and undertaking continuous monitoring of the network for security incidents.17 In addition, such institutions should also ensure that they comply with requirements under the Information Technology Act, 2000 of India and similar laws which require body corporates to report unauthorised uses of computer resources to the relevant authorities within a reasonable timeframe.18
The blockchain technology offers significant advantages to the education sector across the globe and could significantly decentralise and democratise access to education. In India, particularly, the opportunities offered by blockchain technology in the sector are only beginning to be explored by the government and private players alike. This also offers opportunities for new and allied business models in the education space.
Further, the government has presented a positive outlook towards the use of blockchain technology for improving education in the country under the NEP. We foresee more acceptability and adoption of blockchain in education in the new future.
You can direct your queries or comments to the authors
1 National Education Policy, 2020 at page 56, https://www.education.gov.in/sites/upload_files/mhrd/files/NEP_Final_English_0.pdf (last accessed on September 21, 2021).
2 Andrew Tobin, Jamie Smith, Self-Sovereign Identity for Higher Education, https://www.evernym.com/blog/self-sovereign-identity-higher-education/(last accessed on September 21, 2021)
3 Elizabeth Durant, Alison Trachy, Digital Diploma debuts at MIT, https://news.mit.edu/2017/mit-debuts-secure-digital-diploma-using-bitcoin-blockchain-technology-1017 (last accessed on September 21, 2021)
4 NITI Aayog Draft Discussion Paper, Blockchain: The India Strategy, January 2020.
5 Ledger Insights, Indian state government launches blockchain educational certificates, ledgerinsights.com/indian-state-government-launches-blockchain-educational-certificates/(last accessed on September 21, 2021)
6 Rachel Wolfson, US Education Department Promotes Putting Student Records On Blockchain https://cointelegraph.com/news/us-education-department-promotes-putting-student-records-on-blockchain (last accessed on September 21 , 2021).
7 https://www.bitdegree.org/ (last accessed on September 21, 2021)
8 https://ledgerjournal.org/ojs/ledger/about (last accessed on September 21, 2021)
9 Universities Accept Bitcoin Payments to Ease the Burden on International Students, https://www.analyticsinsight.net/top-universities-and-schools-accepting-bitcoin-payments/ (last accessed on September 22, 2021)
10 IS/ISO/IEC 27001 standards on Information Technology - Security Techniques - Information Security Management System – Requirements
11 The Indian Express, RBI plans and an upcoming Bill: Where are digital currencies headed? https://indianexpress.com/article/explained/cryptocurrency-bitcoin-rbi-7285249/ (last accessed on September 21, 2021)
12 Hindustan Times, On Cryptocurrency, Sitharaman Says 'We Have To Be Cautious But Think It Through', https://www.hindustantimes.com/business/on-cryptocurrency-sitharaman-says-we-have-to-be-cautious-but-think-it-through-101632189095218.html (last accessed on September 22 , 2021)
13 Economic Times, Waiting for Cabinet approval, says FM Nirmala Sitharaman on bill on cryptocurrency, https://economictimes.indiatimes.com/news/economy/policy/waiting-for-cabinet-approval-says-nirmala-sitharaman-on-bill-on-cryptocurrency/articleshow/85372886.cms?from=mdr
14 Russia’s Crypto Ban Would Stifle Blockchains, https://news.bitcoin.com/buterin-ban-russia-stifle-blockchains/ (last accessed on September 21, 2021)
15 Note: Initiatives like SuperCert may not face this issue, since they rely on a private/permissioned blockchain, meaning that all participants on this chain can be identified by the central authority. The spillover effect may hence be a significant issue only where universities are taking resort to public blockchain structures. See https://www.steptoe.com/images/content/1/8/v2/189187/Cybersecurity-Tech-Basics-Blockchain-Technology-Cyber-Risks-and.pdf(last accessed on September 21, 2021)
16 MIT Technology Review, Once Hailed As Unhackable, Blockchains Are Now Getting Hacked, https://www.technologyreview.com/2019/02/19/239592/once-hailed-as-unhackable-blockchains-are-now-getting-hacked/ (last accessed on September 21, 2021)
17 https://www.steptoe.com/images/content/1/8/v2/189187/Cybersecurity-Tech-Basics-Blockchain-Technology-Cyber-Risks-and.pdf (last accessed on September 21, 2021)
18 See Reporting cybersecurity breaches in India – Is it time to overhaul the law?,by Aparna Gaur, Aarushi Jain, Gowree Gokhale and Dr. Mihir A. Parikh, available at https://www.natlawreview.com/article/reporting-cybersecurity-breaches-india-it-time-to-overhaul-law (last accessed on September 21, 2021).
The contents of this hotline should not be construed as legal opinion. View detailed disclaimer.