Clarifications on Users PII Data

[Shakthieshwari]

Hello Team,

In the Portal -> Under Course Progress Exhaust Page, We can get User Exhaust which contains User's PII Data.

Similar to this, Under the Program Dashboard now we should get User Exhaust which contains PII Data for all the projects/observations resource

Jira Ticket Link :- https://project-sunbird.atlassian.net/browse/SB-30235

@sowmya-dixit Can you please help us out, on how to get this data ?

Cc- @aks30, @kiranharidas187, @vijiurs

Thanks

[Shakthieshwari]

Team, Any update on this please ?

[aishwaryashikshalokam]

Dear Pramod

You are right! The program manager does not need an Email Id or Phone No. as per our use case. We used an existing template of course PII data and hence the confusion.
We wanted to understand if we just provide Names in the reports, will it still require the user's consent?

The following fields are actually needed: Program Name, Program Id, Resource Name, Resource Id, UUID, User Name, State, District, Org Name, Block Name, Cluster Name, UserType, User Subtype, School name, School Id

We just noticed that current administrator guidelines say that sharing of Names of registered users does not require consent.
Use Case:

• state officials ( Program managers) want to recognize and appreciate users who have consumed resources in the desired manner. Eg: Completing observations during a given duration, taking up and completing improvement projects, etc.

[pramodkvarma]

Thanks @aishwaryashikshalokam for clarifying. Good to know the conclusion and I am in agreement. Showing name, in general, should be fine unless the name is so unique the real person can be identified just by name.

But again I urge you to ask what's the purpose of having name of user in that report? What does the manager who is looking at report do seeing the names? It's important that showing a field, especially user's personal data, should have a clear purpose. What happens if names are not there, what capability will be lost?

[aishwaryashikshalokam]

Dear @mmanimegalai

As per Pramod's comment Name along with the mentioned fields ( Program Name, Program Id, Resource Name, Resource Id, UUID, User Name, State, District, Org Name, Block Name, Cluster Name, UserType, User Subtype, School name, School Id) will not be considered as a PII.

In our call, I understood that Name in combination with the above-mentioned fields will be.
Can you please clarify so that we can proceed further?

cc: @Prateek-slokam, @kameshbhr, @varsha-sl

[kameshbhr]

@aishwaryashikshalokam Like Pramod mentioned:

1. Name in general is not considered as a PII
2. You should be clear on why the name is required in the report

Based on your previous comment, if the Name is required so that the Program managers can recognize and reward the users, it means they will be able to identify the users with the provided information in the report. So it become a PII.

From our previous experience with Courses, here is what I suggest:

1. Have one report with UUID, State, District etc. (without Name). This can be used for deriving insights about the program execution
2. Have another report which has UUID, Name and any other user information as required. This can be used for identifying the users to provide rewards and recognition.
   For populating the information in the second report, take an explicit user consent. Report should contain the information of only the users who have provided consent.

[aishwaryashikshalokam]

Thank you @kameshbhr , this helps!