Why CBSE’s Payment‑Method Clarification and Cyber‑Attack Response Invite Judicial Review of Administrative Authority and Data‑Protection Duties

The Central Board of Secondary Education has issued a clarification stating that students applying for Class XII answer sheet verification and re‑evaluation are no longer required to make the re‑evaluation fee payments through public sector bank accounts, but may instead utilise a range of online payment options that the board has made available. In addition, the board affirmed that its online portal, which processes these verification and re‑evaluation applications, continues to function smoothly despite having encountered a significant cyber‑attack attempt shortly after the portal’s launch, thereby reassuring applicants of its operational reliability. To date, more than forty‑three thousand applications for answer sheet verification and re‑evaluation have been processed through the portal, demonstrating substantial uptake of the newly clarified payment alternatives and indicating the system’s capacity to handle a large volume of student requests. The clarification further underscores that the board’s decision to accept diverse online payment mechanisms aims to facilitate ease of payment for students across the country, removing the previously perceived necessity of using only public sector banking channels for fee settlement. Overall, the board’s communication conveys that while the online portal remains operationally robust in the face of a cyber‑attack, the flexibility in payment options reflects an administrative adjustment intended to enhance accessibility and convenience for students seeking verification and re‑evaluation of their Class XII answer sheets. By explicitly stating that public sector bank accounts are not mandatory for the payment of the re‑evaluation fee, the board removes any implicit requirement that could have disadvantaged students whose banking facilities are limited to non‑public sector institutions, thereby promoting a broader inclusivity in the fee‑payment process. The board’s assurance that the portal continues to operate without disruption despite the cyber‑attack attempt may also raise questions concerning the adequacy of the board’s cybersecurity measures and the obligations of a public authority to safeguard personal data of applicants under applicable legal frameworks.

One legal question that emerges from the board’s clarification is whether the Central Board of Secondary Education possesses statutory authority to prescribe the specific modes of fee payment for Class XII answer sheet verification and re‑evaluation, and whether such authority is derived from the regulations governing secondary education examinations. If the board’s power to determine payment channels is not expressly conferred by statute, the imposition of a particular payment framework could be challenged on the grounds that it exceeds the board’s delegated jurisdiction and amounts to an administrative overreach subject to judicial review. A court evaluating such a challenge would likely examine the board’s enabling legislation, any pertinent rules, and the principle that administrative bodies must act within the scope of powers expressly or implicitly granted to them by the governing statutes.

Another important legal issue concerns whether the board’s decision to expand payment options and abandon the exclusive requirement of public sector bank accounts aligns with the principles of natural justice, particularly the requirement that administrative actions be reasonable and non‑discriminatory towards applicants. Since the right to education under the relevant statutes includes the procedural guarantee that students shall have reasonable access to examination services, any administrative measure that inadvertently creates barriers to fee payment could be scrutinised as a violation of that right. Consequently, a student adversely affected by a presumed limitation to public sector bank accounts might seek a writ of mandamus compelling the board to recognise alternative payment mechanisms, arguing that the board’s original policy, prior to clarification, failed to provide the requisite procedural fairness.

The board’s acknowledgement that its online portal withstood a significant cyber‑attack attempt also raises legal questions regarding the duty of a public authority to implement adequate cybersecurity safeguards under applicable data protection and information technology legislation. If the board’s security measures are found to be insufficient, affected students could potentially invoke statutory remedies for failure to protect personal data, seeking compensation or an injunction to compel remedial action. Moreover, the principle of proportionality may be applied by a reviewing court to assess whether the board’s response to the cyber‑threat, including any temporary suspension of services, was reasonable and balanced against the right of students to uninterrupted access to examination‑related resources.

In sum, the board’s policy shift and its handling of the cyber‑attack present intertwined administrative‑law and data‑protection challenges that invite judicial scrutiny, with potential outcomes ranging from affirmation of the board’s discretion to directives mandating clearer procedural rules and enhanced security protocols. Students who believe that the clarified payment options remain inadequate or that their personal information was compromised may pursue remedial relief through writ petitions, invoking principles of natural justice, the right to education, and statutory obligations of public bodies to safeguard data.