Experts say that the Criminal Procedure (Identification) Bill, which widens the ambit of data collection to include iris and retina scans, biological samples and more, undermines the privacy of ordinary citizens.

Technician performing an iris scan: Why the Bill allowing police to store biometrics should worry youImage for representation: Wikimedia Commons/Biswarup Ganguly
Atom Law Friday, April 01, 2022 - 09:33

The Union government on Monday, March 28, introduced the Criminal Procedure (Identification) Bill, which gives the police legal sanction to take physical and biological samples of convicts as well as accused persons. It seeks to replace the Identification of Prisoners Act, 1920, which only allows recording of fingerprint and footprint impressions of a limited category of convicted persons. The Bill seeks to vastly widen the ambit and scope of the 1920 Act.

In the Bill’s Statement of Objects and Reasons, Home Minister Amit Shah claims this is necessary to “help the investigating agencies to gather sufficient legally admissible evidence and establish the crime of the accused person”. Despite the Opposition raising concerns at the time of the Bill’s introduction, Minister of State for Home Affairs Ajay Teni dismissed apprehensions and said the move was required to make provisions for the use of modern techniques to capture and record appropriate body measurements.

What the bill contains

What will be collected: The “measurements”, as the Bill terms, include finger impressions, palm-print and footprint impressions, photographs, iris and retina scan, physical, biological samples and their analysis, and behavioural attributes including signatures and handwriting. The Bill also provides for any examination under Criminal Procedure Code (CrPC) sections 53 or 53A, pertaining to the medical examination of an arrested person.

Whose data can be collected?

The Bill states that anyone who has been convicted of a punishable offence, ordered to give security for good behaviour or maintaining peace, arrested in connection with a law under a punishable offence, or detained under any preventive detention law shall, if so required, allow his ‘measurement’ to be taken by a police officer.

The person can refuse to allow the taking of biological samples for any offence except those committed against a woman or a child or for any offence punishable with imprisonment for a period not less than seven years. Apart from the above, a Magistrate can also direct any individual to submit to their sample being taken, if required for the purpose of any investigation under the CrPC.

The Bill also has a clause that if any person who is required to allow for their measurements to be collected does not do so, the police or prison officer in question can take them “in such manner as may be prescribed”. Resisting the same will become an offence under Indian Penal Code (IPC) Section 186, which pertains to obstructing public servants in the discharge of public functions.

Who will collect the data, and for how long?

All the data that has been collected will be stored with the National Crime Records Bureau (NCRB) for the purpose of “prevention, detection, investigation and prosecution”, and it will collect the records from state governments, the administrations of union territories or other law enforcement agencies. All data and samples collected will be stored at the national level, processed with relevant records, and given to any law enforcement agency as prescribed. 

The Bill currently states that measurements can be retained for 75 years after it has been collected, and has to be stored digitally or electronically. The only time the Bill allows for the destruction of this data is if a person has not been convicted previously and their samples were taken, but they were released without trial/discharged/or acquitted by the court after exhausting all available legal remedies. After this, the Magistrate shall provide reasons and direct for samples pertaining to that individual to be destroyed.

Concerns regarding the Bill

Member of Opposition Manish Tewari had flagged in Parliament that the Bill goes against the right against self-incrimination as well as the Right to Life under the Constitution. In addition, the Bill did not go through a public consultation process before it was introduced. In a statement, the Internet Freedom Foundation (IFF) said that the Bill “tremendously undermines the privacy of ordinary citizens and undertrials”.

Experts also point out that the Bill needs to meet the thresholds set by the Right to Privacy judgement. Anushka Jain, Associate Counsel (Surveillance and Transparency) at the IFF, told TNM: “The Bill should have gone through a consultation process, which did not happen. Besides, any Bill that involves data collection in any manner has to comply with the Right to Privacy decision of the Supreme Court, which says that it should be necessary and proportionate to what the government is trying to do. Collecting such a large amount of data is neither necessary nor proportional. It is not proportional to hold it for 75 years either.”

Another concern is that the Bill does not talk about safeguards for the protection of the data collected. Prasanth Sugathan, Legal Director at the Software Freedom Law Centre (SFLC), noted that such huge collection of data by law enforcement could lead to its misuse. “Without sufficient safeguards in place, this is a recipe for disaster.” He added that the period of 75 years could be even beyond the lifetime of an accused or a convict, and such a long period of time is problematic. “When the data is shared across various entities, it could be difficult to ensure that data is deleted in case of acquittal or discharge of a person.”

Meanwhile, Anushka pointed out that it is not known how the 75-year period was decided on, but it is definitely more than required. “From what we understand, the basic goal of this Bill is not criminal identification, but data collection. Every aspect of the procedure has been widened in such a way that the maximum amount of data can be taken from anybody who even comes in contact with the police,” she said.

Both Sugathan and the IFF have raised an alarm about Clause 3(c) in the Bill, which states that measurements will be taken from any person arrested under any offence punishable under the law or detained under a preventive detention law. Experts say that this will include even the people arrested for petty offences such as public smoking, traffic offences, loitering or even protesting. “Under the existing law, such information can only be collected from convicts or those on bail/security,” the IFF said.

While the Bill does talk about some persons not being obliged to provide biometrics, Sugathan said the clause on whose data can be collected is ambiguous and could result in misuse. “A person who is arrested even if he is "not obliged" to provide the biometrics may not be in a position to resist the demand by the law enforcement to provide the biometrics. Thus, even an activist detained for a peaceful protest could be made to provide the biometrics and other measurements,” he said.

It is important to note that while we do have a draft Data Protection Bill that was submitted by the Joint Parliamentary Committee, we do not have a data protection framework in place as of now. Anushka pointed out that the draft Bill, as it currently stands, provides wide exemptions for the government.

Why you should care

The average person should care, said Sugathan, because any person could be at risk of being profiled. “With even an accused person being asked to provide measurements, any one, including a person participating in a democratic protest, could be added to the database. With increased usage of automated tools, any person could be at risk of being profiled,” he said.

Anushka noted that the Bill would allow the police to stop anyone just because they suspect you have done something wrong. “You don't even have to be convicted of anything. If you are a suspect in any situation and the police think they need this data, they can collect it. At the end of the day, even if you did not do anything, you might end up giving your data.”

Become a TNM Member for just Rs 999!
You can also support us with a one-time payment.