Privacy Woes & Vague Language: Why Govt's Bill to Collect Biometrics is Worrying

With the introduction of this bill, legal experts and activists have voiced a slew of privacy-related concerns.

Introduced in the Lok Sabha, on 28 March, 2022, the Criminal Procedure (Identification) Bill is slated to replace the Prisoners Act, 1920.

(Photo: The Quint)

Introduced in the Lok Sabha on Monday, 28 March, the Criminal Procedure (Identification) Bill 2022 is slated to replace the Prisoners Act 1920.

While the Prisoners Act authorises the collection of certain identifiable information about specified persons (such as convicts for purposes of investigation of a crime), the current bill would expand the ambit of both the information (identification markers) to be collected, as well as the persons from whom this information can be extracted.

The bill also authorises the National Crime Records Bureau (NCRB) to collect, store, and preserve these details for 75 years.

Following the introduction of this bill, legal experts and activists have voiced a slew of privacy-related concerns with its provisions. These concerns largely pertain to the following aspects of the bill:

• Expansion of identification characteristics

• Expansion of the categories of people the data will be gathered from

• Collection and storage of this information with the NCRB

Speaking to The Quint, Apar Gupta, lawyer and executive director of the Internet Freedom Foundation (IFF), said:

“Based on the current form of the bill, it would be violative of the fundamental right to privacy, because under the Justice Puttuswamy [right to privacy] judgment, beyond a law being passed, it also needs to have a necessary state-purpose that is tied only to a proportional invasion into a person's privacy. It also requires adequate safeguards.”

In Justice KS Puttaswamy (Retd) and Anr vs Union Of India, the apex court had affirmed in 2017, that the Constitution of India guarantees each individual a fundamental right to privacy.

But before further delving into the concerns pertaining to the Criminal Procedure (Identification) Bill 2022, it is important to understand what kind of information can be collected, and whom it can be collected from.

What Does the New Bill Do?

Besides the finger and footprint impressions permitted for collection under the old Prisoners Act, the new bill would permit the collection of:

• Palm-print impressions

• Iris and retina scans

• Behavioural attributes such as signatures and handwriting

• Other physical and biological samples, such as blood, semen, hair samples and swabs, as well as their analysis

These details can be collected from any person who has been:

• Convicted of an offence

• Ordered to give security for his good behaviour or for maintaining peace under relevant sections of the Code of Criminal Procedure

• Arrested in connection with an offence, or detained under any preventive detention law

It is pertinent to note that while the first two categories of persons were already covered under the existing act, the third category has been incorporated into the new bill.

'Right to Privacy' and 'Excessive Delegated Legislation'

"The Puttuswamy Judgment says that any law which might infringe upon right to privacy, has to follow certain principles," Maansi Verma, lawyer and founder of civic engagement initiative Maadhyam, told The Quint.

"So, we have the principles of necessity and proportionality. What is the necessity for such a law? Is it proportional to the kind of infringement that will happen to right to privacy? Is it proportional to the objective that is sought to be achieved? Does the law have in-built requirements of purpose limitation?"

Maansi Verma

"If we look at the bill from that perspective, then it does seem like a lot of those requirements have not been met," Verma added, before going on to point out that it is not very clear what the necessity is in this case.

"For instance, there are confusing statements about increasing the conviction rate, which makes it seem like the only reason conviction rates are low is because we don’t have access to these measurements," she explained.

"But that might not be the case. In a criminal trial, conviction rate could be low for a variety of reasons, and there is no research that the government can cite to establish the point that the conviction rate is low because the government did not have access to these measurements," Verma added.

"So, the connection between gathering all this evidence and increasing the conviction rate is pretty flaky. Thus, the necessity is not established on very solid grounds."

Maansi Verma

"Similarly the proportionality: Since we are not very clear on the objective (of the bill), the extent to which infringement of privacy will happen and whether it will help in achieving that objective is again not established," Verma pointed out.

Commenting on the vagueness of the language used in the bill, she also said: "The bill leaves a lot of aspects open-ended, which perhaps, will be clarified later in the rules." However, according to Verma, this amounts to what the courts call "excessive delegated legislation," which can render a law unconstitutional.

But what exactly does excessive delegated legislation mean? In essence, excessive delegate legislation occurs when Parliament leaves crucial aspects of a law to later be framed by the executive or the bureaucracy as rules.

This becomes a problem because such rules don't have to be placed before Parliament, and therefore are not subject to debate and discussion and scrutiny.

The Dire Need for Safeguards

The International Freedom Foundation also said that the new law “dangerously expands” the purpose of this kind of legislation from “identification” of the perpetrator of a crime to the establishment of "the crime of the accused.”

“This is dangerous breach of privacy as there are little safeguards,” it added.

Verma suggested that the bill could have avoided being a potential violation of the right to privacy if there were some built-in safeguards:

"The bill says that these measurements can be collected not just from those who have been convicted, but also from those who have been arrested. So, for example, if before these measurements were taken, there was some specified scope for judicial application of mind, like if the police had to apply for a warrant and had to justify to a court why in this particular case, taking of measurements of this particular accused is required, and therefore, the infringement of privacy may be allowed."

Concerns Over the Expansion of Characteristics

Expressing concern over the expansion of characteristics from “measurements” to “attributes” and “analysis”, Apar Gupta, meanwhile, said:

“This goes beyond mere identification and will increase the data points of capture of a criminal.”

Observing that while the law “limited the gathering of information from people convicted of an offence with a punishment of more than one year or released on surety as an undertrial” and as per the bill “any person arrested may as per the discretion of a police officer be required to provide such, ‘measurements’," Gupta also, said:

“Under the new provision, this has been expanded to any person who can be arrested for any crime. Hence, this would apply to all offences, even petty ones such as loitering, not wearing a mask (as per applicable prohibitory orders), or traffic violations.”

“The discretion as per my reading of a proviso to this clause is muddy and makes this discretionary in favour of a police officer,” Gupta further added.

Meanwhile, the Internet Freedom Foundation also said in a tweet that it is not properly understood if “biological data” that can be collected will include DNA or not.

“DNA use in criminal investigation has been the subject of study under the DNA Technology (Use and Application) Regulation Bill, 2018…” the non-governmental organisation, that does work on digital rights and liberties, added.

NCRB Databasing – What About Federalism?

According to the IFF, “potentially the most concerning provision is the databasing, which will be done by the NCRB (National Crime Records Bureau) provided under Clause 4.”

Pointing out that the NCRB is as of now supervised and controlled by the Union Ministry of Home Affairs, Verma suggested that this could raise issues of interference with the federal structure as well.

"While MoS Ajay Mishra Teni was responding to the debate on introduction of the bill, he said they have had extensive conversations with the state, and they have given some power to the state governments also to make some rules under it. But the bill does seem to have centralised some of the functions, which, as per the constitution, come under the state (like policing). It gives the power to NCRB to collect, store, process, and disseminate the information."

Maansi Verma

Even though the Centre has said that the state government can carry out similar activities through the agency of their choice, the bill does arguably amount to the Centre stepping into the jurisdiction of the state in several ways. But why is this important?

"Even though it is more of a political point, the fact remains that if, at the state level, you feel your rights are being violated by authorities (such as the local police), you have different remedies available – approach your local courts and the state high court to avail those remedies."

Maansi Verma

"When all of this has been centralised, there may be less transparency around how the central agency is carrying out its role, and an individual will neither have that much information available nor will they have that kind of access to remedies," Verma added.

Thus, it can take the remedy further away from individuals when the process gets centralised.

What Can Be Done Now?

The two over-arching concerns that emerge from our conversation with experts are vagueness of the language of the bill and potential violation of the right to privacy.

Clearly, these two concerns are intertwined, as well. If the language of the bill was to be made more specific, the attributes more defined, the safeguards prominently illustrated, the privacy-related concerns may, at least, diminish.

So, what can be done now? Is there a solution in sight.

Citing "extreme concerns," the IFF has urged a reference of the Criminal Procedure (Identification) Bill 2022 to an appropriate standing committee for scrutiny.

“This is especially to ensure compliance of the Supreme Court’s Puttaswamy (Right to Privacy) Judgement (sic)," it said.

Seconding the requirement for reference to a standing committee of the Parliament, their eExecutive director told The Quint, that the DNA Use and Regulation of Technology Bill was similarly referred to a standing committee when objections arose, during a debate in the House.

“I would state that the ideal course would be a recall of this bill given that no public consultation has been carried out in this regard," Gupta also, however, added, before going on to state: "But referring it to a standing committee should be done at the very least.”

Verma, on her part, suggested that vague language may create a tilted power dynamic between the State and the citizen.

"From my experience, vague language in a criminal law almost always ends up advantaging the State," she said.

"Usually, in case of vague language, the State can take the benefit of expanding its powers, till somebody takes the matter to the courts."

Thus, her suggested solution echoes that of IFF:

“Since now the government has introduced the bill, it doesn’t seem like that it would be very open to the idea of withdrawing it completely. So, a practical mid-way would be to send it to a committee of Parliament, which can study and review it, speak to different stakeholders, and recommend some improvements that can be made to the law to make it more compliant to the constitution.”