Rethink the Bill

The criminal procedure law erodes fundamental rights

The Criminal Procedure (Identification) Bill, 2022, passed by Parliament last week, is an intrusive and dangerous piece of legislation. It erodes the fundamental rights of citizens and probably violates several of them.

It violates the right to privacy (Article 19) since it envisages the unregulated and, in some cases, forcible collection of personal data, including biometric and genetic data. It also violates the right to silence and avoid self-incrimination, as defined under Article 20. It violates Article 21, which protects “bodily integrity and dignity”, since it involves forcible (in some cases) and intrusive measures such as scans of the iris and retina.

The Act is also vaguely drafted. It doesn’t define the term “measurements”, which is used to describe the collection of various data, to be held for 75 years. It offers sweeping discretionary powers to lower-level government functionaries to collect data even in cases of preventive detention (often applied to political detainees and civil rights activists who are not accused of crimes), and also from a wide category of criminal undertrials, including those accused of both minor and major offences.

Taken together, this could easily lead to the profiling of any individuals the government is targeting. The data is to be held in a central repository and the National Crime Records Bureau may share and disseminate it with “any law enforcement agency” with the catch-all phrase “investigation and prosecution of crime” as the purpose. This is too broad and violates the concept of “purpose limitation”, where personal data may be used only for a defined, specific purpose.

The Bill was passed without consultation. There was no review by a Standing Parliamentary Committee, and the draft was not published for public comments and feedback. These procedures offer a chance for course correction. The bypassing of these procedures is especially worrying since this legislation affects every citizen.

It is hard to conceive of any model legislation that would protect personal data and DNA data and not conflict with the sweeping provisions of this Criminal Procedure Bill.

But this is being legislated at a time when there is still no personal data protection law, nor is there legislation governing the collection, use and storage of DNA since the DNA Technology Regulation Bill has not been introduced. Hence there are no safeguards to limit the scope of this Act.

It was argued in Parliament that the Act violates multiple Articles of the Constitution. Overall it conflicts with the critical principle laid down in Kesavananda Bharati vs Union of India that no legislation can change the basic structure of the Constitution.

The new law is also much more intrusive than the 1920 legislation — the Identification of Prisoners Act — it replaces. Under the term “measurements” any police officer of the rank of head constable upwards may take retina scans, iris scans, fingerprints, palm prints, footprints, physical and biological samples and “behavioural attributes”, including signatures and handwriting. Even in discretionary cases, an executive magistrate can order collecting personal data and empower officials to take it by force. Refusals to allow collection could lead to charges under interfering with a public official in the execution of duty.

Since this has been passed by Parliament, it could either be held up if the President returns it for reflection or if it is challenged in the Supreme Court.