The importance of Mr. Shashi Tharoor’s statement, spoken during the initial discussions regarding the DNA Technology (Use and Application) Regulation Bill, 2019 (DNA Bill), may dawn upon the audience in the backdrop of the statements made by Justice B.N Saikrishna (Retd.) regarding privacy and related. It is needless to say that the Personal Data Protection Bill, 2019 (PDP Bill) must be enacted prior to the enactment of the DNA Bill to ensure that the sensitive personal data of individuals is protected, which can be accessed and stored by State powers without the consent of the individual in certain situations under the provisions of the DNA Bill.
While a detailed analysis of the DNA Bill exposes several incidences of violations of the constitutional rights afforded to an individual, the DNA Bill further curtails the right to privacy of the suspects/undertrials, offenders, missing persons, unknown deceased persons whose DNA may be collected for use in criminal investigations and identification of missing persons.
The DNA Bill allows the investigative authorities to collect and process the DNA information of a person accused in a criminal matter if the punishment of the matter is beyond 7 years. While the DNA Bill does provide for a consent requirement for collection of data of individuals arrested for an offence that carries punishment up to seven years, there is very limited scope of seeking consent from a person who is being subject to criminal proceedings as it is; this becomes more apparent in the absence of any legal provision specifically affording a right to this effect. One of the lower hanging fruits for processing of consent in such cases, would be enabling admission of consent to a Magistrate instead of the investigative authority. The DNA Bill further permits the collection of data for both civil and criminal matters which would be stored in a unified database. This may lead to an institutional bias and as we have witnessed this past year systemic bias has been plaguing even the most developed and civilized jurisdictions like the United States of America. It is noteworthy that the seemingly equivalent legislation of the United States of America, has consumed large volumes of DNA samples, and is believed to have caused further bias against vulnerable communities.
It is pertinent to note that the extant Bill would be the first legislation which would regulate the collection of DNA evidence in India. However, the Bill seemingly disregards the contours of the 3-prong test (Legitimate Aim-Proportionality-Legality) to invade upon the right to privacy of an individual set up by the apex court in the matter of Justice KS Puttaswamy (Retd) v. Union of India, Puttaswamy Judgment, while holding that the Right to Privacy is an intrinsic element of right to life and livelihood granted under Article 21 of the Constitution. The DNA Bill does not effectively state the retention period of the DNA records of a person and may lead to cases of wrongful prosecution due to the presence of distant DNA samples at a crime scene. Furthermore, in the event that the consent of an individual is necessary for the collection of their DNA sample, a Magistrate may easily override the consent requirement and can order the collection under Section 21 of the DNA Bill.
The ambiguity with regards to the retention period of the data is further violative of Section 9 of the PDP Bill, wherein the data must not be stored beyond the period necessary to satisfy the purpose for its collection and processing. While the DNA Bill does provide for a procedure for the erasure of data for undertrials, suspects; the Bill falls short of providing a procedure for the removal of data of a person who has been involved in a civil matter. It is important to note that there is no automatic procedure which is trigged for purging the data, which is available with the authorities, an individual will have to move the appropriate court of law to have the data banks purge their records, and there is no guarantee provided for the same.
Will the Personal Data Protection Bill, 2019 help?
While it is a long-held belief that the enactment of the PDP Bill could offset the infirmities of the DNA Bill with regards to the right of erasure and requirements of informed consent for the collection of sensitive personal data, the PDP Bill can be likened to the DNA Bill with regard to the overreaching power and authority granted to State machinery. Section 36 of the PDP Bill provides an exception for the investigation and prosecution of offences, and consequently spares the observance of the fundamental principles of the PDP Bill. Interestingly, the PDP Bill empowers the State under Section 92 to bar a data fiduciary from the processing of certain notified forms of biometric data. It remains to be seen, however, whether this Section is included in the latest iteration of the PDP Bill and the forms of biometric data which the State may choose to prohibit from processing.
The DNA Bill will most likely lean on ideologies of public interest and prevention of criminal activities as its primary purpose for enactment. However, in the absence of any data protection legislation in the country, the DNA Bill would severely curtail the rights of the public under its ambit. While DNA collection drives have become commonplace in jurisdictions like USA, Ireland, China; the absence of any preceding legislation regulating DNA collection or personal data collection would leave the public without any legislative safeguards over the violation of their right to privacy. Furthermore, the effectiveness and the purpose of the DNA collection drive must be scrutinized closely, wherein false positives for DNA identification have become commonplace due to the vast multitude of medical procedures which permit intermixing of genetic information. The DNA Bill is still at the discussion stage, and is likely to be heavily amended, given that the Bill was first drafted before the Puttaswamy judgment and before the erstwhile PDP Bill, 2019 (which itself is undergoing amendments). It would be interesting to note the differences which would be made in any new iteration of the DNA Bill, given the ever-evolving nature of data privacy and protection principles. The DNA Bill does not seem to account for the social sensitivities of the country, as it does little to build awareness, or to enforce awareness amongst the ones who will be subject to the specifics of the DNA Bill. In a country where people are not even aware of basic legal procedures, or their enforceable right to privacy, this DNA Bill is bound to be frenzied.