Two Jamia students move court: HC seeks MHA, Delhi Police reply into plea challenging constitutionality of Act permitting biometric data collection

While no FIR was registered against Alam, Tripathi was booked for the campus protest. Both were questioned and their biometrics and photographs taken by the police in April 2025.

The two have submitted that they were neither convicted, arrested or preventively detained nor ordered to pay security bond for good behaviour – the categories for which such biometric collection is permitted under the Act.

Senior advocate Diya Kapur, along with advocate Naman Kumar – representing the petitioners – argued on Wednesday, “This Act and Rules are so broad that police at any point of time can take my biometrics and put it in NCRB… Here, there is no difference between a convict and an accused, no difference between any law… it is completely contrary to K Puttaswamy judgment… If I am accused of a very minor offence, say, participating in a protest, do I deserve to have my measurements as part of the NCRB… The rules ought to specify that.”

The court will hear the matter next on March 19, along with a 2022 petition, which too, has similarly challenged the Act and its Rules.

In February 2024, the Supreme Court had refused to entertain a similar challenge to the law by a Trust, Internet Freedom Foundation, opining that such a challenge to the law be first dealt with by HC.

What provisions under Criminal Procedure (Identification) Act are the students challenging in HC?

• Relying on Supreme Court’s K Puttuswamy judgment that affirmed right to privacy, the petitioners have highlighted that the Act and its Rules leave it entirely to the discretion of the executive for such “unconstitutionally wide and disproportionate collection of sensitive personal data”. They pointed out that such collection was limited to around 30 IPC and 34 BNS offences under Identification of Prisoners Act, 1920, which was replaced by Criminal Procedure (Identification) Act in 2022.
• The 2022 Act allows retention of such data up to 75 years in a centralised storage under the aegis of NCRB and authorises sharing of such information across databases. Information collection can also include physical and biological samples and their analysis, which potentially includes DNA samples, as well as behavioural attributes.
• The expansive nature of the law provides that any person “who comes remotely in contact with the criminal justice system gets inveigled within the scope” of the Act, including persons convicted of criminal defamation or a person arrested for speeding and careless driving.
• There is a likelihood of reversal of burden of proof as “such a database allows the criminal justice system to engage in probabilistic inquiries into ‘potential’ or ‘possible’ offenders, instead of establishing guilt”, which goes against the fundamental principle of innocent, until proven guilty.
• The law infringes upon right to privacy at the point of data collection, usage and storage, leaving individuals vulnerable to potential misuse of their personal data and unauthorised sharing of data across databases.
• There exists no redressal mechanism in cases of breach of data privacy. Further, the Digital Personal Data Protection Act, 2023 has in fact “created wide exemptions” for the collection of personal data for the purposes of conducting investigations, among others.
• Procedure for destruction and disposal of records is yet to be specified by NCRB.