The Criminal Procedure (Identification) Bill, 2022, a crucial legislation that provides a legal framework for investigative agencies to use modern techniques and technology to solve crimes, has been introduced in the Lok Sabha. It will facilitate collection of sensitive personal and biological data of individuals by the police and creation of a database that could retain the information for upto 75 years. In effect, it entrusts the police — starting from the rank of a head constable who will collect and process this data — with navigating the fine line between the inviolable personal space of an individual and the state’s legitimate interests. For a law that collides with the right against self-incrimination and right to privacy, several terms in the Bill are too broad or too vague.
Replacing the 1920 Identification of Prisoners Act, the proposed law considerably expands its scope and reach. First, it expands the nature of data points it can collect from an individual — from finger impressions, foot-print impressions and photographs in the 1920 law to now include finger-impressions, palm-print impressions, foot-print impressions, photographs, iris and retina scans, physical, biological samples and their analysis, behavioural attributes including signatures, handwriting or any other examination prescribed in the Code of Criminal Procedure. While the phrase biological samples is not described further, it could involve bodily invasions such as drawing of blood and hair, collection of DNA samples. These are acts that currently require the written sanction of a magistrate. Second, the Bill casts a wide net in terms of those whose data can be collected. The proviso (exception to the law) in Section 3 of the Bill essentially says while the police can collect data from any person, only a select category — such as convicts, those under preventive detention, those required to submit a surety bond — can be compelled by the police. While juvenile offenders are outside the remit of a police station, the Bill leaves some ambiguity on collection of data for minors between 16 to 18 years, who cannot consent to collection of personal data but can be tried for serious offences.
In the absence of a data protection framework that is long pending, the proposed law raises questions on protecting rights of the data principal and on the risks of profiling. Any encroachment on personal space must pass the test of constitutionality as laid down by the Supreme Court. It is important for the state to iron out the looseness and ambiguity in law without delay.
This editorial first appeared in the print edition on March 30, 2022 under the title ‘Too loose, too vague’.
