India – Arguments against the Human DNA Profiling Bill 2015

Introduction

With the central government playing fast and loose with the contours of the right to privacy in the Aadhaar case,1 alarm bells have been set off about the implications of the government's stand in the context of other laws and measures that have a bearing on the fundamental freedoms of citizens. Prominent among these is the draft Human DNA Profiling Bill 2015 ("the bill"), which the government had intended to but did not table in the monsoon session of Parliament. The bill seeks to create national and regional DNA data banks that will contain the individual DNA profiles of the categories of persons specified in the bill, such as offenders, suspects, missing persons, unknown deceased persons, volunteers2 and such other indices that may be specified by the DNA Profiling Board ("the board"), which has oversight over these banks. The bill is intended to strengthen the administration of criminal justice; however, a combination of loosely worded provisions and the vesting of sweeping, unchecked powers in the board has raised concerns that the data might be misused.

This article highlights some of the key concerns that have been raised about the bill and then examines them against the legal standards laid down by the Supreme Court in the context of criminal investigation, uncontrolled executive discretion, and the right to privacy. Where relevant, it also draws upon comparative experience from other jurisdictions.

Fatal Flaws

The bill has already been thoroughly dissected in the dissenting note of Usha Ramanathan, a member of the committee that was set up to make suggestions on the bill in 2012 (Ramanathan 2015). Similarly, the Group of Experts on Privacy set up by the Planning Commission in 2012 had developed and applied National Privacy Principles to point out defects in the manner in which it has been drafted (Group of Experts of Privacy 2012). Some of these deficiencies are discussed here.

(i) Vague Provisions: As mentioned in the Introduction, the bill makes provisions for maintaining separate indices of the DNA profiles of "offenders" and "suspects." An offender is defined as a person convicted of, or an undertrial charged with a specified offence.3 However, a suspect is defined as a person suspected of having committed an offence, not just a specified offence. These other offences are listed in Part I of the Schedule of the bill, and include every offence under the Indian Penal Code (IPC), as well as offences under special laws such as the Protection of Women from Domestic Violence Act, 2005, the Scheduled Castes and the Scheduled Tribes (Prevention of Atrocities) Act, 1989 as well as any other law that may be specified by regulations.

These definitions are relevant because Clause 38 of the bill states that DNA profiles are to be used solely for the purpose of facilitating the identification of the perpetrator of a specified offence. However, the proviso to this clause promptly goes on to dilute this strict restriction on the use of DNA profiles to allow them also to be used for purposes related to any of the offences listed in Part I of the Schedule. Profiles may also be used to identify the victims of accidents, disasters, missing persons or for civil disputes such as paternity or immigration disputes.

By extending the scope of purposes for which DNA profiles may be accessed, especially beyond the investigation of specified offences, the bill simultaneously increases the powers of the police and incentivises the arrest of all persons suspected of having committed an offence. This is because Sections 53 and 53A of the Code of Criminal Procedure, 1973 (CrPC) only permit the collection of biological material from persons arrested on charges of having committed an offence without their consent (Ananth vs State of Andhra Pradesh). Moreover, this arrest is to be restricted only to offences that are "of such a nature and alleged to have been committed under such circumstances that there are reasonable grounds for believing that an examination of his person will afford evidence as to commission."

Examples of such offences are murder and rape; there is no purpose to be served in examining a person accused of, say, hate speech under Section 153A of the IPC. However, the restriction in the CrPC on the kind of offences that warrant the collection of biological material is not reflected in the bill. At the very least, the definitions of "suspect" and "offender" ought to be harmonised with the comparatively limited manner in which Section 53 of the CrPC is framed. Otherwise, constitutional safeguards against self-incrimination under Article 20(3) of the Constitution will be called into question. The Group of Experts on Privacy has also recommended that the bill appropriately distinguish between circumstances where DNA collection requires consent (from the victim of a crime) and where it does not (Group of Experts on Privacy 2012).

Clause 12 of the bill empowers the board to disseminate best practices concerning the collection of DNA evidence and sensitise public stakeholders such as police officers, prosecutors and judicial officers. This would appear to be an important function to protect the rights of the accused, given the absence of any current guidelines on the collection and use of DNA evidence by the police. However, the ability of the board to perform this function impartially is seriously compromised by another of its enumerated functions under Clause 12, that is, to make recommendations maximising the use of DNA techniques in the administration of justice. This conflict of interest (Mukunth 2015) is symptomatic of the very wide range of powers vested in the board and discussed below.

(ii) Unregulated Discretion of the Board: The untrammelled powers with which the DNA Profiling Board has been vested, coupled with limited accountability, constitute another source of concern. The most worrying among these is the power of the board to specify through regulations, the maintenance of any DNA indices (other than those already enumerated in the bill). When this is coupled with the fact that the board also has the power to make DNA profiles and samples available for any other purpose, as it may itself prescribe, truly unprecedented control has been vested in a single body without appropriate oversight mechanisms.

Apart from an annual report that is required to be laid before Parliament, the board is not supervised or even advised by any other body, unlike mechanisms that exist in other jurisdictions. In the United Kingdom (UK), for example, the National DNA Database is governed by the National DNA Database Strategy Board, the composition of which is similar to that of the Indian board under the bill (a striking difference, however, is the absence of ethicists in the Indian body). This UK Strategy Board is also assisted by a National DNA Database Ethics Group, one of the functions of which is to "ensure all police and supplier databases containing DNA information are subject to robust governance requirements."4 Additional checks are imposed by the Forensic Science Regulator that ensures that forensic science services across the criminal justice system meet appropriate standards of quality. Even so, the Human Genetics Commission has recommended the creation of an independent body with lay membership to oversee the operation of the Database.

Similar governance mechanisms are in place in Australia, where the CrimTrac agency operating the National Criminal Investigation DNA Database and the Disaster Victim Identification Database is supervised by a user advisory group as well as a board of management with specialist advisers. Several other levels of oversight exist in the form of (a) a Privacy Commissioner, who may investigate breaches of Information Privacy Principles under the Privacy Act, (b) the Commonwealth Ombudsman, who has the power to investigate complaints against administrative decisions of Commonwealth Authorities, and (c) independent statutory review of the operation of the system under the Crimes Act.5

Unlike India, the above jurisdictions have data protections and privacy laws. In their absence, the lack of a suitable oversight mechanism makes the information contained in the DNA data banks even more vulnerable. This makes it all the more important to examine the privacy protections that the Supreme Court has accorded to personal information. This is discussed in the section below. However, before moving on to this, the manner in which the unguided discretion of the board also lays it open to legal challenge is briefly explained below.

The Introduction to the bill identifies its principal objective as enhancing the "protection of people in the society and administration of justice." The bill has already exceeded the scope of these objectives by allowing DNA profiles to be made available for the creation of a population statistics database in Clause 39. Suspect as this expansion is, it is nevertheless expressly provided by the legislature itself. However, vesting a body like the board with the power to indiscriminately expand the use of personal information is an abdication of legislative function6 and places the bill in danger of being struck down for excessive delegation. While the Supreme Court has recognised the necessity for Parliament to be able to delegate some functions to the executive, such delegation must never result in giving away "essential legislative functions" (In Re Delhi Laws Act). These essential functions include the "determining or choosing of legislative policy and of formally enacting that policy into a binding rule of conduct" (Kunj Behari Lal Butail vs State of Himachal Pradesh). For a law that is intended to regulate the manner in which DNA profiles are to be stored and used, there cannot be a more essential legislative function than determining the purposes for which they are to be made available. By failing to lay down even guiding principles to be followed by the board while regulating the use of DNA samples, I would argue that the bill falls short of fulfilling its primary function.

(iii) Personal Information and the Right to Privacy: There are several ways in which the bill is in breach of universally recognised privacy principles that require, among other things, notice of collection of information and limitation of its use to the purpose for which it is collected (Group of Experts on Privacy 2012). To provide a concrete example of a provision from the bill, Clause 43 of the bill is drafted in such a way that a person receiving a DNA profile for entry in a DNA data bank may allow it to be used for a purpose other than the one for which it was received, so long as this other purpose is one contemplated by the bill. This means that if a person were to allow her/his profile to be entered as a volunteer, it is conceivable that the data bank manager could allow it to be made available for the purposes of maintaining a population statistics data bank, because this is a purpose for which information relating to a profile may be made available under Clause 39 of the bill.

Some of the other egregious omissions in the bill that the report of the Group of Experts on Privacy has identified include providing notice to the individual about the collection of her/his DNA sample before it is analysed; obtaining informed consent from volunteers regarding the purposes for which the sample will be analysed; permitting the destruction of DNA samples after the purposes for which they were collected are fulfilled (Mukunth 2015);7 and allowing individuals to view and correct their personal data.

Do any of these shortcomings in the bill violate elements of the right to privacy as recognised by the Supreme Court to date? An incisive analysis of the Supreme Court's decisions on the right to privacy has been undertaken by Gautam Bhatia in an academic article on state surveillance (Bhatia 2014). In a landmark case that dealt with domiciliary visits by the police (Gobind vs State of Madhya Pradesh), Bhatia shows how the Supreme Court required the government to demonstrate a "compelling State interest" to justify placing limitations on the right to privacy. Additionally, these limitations also had to be "narrowly tailored" and "targeted" to meet the government's objective of preventing crime (Bhatia 2014: 138). The application of these tests to bulk surveillance was confirmed in a later landmark case on telephone tapping (People's Union for Civil Liberties vs Union of India; Bhatia 2014: 144).

Conclusions

As this discussion of the provisions of the bill demonstrates, it is undeniable that the manner in which it is currently drafted does not meet these requirements. However, these tests are triggered only once the Supreme Court determines that there has been an infringement of the right to privacy in the first place. The Supreme Court has considered the right to privacy in relation to personal information in a case involving medical records (X vs Hospital Z)8 as well as a case concerning searches and seizures of private bank records (Collector vs Canara Bank). The latter case is of special relevance to the bill because the Supreme Court held that the documents continued to remain confidential, notwithstanding the fact that they had been voluntarily submitted to a bank (Bhatia 2014: 151). Thus, at least in the case of persons who submit their DNA samples voluntarily to the data banks, the government will not be able to argue that they have surrendered their right to privacy.

However, the Supreme Court's pronouncements in the case of the bank records came in the context of search and seizure provisions, which are not present in this bill. Given that the Supreme Court has also upheld the forcible extraction of biological material from accused persons in criminal investigations (Selvi vs State of Karnataka), doubts have also been expressed about the existence of a right to bodily privacy (Acharya 2015). Nevertheless, given the integrated reading of Articles 14 (protection against arbitrariness) and 21 (right to life and personal liberty) that our courts have adopted (Bhatia 2015), given the fallibility of DNA evidence (Ramanathan 2015) and the constitutional protection against self-incrimination, and given the harm to individual dignity posed by the misuse of personal, biological information, I would argue that there are strong arguments to be made that the bill in its current form falls short of constitutional guarantees to liberty and privacy.

The government's stand in the Aadhar case has thrown a shadow on its commitment to enact a privacy law.9 Although, the Supreme Court initially came down harshly on this stand during oral hearings and questioned whether liberty could exist without privacy, it has now asked a Constitution bench to determine whether the right to privacy exists as a fundamental right and if yes, what its contours are. It is to this bench that we must now look to protect us against the not-so-insidious extension of state surveillance.

[The author thanks Sanchit Saluja for his research assistance.]

NOTES

1 The Attorney-General of India, while defending the government's unique identification programme, argued that a larger bench of the Supreme Court must be constituted to redefine the content of the right. He argued that two Constitution Bench judgments in 1954 and 1963 that held that the right to privacy is not a fundamental right, have yet to be overruled by a larger bench.

2 Persons may volunteer to undergo a DNA procedure and submit their DNA profile to the data bank. These are likely to include the relatives of missing persons, victims or witnesses at the scene of the crime.

3 Specified offences in turn are defined as offences under the Indian Penal Code, 1860 that are listed as cognisable offences in Part I of the First Schedule of the Code of Criminal Procedure, 1973.

4 More information about the composition and functions of this group is available athttps://www.gov.uk/government/organisations/national-dna-database-ethics...

5 Details about these oversight mechanisms are available at http://www.alrc.gov.au/publications/43-dna-database-systems/dna-database…

6 See Ramesh Birch vs Union of India AIR 1990 Supreme Court 560 for an explanation of what does or does not constitute legislative abdication.

7 Although the bill talks about the deletion of the profiles of persons who have been acquitted, no provision has been made for missing persons who have subsequently been identified or volunteers who have died.

8 In this case, the Supreme Court upheld the disclosure of the appellant's HIV+ status to advance "public morality or public interest."

9 Proposals include the setting up of a Data Protection Authority to investigate data security breaches and data controllers to exercise self-regulation. See Aulakh (2014).

References

Acharya, Bhairav (2015): "The Battle for a Right to Privacy Still Has a Long Way to Go," 2 August, The Wire, available athttp://thewire.in/2015/08/02/the-battle-for-a-right-to-privacy-still-has…

Ananth vs State of Andhra Pradesh AIR 1977 AP 1797.

Aulakh, Gulveen, "India Proposes to Penalise Invasion of Privacy Offences in Draft Bill," 18 February, The Economic Times, available at http://articles.economictimes.indiatimes.com/2014-02-18/news/47451233_1_…

Bhatia, Gautam (2014): "State Surveillance and the Right to Privacy in India," National Law School of India Review, Vol 26, No 2, pp 127–158.

— (2015): "Sorry, Mr Attorney-General, We Do Actually Have a Constitutional Right to Privacy," 28 July, The Wire, available at http://thewire.in/2015/07/28/sorry-mr-attorney-general-we-do-actually-ha…

Collector vs Canara Bank (2005): 1 Supreme CourtC 496.

Gobind vs State of Madhya Pradesh (1975): 2 Supreme CourtC 148.

Group of Experts on Privacy (2012): "Report of the Group of Experts on Privacy," 16 October, New Delhi: Government of India, Planning Commission.

In Re Delhi Laws Act AIR 1951 Supreme Court 332.

Kunj Behari Lal Butail vs State of Himachal Pradesh (2000): 3 Supreme CourtC 40.

Mukunth, Vasudevan (2015): "Modi Wants the DNA Profiling Bill Passed Right Away. Here's Why It Shouldn't Be," 24 July, The Wire, available at http://thewire.in/2015/07/24/modi-wants-the-dna-profiling-bill-passed-ri…

People's Union for Civil Liberties vs Union of India 1997: 1 Supreme CourtC 301.

Ramanathan, Usha (2015): "Notes on the Human DNA Profiling Bill 2012 Presented to the Committee Set Up to Discuss the Draft Bill and to Make Suggestions on the Draft Bill," 9 November, available at http://www.kractivist.org/usha-ramanathans-note-of-dissent-on-human-dna-…

Selvi vs State of Karnataka (2010): 7 Supreme CourtC 263.

X vs Hospital Z (1998): 8 Supreme CourtC 296.