Replacing the Identification of Prisoners Act, 1920, the Criminal Procedure (Identification) Act, 2022 gained presidential assent, allowing police and prison officers to collect a wide ambit of personal data from convicts and “other persons” related to investigations. The Act criminalises a refusal to give such sweeping data to the police and allows executive agencies to analyse and store this data without any mandates concerning its use. There are three features that distinguish the 2022 Act from its 100-year-old predecessor.
Firstly, Section 2 (1) (b) of the Act significantly expands the nature of data (termed “measurements”) that can be collected, to include physical and biological samples, iris and retina scans, and behavioural attributes such as signatures and handwriting in its ambit. Moreover, the Act has an inclusive definition rather than an exhaustive list of measurements that are to be taken and leaves critical terms such as “behavioural attributes” undefined, providing even more flexibility to law enforcement officials.
Secondly, while the 1920 Act was restricted to those arrested or convicted for offences punishable with at least a year of rigorous imprisonment, Sections 3(a) and 3(c) of the 2022 Act widen the law’s operation to people who have been convicted or arrested under “any law” including preventive detention laws.
Lastly, Section 4(2) of the 2022 Act allows the creation of a “measurements record” by the National Crime Records Bureau (NCRB), with the data being stored digitally for 75 years, without any provision for their deletion.
A petition in the Delhi High Court has challenged this Act as lacking a substantive due process mechanism, being “arbitrary” and “disproportionate”, and violating fundamental rights that the Constitution protects. This article analyses the Constitutionality of the Act under similar grounds, arguing that it confers excessive powers to the executive and violates individuals’ right to privacy.
- Excessive Delegation of Powers
In The Delhi Laws Act, 1912 case, the Supreme Court held that the legislature cannot delegate its essential legislative function. Chief Justice Hughes of the United States Supreme Court in the Panama case, who is widely cited in Indian decisions (like the Swadeshi Cotton Mills Case, Madanlal Chandak case, Collective Farming Society case, etc.), stated that the legislature should include some limitations on the powers granted to the Executive or at least lay down the broad perimeter and circumstances under which it can be exercised. Going by this understanding, this Act delegates excessive power at every step of the process.
The first stage involves the collection of measurements. Section 5 also allows the Magistrate to direct “any person” to give measurements if it is “expedient” to do so, without the procedural safeguard present in the 1920 Act, which only allowed such an order if said person was arrested at some point in connection to the investigation. This power extends to collecting vast amounts of personal data from “any person” convicted, arrested or even related to the proceedings under, not just the Code of Criminal Procedure 1973, but “any law” without any guideline on what is considered “expedient” or what are the broad grounds under which such extensive power can be exercised.
Thus, individuals distantly related to the suspect could be subject to genealogical analysis; measurements could be undertaken even when involvement in the offence has not been clearly established; measurements can be enforced in cases involving trivial offences or cases filed through the abuse of police powers as have been widely documented in preventive detention laws in India. Such sweeping powers have been given to Magistrates, with not even an indication of the contours under which they can be exercised.
The second stage involves storing the collected measurements. Section 4 of the Act allows the NCRB to “store, preserve and destroy”, “process”, or “share and disseminate” measurement records with no guidelines on when, the purposes for, to whom, and the process through which such actions can be undertaken. While the Act states that the records will be held for 75 years, it stays silent on what happens after. Furthermore, even this grossly disproportionate period of 75 years is only applicable to the “records of measurements” held with the NCRB and not to the collected measurements themselves, which, as per Section 4(3), are collected by agencies notified by State governments. Thus, vast amounts of data from people can, not just be collected, but also stored indefinitely with no limitations or conditions under which this mammoth exercise can/should be undertaken or halted.
Lastly, Section 8 provides the Central and State governments the power to pass rules through notifications on not just the manner of taking, collecting, storing, sharing, and disposing of measurements (considered the essential function of the legislature) but also on “any other matter” deemed necessary.
Thus, this Act clearly delegates excessive power to the executive, raising serious questions about the potential for abuse and lack of accountability that stems from it.
- Right to Privacy and Proportionality
The Puttaswamy decision has established that the right to privacy is a fundamental right protected under Articles 14, 19 and 21. The Supreme Court established a four-fold test which defines and applies the tests of legitimate aim, suitable means, necessity of said means and proportionality to adjudicate the constitutionality of any State action vis-à-vis the right to privacy. The procedure adopted in the Act is neither suitable nor proportional in meeting its stated aim i.e., to aid in the investigation of criminal matters.
Additionally, Section 4(2) of the Act allows the NCRB to keep the record for 75 years without any adequate reasoning to hold such a massive database, or any evidence to suggest that this would aid in future investigations, given the evidence collected for crimes often needs to be context-specific ones, suitable to particular cases. Furthermore, the Act allows the Magistrate to order measurements of “any person” and allows the police to collect samples (excluding only biological samples in cases where women or children are not the victims) from any person arrested under any law, without making distinctions based on the severity of the crime, extent of criminality, the necessity of specific forms of evidence, etc. thereby putting the Act at odds with the proportionality principle.
Much more fundamentally, in the absence of a data protection bill, the abuse of such sensitive information becomes even more likely. Moreover, safeguarding sensitive data for 75 long years in a context where the infrastructural capacities of the Indian State are questionable, as evidenced by serious data leakages in the past, also raises serious questions about the privacy of individuals.
The proponents of the Act argue that there is a need to modernise and update obsolete laws, to make full use of scientific advancements in evidentiary systems. However, the science behind using the measurements in the Act argues for is rather weak. The Supreme Court itself has previously held footprint impressions to be at rudimentary stages and handwriting samples to be prone to variation. Failure rates of about 9 per cent have been recorded for Iris scans, with the numbers at 9.5 per cent for palm-print impressions. Even when some of these instruments are useful, such as fingerprint examinations and DNA profiling, the best practices must be followed due to the potential for error, and therefore, specific guidelines concerning these measurements must be developed. Thus, repeated comparisons with jurisdictions like the United States that use such measures is not a compelling argument, given that India currently does not have standards and guidelines to appreciate such evidence. Hence, running the race of modernising the system without placing the procedural safeguards that make such a system effective is counterproductive, to say the least, but actively harmful through false positive reports at worst.
Suggestions and Conclusion
Firstly, the Act needs to be made constricted in its scope concerning both the collection and use of measurements. Specific guidelines on how DNA evidences’ accuracy can be ascertained in court-rooms, or the extent of weight that should be attached to palm-print impressions or iris scans, and the crimes (depending on the severity of crime and necessity of evidence like in the case of rape) for which extensive measurements can be collected need to be specified for the system to better appreciate such evidence in the first place.
Secondly, the nature of the analysis that can be conducted, the duties of the NCRB and state agencies, the grounds or the process through which these records can be deleted, and the mechanism through which police or other actors’ abuse of such records can be held accountable need to be included in the Act. Lastly, the duration for which the NCRB can hold such measurements must be drastically reduced from 75 years, with detailed infrastructural protections to prevent data leakage.
The 87th Law Commission Report notes at multiple points that while “expanding the scope of these [the 1920 Act] provisions, the need to protect freedom of the individual ought not be lost sight of”. This is the distinction between a colonial government enacting the Identification of Prisoners Act to exercise Orwellian control through increased surveillance and a democratic government balancing the rights and interests of its people. It is a cruel irony that it is the 2022 Act that enables the collection of even more data with even fewer safeguards than the colonial act it seeks to replace. While India does need a revision of the 1920 Act, this revision needs to happen both, with respect to modernising the kinds of measures we take to better equip the police, and incorporating the kinds of Constitutional values to protect the people from its abuse.
Saranya Ravindran is a 1st year law student pursuing B.A., LL.B.(Hons.) from NALSAR University of Law, Hyderabad
Image Credits: Live Law