Criminal Procedure (Identification) Act of 2022 allows government agents to take and store 'measurements' of those who have been convicted, arrested and detained. The Supreme Court has refused to examine its constitutionality, saying it wants a high court opinion on the issue first.
—
ON Monday, the Supreme Court refused to examine the constitutional validity of the Criminal Procedure (Identification) Act of 2022 and the Criminal Procedure (Identification) Rules of 2022 which authorise police or prison officers or any person directed by a judicial or executive magistrate to take 'measurements' of those who have been convicted, arrested and detained.
A Bench comprising Justices Sanjiv Khanna and Dipankar Datta believed that a challenge to the Act and Rules must first be dealt with by the high court so that the Supreme Court can benefit from the opinion of the high court.
Sensing the mood of the Bench, Internet Freedom Foundation (IFF), the petitioner chose to withdraw the petition with the liberty to approach the high court.
IFF is a registered charitable trust that was set up to protect, promote and defend human rights of citizens using information communication technologies. Advocate Abhinav Sekhri appeared for the petitioner.
The petitioner contended that the impugned Act and Rules are irrational in their classification of persons and situations in which information may be collected, disproportionate in their invasion of the fundamental right to privacy, and insufficient in discharging the State's constitutional obligation to safeguard and protect the data that it collects from individuals.
The petitioner contended that the impugned Act and Rules grant State authorities an open-ended, uncanalised discretionary power to collect sensitive personal information of virtually every person who comes in contact with the criminal justice system, namely (i) convicts, (ii) any persons arrested or detained under any offence, and (iii) persons ordered to give security for good behaviour or maintaining peace.
"For instance, Section 2(1)(b) read with Section 3 of the impugned Act authorises Respondent No. 1 to collect 'measurements', i.e., fingerprints, palm prints, footprints, iris and retina scans, 'physical and biological samples and their analysis', 'behavioural attributes' (including signatures, handwriting, etc.) of all such persons.
"The impugned Act and Rules do not adhere to a proportionality assessment as mandated by the Constitution, lack oversight mechanisms and suffer from the vice of excessive delegation," the petitioner contends.
The petitioner goes on to argue that the impugned Act and Rules fail to exhibit a rational nexus between the categories of persons and situations where information may be collected, the nature of the information collected, and the prevention and prosecution of crime.
The impugned Act and Rules, the petitioner submits, significantly expand both, the categories of persons subject to data collection and the nature of the data collected from the previous legislation that held the field, namely the Indian Prisoners Act, 1920.
"For example, Section 2(1)(b) read with Section 3 of the impugned Act authorises extremely intrusive data collection under the term 'behavioural attributes'— which remains undefined— from persons convicted of any crime, from undertrial prisoners, and from individuals detained under any preventive detention law.
"The impugned Act and Rules do not exhibit any rational nexus between the categories of individuals and crimes, the nature of the data collected, and the stated goal, leaving it, instead, to the discretion of police and prison officers," the petitioner states.
The petitioner also highlighted the lack of safeguards regarding the collection and storage of sensitive data.
"Section 4(2) of the impugned Act read with Rule 5 authorises Respondent No. 1 to store 'measurements' (which include biometric and other data) for 75 years. Further, no procedure for destruction and disposal of such records has been prescribed under the law, and Rule 5(4) leaves it to the discretion of the respondents to specify it through a 'standard operating procedure'.
"Such retention of sensitive personal data fails the proportionality test as well as the just, fair and reasonable test prescribed under Articles 14, 19, 20(3) and 21 of the Constitution," the petitioner argues.
It further argues that Section 4(1)(d) of the impugned Act read with Rule 5 allows the National Crime Records Bureau, to "share and disseminate" such sensitive personal data with "any law enforcement agency" in such manner as may be prescribed.
"No specific manner has been prescribed under the Rules, including Rule 5 that purportedly regulates the manner of sharing and dissemination of measurements.
"Such uncanalised sharing of information that is collected for a specific purpose (at the time of arrest) with any law enforcement agency for use for any purpose violates the principles of purpose limitation, data minimisation and facilitates profiling, as held by this court in K.S. Puttaswamy versus Union and the Aadhaar judgment," the petitioner argues.
The proviso to Section 4(2) of the impugned Act and Rule 5 of the impugned Rules are so framed, the petitioner argues, that even after a person has been acquitted by courts, their "measurements" (taken at the time of arrest) that have been shared with any law enforcement agency shall not be deleted.
The petitioner also highlights that the Act and Rules do not automatically require law enforcement agencies to delete the "measurements" of persons who have been acquitted and illegally shift the onus on the persons acquitted.
"In fact, under the proviso to Section 4(2) read with Rule 5, such a remedy can only be sought (i) after all legal remedies have been exhausted (i.e. virtually till the matter attains finality before this court); and even then (ii) the magistrate has the discretion to reject the request.
"At the same time, the law is void for vagueness since Rule 5(5)(i) requires a request for the destruction of record of measurements to be made to the nodal officer appointed by the respective Central or state governments, whereas proviso to Section 4(2) seems to require the magistrate to take the final decision," the petitioner submits.
The petition, filed through advocate-on-record Vrinda Bhandari, also pointed out that in the face of the Digital Personal Data Protection Act, 2023 that grants wide exemptions from the applicability of the law to government instrumentalities and the lack of differentiation between personal data and sensitive personal data, the impugned Act fails to provide for necessary and proportionate safeguarding of personal information or accountability for its misuse.
In 2022, the Parliament cleared a Bill redefining 'measurements' to allow the police to take iris and retina scans, photographs, finger impressions, palm-print impressions, footprint impressions, physical and biological samples and their analysis.
The Act also allows the police to collect behavioural attributes including signatures and handwriting, or any other examination referred under Sections 53 or 53A of the Code of Criminal Procedure, 1973.