Prodding Privacy: Why India’s DNA Regulation will be Curtains for Autonomy

As the DNA (Use and Application) Regulation Bill, 2019 is all set to be reintroduced before the winter session of Parliament, it has revived concerns regarding the violation of the fundamental rights of the accused and convicts. Manvi Rathod and Keiya Barot address some of these concerns regarding the unified database, caste-based profiling, consent, and privacy. 

—————-

The DNA (Use and Application) Regulation Bill, 2019 aims to regulate DNA technology to establish the identity of persons in criminal matters as well as civil matters like parentage, organ transplant, immigration, and establishment of individual identity. The object of the Bill is to create a DNA database that will have various indices containing profiles of undertrials, suspects, victims, offenders, their relatives, and any DNA found at the place where the crime was committed.

After lapsing in the Parliament in 2019, amidst heavy criticism, it was put before the Parliament's Standing Committee and is set to be placed before Parliament once again in this year's winter session. However, while in the works since 2007, this Bill has not taken into account a myriad of human rights issues related to security, privacy, consent, and caste-based profiling.

The Bill envisages various indices for criminal matters but is silent regarding civil matters leading to confusion about where and how those DNA profiles will be stored.

The objective of maintaining a database is identification. Section 34 under Chapter VI lays bare that the records maintained may be utilised for many things- from facilitating adjudication and prosecution in criminal matters to identification for civil matters. This is to say that if someone has rendered their DNA for a civil matter, their DNA could be used at a later stage for cross-referencing in a criminal matter.
Thus, consent given for the collection of DNA for civil matters cannot be understood to be blanket consent for identification in a criminal case.

Having a unified database blurs the line between guilt and innocence. The presumption of innocence is undermined, somehow making people who have given their DNA for civil matters less innocent than those whose DNA is not on the database. This could also shift the burden of proof onto a person whose DNA matches in a future criminal case, and this person would have to prove their innocence in light of a DNA match. Thus, separate civil and criminal databases should be maintained.

The Supreme Court had held in Selvi vs. State of Karnataka that personal autonomy is of utmost importance and any interference with it violates the right to privacy especially in circumstances where a person can face criminal charges or penalties. Thus, a possible cross-referencing of DNA collected for civil and criminal matters would lead to self-incrimination.

In the same case, Justice Ranjana Desai had observed that even though retention and collection of DNA samples are not unconstitutional, future use and development of DNA profiling for testimonial purposes could face constitutional obstacles under Article 20(3) of the Constitution.

A unified database of civil and criminal cases might lead to speculative searching and will impinge on one's right to privacy.

Caste-based profiling, consent, and privacy: an argument for human rights

One of the biggest concerns raised by the Standing Committee was that this Bill could lead to caste-based profiling. In India, over the years, it has been seen that the Dalit, Scheduled Caste, and Scheduled Tribe population has been vulnerable to police scrutiny and bias.

An analysis by the National Crime Records Bureau in its 21st Prison Statistics in India report revealed- that 55% of the undertrial prison population belongs to the Dalit, Adivasi, or the Muslim community which is shockingly disproportionate to their combined total population of 39%.

The social disparity is glaringly obvious even with arrested and convicted prisoners. SC and ST population in India amounts to only 24.2%, however, they make up 34% of the prison population. The Dalit's plight is no better while they make up 21.6 % of the population in India, almost one in four of the prisoners is Dalit.
Since the arrest, conviction, and undertrial population is made up largely of these vulnerable groups, the database will also predominantly contain their DNA profiles. Hence, a unified database will increase the risk of caste-based profiling by the police and allow them to systemically target marginalized sections by referencing their DNA over and over for crimes associated with specific groups.

In the landmark K. Puttaswamy judgement, the Supreme Court held that privacy enables the individual to retain the autonomy of body and mind, and the right to control the collection, use, storage, and dissemination of personal information is an integral aspect of this right.

This Bill is not only at odds with the right to privacy but also with the Personal Data Protection Bill. "Sensitive personal data" under the Data Protection Bill includes genetic data that has secure parameters for collection, processing and requires informed and specific consent.

However, if an individual which includes guardians of minors and relatives of victims under does not consent to give his DNA for an investigation, a magistrate can easily override this consent and can order the collection under S.23 of the DNA Bill.

Thus, taking away an individual's right to make intimate decisions about themselves guaranteed under Article 21 of the Constitution.

Another example of security failure is S.35(b) of the Bill. As per this section, highly confidential DNA data will be made available to the personnel of DNA laboratories for training purposes. DNA data is highly contaminable and it runs the risk of a large-scale breach of security. The Bill does not make a provision for consent to be taken from individuals for their DNA to be used to educate trainees.

Further, the National DNA Bank will store data in perpetuity unless a written request to expunge data is submitted.

While a procedure is given for suspects and undertrials, there is nothing appertaining to civil matters. There is no appeal mechanism prescribed for DNA expunging if the National Bank refuses it and thus, no means to verify if the DNA has been purged. Passersby who leave their DNA at crime scenes will also be profiled and indexed under the crime scene index. Thereby being cross-referenced against all searches in perpetuity without the means of knowing their personal data has been compromised, let alone getting it expunged.

It goes against the Supreme Court's affirmation that "individuals have the right to be free, except in very limited circumstances, from unwanted governmental intrusions into one's privacy."

Several sections of the Bill are inconsistent with the Constitution and present contradictions to the legal precedents. The Bill does not take into account the interrelationship of rights and violates autonomy, privacy, and an individual's right to make decisions.

Before passing this Bill, the government should bifurcate the database into civil and criminal, the Bill should flesh out details about the civil database and ensure no cross-referencing takes place between databases. Let us not forget that the Bill is very vague about consent in the collection of DNA for civil matters and sharing their DNA with foreign agencies. In addition, wide powers are being given to the magistrate to override consent, these powers need to be defined to ensure that there is no abuse.

While the Bill makes provisions for the storage of DNA data in the criminal database for perpetuity, it should not do the same for the civil database. Once the civil matter is completed, the automatic deletion of DNA profiles should take place. The argument for deletion of civil samples is further forwarded by the theory that a larger database will yield itself to false positives and will not be cost-efficient
.
The Parliament before making the Bill into an Act must rectify and fill the lacunae related to violation of fundamental rights. The Bill should be ratified only after data protection laws are in place in the country as it is in direct conflict with the Personal Data Protection Bill, 2019. The present vague framework of the Bill fails to account for lack of awareness and technical knowledge and is likely to confuse the judiciary as well as the common man.

(Keiya Barot and Manvi Rathod are a final year law students studying at Pravin Gandhi College of Law, Mumbai. Views are personal.)