Why the DNA Bill 2018 – a tangled mess of unresolved concerns – is a privacy and security nightmare

[dropcap]T[/dropcap]he DNA Technology (Use and Application) Regulation Bill 2018 was introduced in the Lok Sabha on August 9, 2018. The Union Minister for Science and Technology, Dr Harsh Vardhan, led the discussion during the just concluded Monsoon Session of the Parliament. The Bill was first proposed in 2007, and the process of drafting began in 2012. The Bill was earlier tabled in the Monsoon Session of the Rajya Sabha in 2015; however, it was not addressed at the time.

What are the Driving Factors behind the Bill?

The National Crime Records Bureau (NCRB) Report of 2016 has revealed a staggering rise of crimes against the human body, i.e. murder, rape, human trafficking and grievous hurt. Officials have confirmed that a very small proportion of these crimes are currently being subject to DNA technology, and hope that an increased reliance on the same would result in successful convictions. The Objective of the Bill is to "provide for the regulation of use and application of DNA technology for the purposes of establishing the identity of certain categories of persons including the victims, offenders, suspects, under-trials, missing persons and unknown deceased persons and for related matters".

The Lokniti Foundation in 2017 pleaded that a DNA database could be instrumental in the identification of unidentified dead bodies before their ultimate disposal. The Foundation demanded information on the progress of the Bill, to which the Centre intimated the bench headed by Justice Dipak Misra, that the legislation process had begun. The primary concern of the petitioner was that the "influx of migrants across the country has increased the crime rate" and a corresponding upheaval of corpses, which have not been traced back to their families.

Privacy and Data Protection

Several activists, civil society members and academics have criticised the Bill for its ignorance in recognising recent developments in the field of privacy and data protection. First, the Law Commission of India in its 271^st report published a Draft Bill for the Use and Regulation of DNA-Based Technology of 2017, emphasising on the adherence to the 13 CODIS loci, as well as the need for a strong legal framework for the enactment of appropriate laws to deal with the same.

Second, the August 2017 Supreme Court judgment of Justice K S Puttuswamy v. Union of India and Ors. held the Right to Privacy as a fundamental right guaranteed by the values enshrined in the Constitution of India. A bench of nine judges, including Justice D Y Chandrachud and retired Justice Jasti Chelameswar, opined in the backdrop of the Aadhaar/UIDAI database constitution case (which has now concluded and judgment in which has been reserved) when the Central government argued against privacy as a fundamental right. The Puttaswamy judgment has cited cases from the UK, which held that the retention of data by the police was unlawful as per Article 8 of the European Convention on Human Rights. The Justice Shah Report on privacy submitted in 2012 was cited for its recognition of DNA as a part of physical privacy. Interestingly, a Supreme Court case from 2010 was mentioned in which the usage of DNA samples for paternity tests were recognised for also leading towards prejudicial rights of the parties and having devastating effects on the child.

Third, the Government released the Justice BN Srikrishna Committee of Experts Report on Data Protection, which has recognised DNA samples as being sensitive personal data being utilised for the prevention, detection, investigation and contravention of activities of the law. The report further discusses the need for processing citizen databases only for necessary and proportionate purposes. It cites a case from the UK, where the government was compelled to delete more than a million records of innocent citizens after the enactment of the Protection of Freedoms Act, 2012 which regulated the collection, retention, and destruction of biometric data as a surveillance mechanism.

Last, the release of the Personal Data Protection Bill of 2018 should perhaps be prioritised before hastily enacting the DNA Bill, for the former to take shape as a distinguished protective legislation, with a corresponding Data Protecting Officer.

Question of consent

The guidelines pertaining to the granting of consent to the appropriate authorities for the submission of DNA evidence state that, consent may not be taken in cases where arrests are made in the "specified offences", i.e. any offence punishable with death, imprisonment or a term exceeding 7 years. Although consent needs to be taken in the other cases, a Magistrate's approval on the grounds of "reasonable cause" may grant the permission for obtaining bodily substances from any arrested persons.

Voluntary consent may be given as a personal submission for DNA testing if one is present at a crime scene, for questioning during an investigation etc. There is a need to make the consent framework more robust by divulging the volunteers with details of how their genetic information will be stored and used.

Further, although persons below 13 years of age may submit their consent through their parents or guardians, a refusal by them empowers the approval of a Magistrate with "reasonable cause" to grant permission for obtaining requisite bodily substances from the person concerned. As is often with the law, the parameter of defining "reasonable cause" is very subjective and established through precedent. Since the introduction of DNA technology is at a nascent stage, a set of guidelines may be helpful to avoid arbitrariness and coercive instances by aloof Magistrates.

Clash between the Board and the Centre

The Bill suggests the establishment of a DNA Regulatory Board, empowered to have an advisory, supervisory and regulatory role. Additionally, it is primarily responsible for spearheading the development, research, and optimum use of the technology in different facets.

The Bill mentions that the Board should keep tabs on their conduct in accordance with international UN guidelines surrounding the Right to Privacy, the mandates of civil liberties, and ethical-social implications in the adoption of the technology and its testing. They can further recommend the Central Government for the application of privacy protection in relation to the access or use of DNA samples and their analyses. Their responsibility also extends to the granting of accreditation to laboratories for testing requisite procedures etc. and carries the power of revoking the grant on failure to comply with provisions of the Act, Rules and Regulations. It is evident that the Board has ample authority on its own to ensure compliance concerns.

However, as per the Bill power held by the Central government to supersede the Board indicates the fact that it may take priority the instance that it feels dissatisfied with the discharge of duties and functions being exercised by the latter, as well as to issue directions. In that regard, it may be realised that there is per se no independent authority that may be accorded to the Board or members of the Bank, which is already opaque and unaccountable in its composition. Space for the judiciary to comment on the functioning of the Board should be introduced, and an independent Board of Ethics should be established to keep checks and balances on their manifestation on the ground.

Nature of information collection

The sources of DNA collection may be diverse — in addition to "non-intimate bodily substances", like fingerprints, and hair or nail samples, the Bill extends its jurisdiction to "intimate bodily substances", such as semen and skin tissues. A step further, the Bill recommends several forms of "intimate forensic procedures", like genital swabs through invasive methods like vacuum suction, as well as photographs and video recordings of genital areas. The administration of such procedures must necessarily be conducted by extremely professional doctors, prescribed with certain protocol of monitoring their conduct with the consenting persons.

The National DNA Data Bank maintains indices of offenders, missing persons and unknown deceased persons, but also indices of suspects, and under-trials. Information in the Bank will be retained in exception of court orders. The information contained in the Bank is specified for investigatory or judicial purposes, but is easily accessible by any personnel of the Bank. Further, obtaining the DNA information without authorisation is also punishable in its regard. Although directions are given for the destruction of DNA samples and the removal of innocent persons from the database, the same has been urged to be automatic in nature for its compliance to international standards.

Profiling concerns

Several organisations have conducted research to indicate that there is a relationship between extensive police databases and the targeting of vulnerable citizens. Profiling and the harassment of innocent members of a community as well as blacklisting certain neighbourhoods, especially when unaware of their rights and are at the receiving end of unreasonable force at the hands of the bureaucracy, are real concerns.

The Centre for DNA Fingerprinting and Diagnostics (CDFD) already requires the caste of the suspect for the collection of DNA samples. The rigidification of a pre-existing institutional bias is bound to emerge from the practice of 'cold hits', which facilitates the search of DNA databases without any investigative leads. As a product of this, prejudice plays a primary role in the determination of guilt, and the reinforcement of criminality as an innate virtue among marginalized members of the society.

Privacy experts like Helen Wallace from GeneWatch UK, has indicated that privacy protections are missing from the Bill, such as the need to restrict DNA profiling so that it uses only non-coding DNA. She has recommended a separation of the databases for missing persons and for criminals, to avoid people who volunteer their DNA to locate missing relatives being subsumed as being criminals. She is wary of the use of the database for civil uses, such as paternity tests. Her analysis of the UK National DNA Database is helpful to realize that the success of the same was due to a number of crime scene DNA profiles loaded on the same, rather than the number of DNA profiles from individuals.

Usha Ramanathan, a prominent academic in the field of law and poverty, was invited to be part of a committee to review the Human DNA Profiling Bill 2012. On realising that the revised Draft of 2015 barely contained any of her research and recommendations, she published the note of dissent that she had written to Alka Sharma, the Director of DBT. The note addressed several additional concerns regarding the Bill that have emerged in the recent past. Usha Ramanathan's primary criticism surrounds the phenomenon of 'Databasing', i.e. the implications of the corporatizing effect of databases under the garb of 'national security'. In the Indian context, the Aadhaar/UIDAI project, surrounding the convergence of an individual's demographics and biometrics, has shown several chinks in the armour of "protected data", such as the recent expose by The Tribune of the availability of Aadhaar data by a mere payment of Rs 500.

Cost-benefit effectiveness

The primary concern of the Bill is the lack of a detailed financial plan for the allocation of funds for the development of DNA technology in India. As per an analysis of a similar system in the UK, the approximate expenditure of establishing the infrastructure, the collection and storage of samples and other operational costs could come up to Rs. 3,000 crore. Further, the mere cost of acquiring DNA samples from people arrested in India on criminal charges could be over Rs. 1,800 crore. The current allocation of Rs. 20 crores is completely inadequate, and is bound to compromise on the aforementioned issues of privacy and security. Such under-estimation further reflects the inexperience of the legislators in adopting such a Bill, without adequate research from comparative jurisdictions that have absorbed the same successfully. If the Central Government reflects an inclination towards the Bill, the Annual Budget of 2019 must discuss and further a substantial amount towards the development of DNA technology in India.

Enforcement methodologies

The DNA Bill has not been subject to review by either the Ministry of Home Affairs, or any law enforcement agencies. The intricacies surrounding DNA profiling and testing surround questions of adequate infrastructure, technical expertise, and most importantly, training pre-existing police personnel with the collection of such evidence from the crime scene. The Indian police force has been amply criticized for its shortcomings in their forensic data collection techniques. It is imperative that the collection process is free from any contamination, which has grave impacts on the arrests, suspense and ultimate conviction of the people involved.

Reliance on DNA Technology – Aims and Ambitions

Ramanathan in an interview stated that there were clear scientific ambitions that are fuelling the project, i.e. in fields of molecular genetics, cytogenetics, biochemical genetics, newborn screening, and the eventual establishment of a national database for genetic disorders. The 12^th Plan Document of the CDFD has revealed the same, and it is only evident that interest and funding towards the National DNA Bank may offer a gold mine for the conduct of scientific tests, further endangering the privacy of members of the database.

Lastly, Ramanathan has criticised the near-mythic but grossly inaccurate notion of the "infallibility of DNA technology", and the rhetoric, which identifies it as a better metric than the current prevailing methods in forensic technology. The recovery of DNA from crime scenes is often just a partial strand, with possible matches with any one else from a similar gene sequence. Hence, the repercussions of such from mislabeling and degradation may result in false incriminations.

The anxiety surrounding the mechanisation of law enforcement has been hitting India, however, the rush for the same under the garb of efficiency must not be irresponsible and haphazard. Before a reliance on the same, there is a necessity to equip agencies with adequate knowledge of the limitations of the science, for its judicious employment in the field.