It is widely appreciated that we must stay vigilant for very unlikely but dangerous events, such as mass nuclear irradiation. Advances in technology mean that these dangers have proliferated beyond easy comprehension, which may explain our policy laxity on vital matters left to languish. Like privacy. Dystopian fiction may have run ahead of possibility as much as likelihood, but perils do lurk in the gross misuse of data. We do not need to take seriously the latest James Bond thriller, whose villain menaces the world with stolen genetic data encoded into gene-aimed viral weapons that can outdo Sars-CoV-2 in selectivity to wipe out particular families or entire gene pools, to widen our consideration set of threats should we fail to safeguard the specifics of our bio-identities. Our normative frame tends to picture only benign uses of data, as we expect the law to look after us and public authorities like law-enforcers not to go rogue. Yet, leaks do happen, even if they are rare. This should call into debate the Criminal Procedure (Identification) Bill, 2022, which looks set to give the Indian police legal access to the biometric and biological data of convicts and potentially also under-trials. As pitched, the basic idea is to let the cops bio-tag law-breakers in their records, just as they take fingerprints and so on, for a watchful eye to be kept on them. This concerns all our citizens, though, and clear restraints need to be placed on the idea by a privacy framework that we still lack.
Under the Bill’s proposals, as reported, the scope of what all could so far be sought under the Identification of Prisoners Act of 1920 will be enlarged to include iris and retina scans, analysis of physical and biological samples, and “behavioural attributes" such as a person’s signature, among other things, for a database that will be retained by the National Crime Records Bureau for 75 years. From a legal vantage point, while the Bill focuses on criminality, its text leaves space for data extraction from people other than convicts without due clarity on who all this may include. The proposal is clearer on bio-samples, which can yield genetic data and hence need tighter security; for these, the consent of an arrested individual would be mandatory, provided the suspect has not been charged with sexual offences against a child or woman, or accused of crimes punishable with at least seven years of jail. While this could act as a safeguard, in a country where assent can depend on power equations in lock-ups, awareness levels remain low and few can count on a pre-trial ‘right to remain silent’, it could get lost in the process of profile creation. Given how fuzzy the divide between norms and exceptions can prove in practice, the slightest exposure of people not yet found guilty could expose too many Indians to safety risks that will worsen over time as biotech possibilities expand.
No doubt, DNA and biometric grabs are valuable crime-solving aids today. Still, this utility needs to be filtered by our basic right to privacy, as upheld by our Supreme Court but yet to be given legislative shape. Tools like narco analysis and brain mapping must be regulated with reference to that right, just as the collection, storage and use of genetic data should be. Any aspect of law that abridges our privacy must not just be kept free of ambiguity in its application, but also be put to a careful cost-versus-benefit test before it’s adopted. This would help allay worries about, say, a civil protestor faced with the prospect of having a police record with invasive details.
