Article 21, Privacy and the Holding of Forensic Data
Chapter Twenty-Seven
Syllabus topic 1, "Forensic Science – An Integral component of Criminal Justice system – scope."
Pages 114 to 117 of 654
In one line
Taking a fingerprint is one question; keeping it for seventy five years in a national database is another, and the second is a question about privacy.
In the wording a student can write in an exam: since privacy was held to be a fundamental right protected by article 21, a State measure that invades it must satisfy three requirements, namely the existence of a law, a legitimate State aim, and proportionality between the object and the means adopted, together with procedural safeguards against abuse. Forensic data raises the question in its sharpest form, because collection may be justified by an investigation while indefinite retention, unrestricted sharing and the absence of any regulatory body are separate invasions that the justification for collection does not answer.
Why collection and retention are different questions
An accused's fingerprint is taken because there is an investigation. That is a specific purpose, applying to one person, for a limited time.
The record then goes to a national database, where it is stored for seventy five years, processed with other records, and shared with any law enforcement agency. None of those things is done for the investigation. They are done for the general purpose of building a national identification capacity, and they continue long after the case has ended.
The mistake most answers make is to treat the second as though it were justified by the first. It is not, and the analysis has to be done twice.
The three part test
A law. The invasion must be authorised by a valid law. The Criminal Procedure (Identification) Act, 2022 satisfies this: it is a statute.
A legitimate State aim. Prevention, detection, investigation and prosecution of offences is plainly legitimate, and the Act says so in section 4(1).
Proportionality. This is where the argument is. The measure must be a rational means to the aim, must be no more intrusive than necessary, and must strike a fair balance. Four features of the Act make this contestable.
- Seventy five years. No investigative purpose requires a record for that long.
- The class of persons. The Act reaches arrested persons and preventive detenus, who have been convicted of nothing.
- The width of "measurements". Biological samples and their analysis are included, so genetic material is within it.
- The absence of an independent regulator. There is no body to authorise, audit or restrict access, and no statutory limit on what a receiving agency may do with a record.
What is missing from the Indian framework
There is no DNA statute. The DNA Technology (Use and Application) Regulation Bill, 2019 was withdrawn from the Lok Sabha in July 2023. There is no DNA Regulatory Board, no statutory data bank with defined indices, no statutory accreditation regime for laboratories doing DNA work, and no statutory rules on consent, on retention, or on the destruction of profiles. Every textbook that describes the Bill as law is wrong.
Article 21, Privacy and the Holding of Forensic Data
The data protection statute is not yet in force in substance. The Digital Personal Data Protection Act, 2023 has been enacted, but its substantive provisions are being brought into force in stages and the timetable notified in 2025 postpones most of the obligations. In any event the Act contains wide exemptions for the State in the interest of the prevention, detection, investigation or prosecution of offences, so it would not answer the objections to the Act of 2022 even when fully in force.
There is no post-conviction testing scheme. Retained material could be re-examined as techniques improve, and no statutory route to it exists.
The honest conclusion for an answer is that India has built the collection half of a modern forensic identification system without building the regulation half, and that the gap is the subject on which this part of the paper is examined.
A worked example: the same fingerprint, three lives
Ajinkya Patil, aged nineteen, is arrested in 2026 for an offence of rioting. His fingerprints, photograph and iris scan are taken under the Act of 2022 and go to the National Crime Records Bureau.
Life one: the investigation. The prints are compared with a chance print from the scene. There is no match. The purpose of collection is exhausted.
Life two: the database. The record sits in the Bureau's system. It is processed with crime and criminal records and may be shared with any law enforcement agency. Every future search of a chance print anywhere in India runs against it. Ajinkya has become a permanent suspect in every unsolved case with a print.
Life three: after the acquittal. He is acquitted in 2031. Because he has no previous conviction, the proviso to section 4(2) requires the record to be destroyed, but only after he has exhausted all legal remedies, and only if no court or Magistrate directs retention for reasons in writing. If the State appeals, the record stays. If nobody applies for destruction, in practice it stays.
The proportionality argument in one sentence. The State's interest in identifying offenders is real, but it is not obviously served by holding the biometric record of a nineteen year old acquitted man until 2101, and the burden of justifying that lies on the State.
The counter-argument, which a good answer states
Identification records are not new. The Identification of Prisoners Act, 1920 did the same thing for a century with fingerprints and photographs, and nobody suggested it was unconstitutional.
Comparison requires a database. The whole utility of a chance print is that it can be searched against records, and a database that is emptied on every acquittal is much less useful.
Article 21, Privacy and the Holding of Forensic Data
The taking is not testimonial. On Kathi Kalu Oghad the collection is unobjectionable, and the objection is confined to retention and sharing, which is a narrower target.
The destruction proviso exists. The Act does provide for destruction, which the Act of 1920 did not, so the position is better than before rather than worse.
A candidate who states the objections and then meets them is writing an LL.M. answer. One who states only the objections is writing a pamphlet.
Distinctions
| Collection | Retention and sharing | |
|---|---|---|
| Justified by | the particular investigation | the general aim of building a capacity |
| Duration | the case | seventy five years |
| Constitutional test | article 20(3), settled by Kathi Kalu Oghad | article 21 proportionality, unsettled |
| Regulator | the court and the Magistrate | none |
What beginners get wrong
Treating the privacy judgment as making forensic collection unlawful. It does not. It sets a test that the collection comfortably passes and that indefinite retention may not.
Saying India has a DNA law. It does not. The 2019 Bill was withdrawn in July 2023.
Saying the data protection Act protects an accused. Its State exemptions cover exactly this activity, and its substantive provisions are being commenced in stages.
Confusing the destruction proviso with automatic deletion. It applies only to a person not previously convicted, only after acquittal or discharge with all remedies exhausted, and is subject to a court's direction to retain.
Quick revision
- Privacy is protected by article 21, and an invasion must satisfy legality, a legitimate State aim, and proportionality with procedural safeguards.
- Collection and retention are separate questions and the justification for one does not answer the other.
- The Criminal Procedure (Identification) Act, 2022 retains records for seventy five years, covers arrested persons and preventive detenus, includes biological samples and their analysis, and has no independent regulator.
- India has no DNA statute: the DNA Technology (Use and Application) Regulation Bill, 2019 was withdrawn in July 2023.
- The Digital Personal Data Protection Act, 2023 is being commenced in stages and exempts the State for the prevention, detection, investigation and prosecution of offences.
- The counter-arguments are the century of practice under the Act of 1920, the necessity of a database for comparison, the settled position on collection, and the destruction proviso.
Test yourself
1. What must a State measure satisfy to justify an invasion of privacy? The existence of a law, a legitimate State aim, and proportionality between the object and the means adopted, together with procedural safeguards against abuse.
2. Why must collection and retention be analysed separately? Because collection is justified by a particular investigation and ends with it, whereas retention, processing and sharing serve a general purpose that continues for decades after the case is over. The justification for the first does not establish the second.
Article 21, Privacy and the Holding of Forensic Data
3. State three features of the Act of 2022 that make its proportionality contestable. The retention of records for seventy five years, its application to arrested persons and preventive detenus who have not been convicted, and the inclusion of biological samples and their analysis without any DNA statute or independent regulator.
4. Does the Digital Personal Data Protection Act, 2023 answer the objection? No. Its substantive obligations are being brought into force in stages, and it contains wide exemptions for the State in the interest of the prevention, detection, investigation and prosecution of offences, which is precisely the activity in question.
The rest of this subject
These notes are cut from the University's printed syllabus. Open the syllabus itself, or the past papers, for the same subject.