Introduction
Deoxyribonucleic acid (‘DNA’) is a complex hereditary material present in all living beings. The composition of the human DNA sequence is nearly 99.99% similar in every person. However, that 0.01% DNA remains unique enough to distinguish one individual from another. This unique, miniscule part of our DNA can be used to generate a DNA profile. DNA of any organism can be extracted from its saliva, hair/fur, blood samples, or from the nail scrapings.
From verifying paternity claims, to identifying and uniting families, to solving crimes, DNA profiling and fingerprinting technology[3] is used in numerous situations, and is undoubtedly a ground-breaking technology. In the context of law enforcement, DNA fingerprinting has been instrumental in securing fairly accurate correct convictions, as well as exonerating the innocent.
Despite its varied benefits, the misuse of DNA profiling technology could lead to serious ramifications for the concerned individual; it has potential for invasion of individual privacy, owing to its sensitive nature. Moreover, owing to environmental factors, DNA profiles may not often be clean enough to conclusively identify an individual; this could lead to wrongful convictions.
Thus, it becomes imperative for lawmakers to regulate such technology, and monitor its usage for the benefit of the society. In India, a prime example of such a legislation is the controversial DNA Technology (Use and Application) Regulation Bill, 2019 (‘the Bill’).
Legislative History of the Bill
In India, the initiative to draft a bill governing DNA profiling started in 2003.[6]
The Department of Biotechnology set up a committee called the ‘DNA Profiling Advisory Committee’, to commence the drafting of the DNA Profiling Bill, 2006.[7] Eventually, this became the Human DNA Profiling Bill, 2007.[8] The aim of this bill was limited to regulate the use of DNA technology to identify missing persons, victims, offenders, under-trials, and anonymous corpses.[9]
This bill underwent a series of changes until 2012. In January 2013, the erstwhile government established a committee to examine the 2012 draft.[10] This analysis was completed in late-2014, and the draft was circulated within the Ministry of Science & Technology for comments.[11]
In January 2015, the revised document was sent to the Legislative Department of the Ministry of Law & Justice, wherein the “Use and Regulation of DNA-based Technology in Civil and Criminal Proceedings, Identification of Missing Persons and Human Remains Bill, 2016” was redrafted as the “DNA Technology (Use and Regulation) Bill, 2017.”[12]
It is interesting to note that these legislative iterations have received considerable criticism[13] owing to concerns of bodily and informational privacy violations, lack of safeguards against the same, ambiguous language regarding the definitions of persons whose samples are to be collected, unclear objectives, as well as wide discretionary powers granted to the State.
Despite these serious concerns, this Bill, which regulated the use of DNA technology to establish the identity of persons in listed criminal and civil matters, was first introduced in the Lok Sabha in August 2018; however, it eventually lapsed at that time.[14]
In January 2019, the Bill was reintroduced, where it was passed by the Lok Sabha after a short discussion round.[15] However, it was not tabled before the Rajya Sabha for discussion, and lapsed when the previous government’s tenure ended in May 2019.[16] When the incumbent government resumed after the general elections in June 2019, the Bill was referred to the Parliamentary Standing Committee on Science and Technology (‘Standing Committee’) chaired by Mr. Jairam Ramesh, and comprised 10 members from the Rajya Sabha and 31 from the Lok Sabha, in October 2019.[17]
In February 2021, the Standing Committee submitted its report, raising issues of privacy violations, profiling against minorities, and independence of the proposed regulator – the DNA Regulatory Board (‘DRB’).[18]
Presently, the Bill is under consideration by the current Government.[19]
Features and Criticisms of the Bill
The new Bill envisages the streamlined use and regulation of DNA profiling technology for the purposes of identifying missing or deceased persons,[20] as well as tracking repeat offenders to aid the criminal justice system.[21]
Some salient features of the Bill include the use and collection of DNA data for – offences under the Indian Penal Code, 1860, civil matters such as paternity suits, and matters relating to establishment of individual identity.[22] In case these situations arise, bodily substances of persons may be consensually collected by the investigating authorities, to prepare a DNA profile.[23]
It is especially concerning to note that even if a person does not give consent for DNA collection, the police or other law enforcement authorities can approach a Magistrate, who may order the taking of bodily substances of such persons, if he or she believes that analysing those substances may confirm or disprove culpability.[24] Such non-appealable discretionary powers override basic standards of consent, and grossly violate an individual’s right to bodily privacy and autonomy.
Further, the Bill provides for the establishment of a National DNA Data Bank and Regional DNA Data Banks for every state or two or more states, with whom DNA laboratories are required to share prepared DNA samples.[25] Data Banks are mandated to maintain indices for “crime scenes”, “suspects” or “undertrials,” “offenders”, “missing persons’ index,” and “unknown deceased persons.”[26]
However, neither of these terms are defined in the Bill. Moreover, authorities could have unregulated discretion to name any person as a suspect – regardless of the nature of evidence against them. Despite the presumption of innocence under law,[27] this Bill implies that any person suspected of having committed a crime, may have to be subjected to invasive DNA profiling.
What is especially unsettling is that given the prevalence of caste and community-based biases and profiling in the Indian criminal justice system, it is possible that oppressed and minority groups are disproportionately targeted under the “suspects” or the “undertrials’ index.” The Indian policing system has historically believed that it is “far easier to prosecute a prisoner on a charge of belonging to some ill-defined criminal collectivity, than to establish individual responsibility for a specific criminal offence.”[28] Considering this ingrained tendency, it is possible that DNA information can be used to create familial linkages,[29] to further substantiate group-based profiling.
With respect to the entry, retention, or removal of DNA profile records, the Bill sets out vague criteria for the same; it states that the DNA profile of any person will be removed from DNA Data Bank, in a manner specified by ‘regulations’,[30] except in cases (i) of a suspect, if a police report is filed, or court order given, (ii) of an undertrial if a court order is given, and (iii) on written request, for persons who are not a suspect, offender or undertrial, from the crime scene or missing persons’ index.[31] These ‘regulations’ have not been specified, or defined anywhere in the text of the Bill.
Further, all the information pertaining to samples, which is contained in the National DNA Data Bank and the Regional DNA Data Banks may be made available by the Director, at his discretion, to private personnel of any DNA laboratory, for the sole purpose of training, in accordance with regulations.[32] Neither does the Bill explain what these regulations are, nor does it mandate the following of any anonymisation procedures to ensure data security.
Thus, such provisions could lead to situations where an individual’s data, when collected from a crime scene, could end up in any DNA laboratory, without their explicit consent. Moreover, there is limited opportunity to get such records deleted as well.
In addition to these issues, the Bill also does not mention how long such data can be stored for, whether the data collected for one case can be used for another, or who all has access to the data within the Data Banks, including third-parties.
In context of the global debate on personal data security, the need for safeguards to ensure the deletion of DNA profiles or samples of innocent people, coupled with India’s history with personal data breaches,[33] this legislation raises more concerns than the problems it claims to address.
The Bill aims at creating the DRB, comprising experts, directors of central investigative agencies, to superintend the standardisation of DNA profiling, by overseeing, as well as granting accreditation to DNA Data Banks and laboratories.[34] The DRB is entrusted with the responsibility of maintaining confidentiality of all information relating to DNA profiles.[35] However, there are no specific penalties levied on the national or regional DNA Data Banks, in case of data breach.
However, Section 57 of the Bill completely ousts the jurisdiction of the court, in respect of any matter which is to be determined by the DRB. Essentially, courts cannot question any act of the DRB by virtue of judicial review,[36] thus granting the latter overriding authority to the DRB, for taking unchecked initiatives. Such arbitrary provisions effectively leave no remedy for the infringement of privacy rights of citizens.
Suggestions
Under Article 20(3), the Indian Constitution guarantees a right against the self-incrimination. However, in a serious of judicial decisions,[37] courts have held that – “when there is apparent conflict between the right to privacy of a person not to submit himself forcibly to medical examination, and duty of the court to reach the truth, the court must exercise its discretion only after balancing the interests of the parties and on due consideration whether for a just decision in the matter, DNA test is eminently needed.”[38] Essentially, depending on the facts and circumstances of the case, it would be permissible for the court to direct the DNA examination, to determine the veracity of the allegations made in a case.[39]
Given that DNA examination could be requisite in criminal investigations or judicial examination depending on the context, thus, in my opinion, the current form of the DNA Bill requires considerable strengthening. It needs to be significantly redrafted, so that it upholds judicial integrity, while safeguarding the fundamental rights of Indian citizens.
The Bill should envisage sufficient safeguards, including satisfying the three-prong test of legality-necessity-proportionality,[40] for obtaining the consent of suspects before taking their DNA samples, as laid down in Puttuswamy v. Union of India.[41]
The consent of suspects regarding DNA collection, should be obtained in the presence of a Magistrate. For other purposes, the persons whose DNA samples are sought should have a meaningful right to opt-out. If that is not feasible, at the very least, there should be a limited period till which such information can be retained with the authorities.
Tampering of DNA evidence continues to be a huge risk, as police officers are ill-equipped to protect samples from getting leaked or destroyed.[42] Hence, it is imperative to extensively train all individuals and authorities, especially police officers concerned with crime scene investigation, collection, sampling, profiling, and uploading of DNA evidence on databases. Moreover, it might be beneficial to have independent agencies conduct collection and sampling procedures, to negate any possibility of collusions between investigating agencies and first responders.
In order to minimize the risks associated with community and caste-based biases, to eventually ensure fairer investigations, a strong anti-casteist clause or proviso could be included in the Bill. Such a provision should tie up specific casteist targeting in this Bill, with the Scheduled Tribes Prevention of Atrocities Act, 1989 (‘PoA Act’), so that any casteist action under this Bill is an offence under the PoA Act.
Considering the large size of the Indian population, it is a mammoth task to safely collect, profile, and store all forms of DNA data samples. Further, the crime investigation system lacks the infrastructure and investment required for maintaining a large databank.[43]
Accordingly, distinct standards for obtaining consent, and retaining DNA samples should be created for distinct categories of people, i.e. “people associated with criminal proceedings,” and “people not associated with criminal proceedings” (i.e. those looking to locate their missing relatives or unknown deceased persons).[44] The ambiguous language of the Bill should be redrafted to exclude “people not associated with a crime,” from the ambit of the Bill.
Further, to improve security measures for DNA sample protection, as practiced by American biotech companies,[45] blockchain technology can be used to decentralize the database of DNA samples.
Blockchain is essentially a type of information technology which does not rely on one central server, instead all its users are part of the network, forming a ‘decentralized’ server, that is a secure, anonymous way to share information.[46] The decentralized database ensures that there is no single point of failure, i.e. a single database server which could stop functioning. Essentially, blockchain technology enables the creation of a decentralized, immutable, and incorruptible ledger for storing sensitive information.[47] However, to implement radical suggestions such as these, it is imperative to conduct specific research and development in this space.
Further, scientific certainty in forensic science must be developed, prior to envisaging the ambitious, yet ambiguous provisions in the Bill. Once the foundational science and technology issues are addressed, and there are adequate safeguards to protect personal data, implementation of this legislation could be a lot more feasible and ethical.
