How DNA Bill gives near-sweeping powers to the state to bulldoze privacy

Privacy violations under the DNA Bill cannot be addressed under the draft data protection bill

Following close on the heels of the release of the draft Personal Data Protection Bill, 2018 (PDP Bill) release, is the proposed DNA Technology (Use and Application) Regulation Bill, 2018 (DNA Bill), which was introduced in parliament this monsoon session. This DNA Bill is the latest in a series that originated as the “DNA Profiling Bill” in 2007. Since then, the proposed law has gone through multiple iterations – with each version raising privacy concerns, such as the lack of adequate standards for consent, notice, retention and security of data.

Chief amongst these privacy concerns is the fact that each of these iterations seems to grant near-sweeping powers to the state for the collection of DNA samples, with very few safeguards to protect citizens.

Unfortunately, the present DNA Bill does little to address these concerns. For instance, the Bill allows the state, through its law enforcement agencies, to collect “intimate bodily substances” from citizens with very questionable standards to protect their privacy. The consent mechanism under the DNA Bill appears to be entirely superficial. While it requires citizens to consent to the collection of their bodily substances, it does not define the term “consent” and provides no safeguards against forcibly obtained, unclear or uninformed consent. Further, even this low standard for consent is not considered paramount under the DNA Bill since a citizen’s refusal to give their consent to collection of their DNA can be overridden by a magistrate’s orders. To make matters worse, there is no provision for notice under the DNA Bill, meaning that requests for acquiring a citizen’s consent for collection of DNA are not required to adequately inform citizens of the purposes for the collection of their DNA, the uses that it could be put to or of the consequences of such collection for them.

The shortcomings under the Bill pose a serious threat to the right to privacy, which was recognised as a fundamental right by the Supreme Court in Puttaswamy vs Union of India. The court in its seminal ruling had mandated a comprehensive data protection law to give effect to the constitutional right to privacy. Subsequently, the Committee of Experts on Data Protection (“Srikrishna Committee”) came out with the PDP Bill to provide an overarching statutory framework to enable the fundamental right to privacy through mandatory data protection norms.

However, privacy violations under the DNA Bill cannot be addressed under the PDP Bill since section 43 of the PDP Bill exempts laws involving the investigation and prosecution of offences from compliance with its strict data protection safeguards. This section exemplifies one of the core criticisms against the PDP Bill, which is that it provides substantial leeway to processing of personal data by government agencies. In doing so, it skews the state-citizen relationship by granting the government with exemplary powers over citizens. Such powers are liable to be abused for impermissible surveillance of citizens by the state.

Fortunately, despite being exempt from the overarching statutory framework under the PDP Bill, the DNA Bill will still have to satisfy the constitutional three-part test of legality, necessity and proportionality as prescribed in Puttaswamy v. Union of India. The DNA Bill will satisfy the test of legality if it is passed by the parliament, as legality includes authorisation by the parliament through a valid law.

However, the provisions under the Bill will have to establish necessity, meaning that the law must be necessary for fulfilling a legitimate state purpose and proportionality of the proposed measures in order to pass constitutional muster. The Supreme Court has not yet prescribed any standards for necessity and proportionality in context of the fundamental right to privacy since Puttaswamy. Therefore, it is difficult to conclude if the DNA Bill will satisfy the tests of necessity and proportionality, respectively. Going forward, any ruling on the necessity and proportionality of the proposed measures under the DNA Bill may also reflect the judicial stand on dilution of data privacy standards for government agencies. One can only hope that Indian courts will continue the tradition of progressive interpretation to right of privacy as established in Puttaswamy.

Tuhina Joshi and Pushan Dwivedi are policy associates at TRA Law, an award-winning policy and law firm focused on emerging technologies. Find them on Twitter – @tuhinajoshi11 and @PushanDwivedi.

Published in arrangement with The Wire.