DNA Bill: To ensure justice is 'gene'-uine, govt must ensure privacy of individuals is respected as well

DNA profiling and testing are increasingly being used in investigations in India. The Union Cabinet in the second half of the year 2018 approved the DNA Technology (Use and Application) Regulation Bill, 2018 (the “DNA Bill”) to effectively regulate the use of DNA-based technology for speedy delivery of justice. The DNA Bill intends to regulate the use of DNA-based technology for identifying individuals including victims, offenders, suspects, under-trials, and missing persons. While the intention behind the DNA Bill is certainly a welcome measure, some inconsistencies and uncertainties have sparked a nationwide public debate. The current Indian data protection regime, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, classify DNA profiles as sensitive personal information. DNA profiles are the result of analysis of a DNA sample for establishing human identification. However, these rules do not apply to government bodies. The Supreme Court in Justice KS Puttaswamy (retired) and Another Versus Union Of India And Others held that Indian citizens have a fundamental right to privacy. This right cannot be trammelled upon, unrestrained by the rule of law, by government bodies. The DNA Bill should be amended to take into consideration the right to privacy and the Personal Data Protection Bill, 2018. [caption id=“attachment_5872701” align=“alignleft” width=“380”] Representational image. Reuters[/caption] Consent is the lynchpin around which provisions with respect to personal data protection revolve. The DNA Bill states that if written consent for collecting bodily substances is denied by a person arrested for offences other than offences punishable with death or imprisonment exceeding seven years (for which no consent is necessary); or by parents/guardians of minors, the investigator may approach a magistrate for an order to collect samples. The assumption/forcing of consent, in order to fulfil the requirements of law and order, is certainly appropriate. The DNA Bill also makes provision for cross-border sharing of information pertaining to DNA profiles and grants vast powers to the Central Government to decide the nature and extent of such sharing. However, the DNA Bill does not contain safeguards (eg, on why consent will be forced or assumed, exceptions to personal consent, and guidelines on sharing DNA data across borders) which are necessary to guide and mould the exercise of this power whilst being respectful and cognizant of individual liberty. Part of an Indian citizen’s right to privacy, importantly, includes the right to be forgotten. The DNA Bill fails to provide any specific time period for which information contained in a crime scene index will be retained. In the process of DNA profiling, certain other personal data could be revealed (eg, immunity, diseases existing on the body — both diagnosed and not yet diagnosed — and fertility). The DNA Bill fails to provide any clear mechanism to handle such additional or resultant sensitive and personal data. The DNA Bill should provide a grievance redressal mechanism for addressing the complaints of individuals whose data is being stored or processed. This is a surprising omission in a time of heightened sensitivity with respect to personal rights and freedom. We would have also liked to have seen some liability for data breaches which are due to negligence. The standard of protection afforded to sensitive and personal data should be mandated to be as high as it can possibly be. The DNA Bill makes provisions for the establishment by the government of a National Data Bank and other regional data banks for storing DNA profiles and related information. Side-stepping the debates for and against nationalisation, such a measure also implicitly comes at a huge cost, both one time and recurring, to the government. We wonder if such an expense will impact not only implementation but also cause other issues to emerge as the cost conundrum is dealt with. The DNA Bill does not deal with how the information from a crime scene or relating to an individual will be given to the DNA laboratories. The chain of custody and command with respect to DNA profile analysis is not clear from the DNA Bill. In the context of expediting justice and considering the short life of some material, it would also have been useful for the Bill to contain provisions with respect to the time within which samples will be analysed. We do not mean to be only negative towards or overly critical of the Bill. The Bill appears to seek to regulate the use of DNA materials for facilitating identification of individuals, and expediting delivery of justice on one end and to protect the privacy rights of an individual on the other. These are laudable objectives and much-needed not only in India but also worldwide. However, the construct within which the DNA Bill now exists includes the new Personal Data Protection Bill, 2018 (proposed and pending before the Parliament), and the Supreme Court’s decision on the right to privacy. The gaps in the DNA Bill and a fairly visible lack of clear guidance on the exercise of discretionary powers under it are difficult to ignore. This proposed law perhaps needs some blanks filled in, budgetary allocations checked and more deliberation from a process and privacy perspective before being enacted. This is ‘gene’-uinely (pun intended) one circumstance where we feel the sooner this happens, the better for India. The authors are members of IndusLaw, a multi-speciality Indian law firm