On 24th March 2022, the home minister Shri Amit Shah, introduced the Criminal Procedure (Identification) Bill, 2022 in Lok Sabha. As expected, it met with resistance by oppositions claiming it is unconstitutional and illegal. Unconstitutional on the grounds that it is against the Article 20(3) of the Constitution related to self-incrimination in a criminal case and also breach of privacy guaranteed under Article 21. It is declared illegal by opposition because it is not in consonance with the draft Data Protection Act 2021.
Before we dwell in to more details, here is the reason as to why this subject is appearing in this technical blog and what it got to do with Cybersecurity and Privacy. The reasons are:
We also provide Techno-Paralegal services hence the proposed law falls in its domain.
The proposed impacts access control in conceptual level also gives insight what all factors can be used for access control and what is their legal standing in Indian laws.
It has direct impact on privacy and security of prisoner's data. (Please note unlike west there is zero importance to the data who are under police investigation)
We as citizens of India must know our rights and right procedures to claim our fundamental rights and its limitations.
Before we dive deep here is the quick summary of the Criminal Procedure (Identification) Bill, 2022:
It replaces The Identification of Prisoners Act, 1920.
The law will be applicable mandatorily on offences committed. against women and Children or offences attracting more than 7 years of imprisonment.
National Crime Record Bureau will be the central controlling agency.
It will add or continue to use finger/palm/foot print, photo, iris/retina scan, ‘physical, biological samples for record of identification of offenders and prisoners.
It empowers police / prison officers to use coercive force in case of refusal, in addition to appropriate additional criminal proceedings. Additionally, a separate criminal case can also be initiated for refusing to give such sensitive personal data, here called as “measurement”.
Life of such data will be 75 years from the date of recording or dropping of criminal case.
Why this law?
The Eighty Seventh Report by the Law Commision of India dated 29 August 1980 had a complete look at the Identification of Prisoners Act, 1920 and made detailed recommendations to then government. But successive government sat on the report and did nothing. This bill not only implementing all the recommendations but has improved in terms of controls and privacy.
When The Identification of Prisoners Act, 1920 was brought in force, photography was a novelty and rarity. However, considering its utility, the Identification of Prisoners Act was enacted and empowered the police to take photographs and fingerprints. Now the new facets identification technologies are mature, therefore new technologies should become part of the century old law.
The Identification of Prisoners Act gives an impression that it deals with convicts only, but the fact is that The Identification of Prisoners Act deals with not only convicts but also all accuses arrested for a case where prescribed punishment is more than one year of rigorous imprisonment. Hence 87th Law Commision was not comfortable with the name of the legislation, as it gives false impression.
Understanding Identification vs measurement
Unauthorized access to data and resources is one of the most significant and dangerous risks of the digital world. Therefore, in digital world there is due process for access control through the triangle of Identification, Authentication and Authorisation. Identification is the person who claimed to be the one. Generally, ‘User Name’ is what comes under Identification. At the backend this identification is mapped to the profile filled during registration. Next is the verification approach called authentication, to validate that the user is who he claims to be there are four approaches discussed below. And on the basis of the Authenticated Identity is authorised access to the objects of which such identity is approved to have access to. The approaches to authentication are:
What you know- What that person has in his memory such as password, passphrase, own friends and phone numbers, images or sounds.
What you have – What is known to be in possession of the person such as identity card, smart card, mobile phone with specific number or authenticator device or tool.
What you are – What a person’s natural attributes including finger-impressions, palm-print impressions, facial recognition, iris and retina scan and voice sampling.
What you do – Analytics of actions so peculiar to a person that he can be so identified uniquely such as typing pattern (keystroke dynamics), signature pattern (signature dynamics) or voice pattern.
Where you are – It is an important factor especially for financial transaction.
In criminal investigation it is necessary to link criminal to the impugned offence. And also, it may be necessary to track an offender when allowed to go in public like on bail or furlough. The existing law allowed only signature and photograph for linking the person with his identity. Though the existing and proposed law call such traces of evidence as identity but for technologist what it means is authentication of the claimed identity. The proposed law deals with approach iii and iv of authentication to link the evidence with the person (accused or convict) so identified. Having set the context for technologists (Techno-paralegal) let's see details of law.
In fact, there is a legal term “Criminalistic” which covers the criminal jurisprudence where technology helps in crim investigation and trial. It is to take the sensitive personal data and ‘measure’ it against the evidences collected to link a specific human being to the evidence.
Is the propose bill progressive or regressive?
There has been lots of bad press about the Bill. The article is not to defend the bill but look at all angles to the Bill before reaching any conclusion.
The law related identification has not come out of blue, but as stated earlier that it is an amended version of The Identification of Prisoners Act, 1920. In fact, the structure and wordings are almost same. Therefore, the question comes to the mind is, why not call it The Identification of Prisoners (Amendment) Act, 1920 or The Identification of Prisoners Act, 2022? Though, the Identification of Prisoners Act sounds like as if it is applicable only on convicts but the existing law is applicable on accused too as explained earlier. To resolve this sense of wordings, the 87th Report of Law Commision has recommended that it should be made part of the Code Criminal Procedure (CrPC). However, the government has done an intelligent act by naming it as Criminal Procedure but not by amending directly or through Schedule the Code of Criminal Procedure, 1973 (CrPC). This serves two purposes.
Had it become the part of CrPC, then due to Section 4 and 5 of CrPC, other laws can overrule it.
By being an independent law, as this is the latest law, it overrules all other existing laws on similar subject.
Persons whose measurements can be taken The existing The Identification of Prisoners Act covers any person convicted or accused (but does not cover the detainee) who is awarded or may get awarded enhanced (more than) punishment of one-year rigorous imprisonment. Also, any person ordered to give security for his good behaviour. The new law has modified it to cover following persons:
Any person convicted, arrested or detained under any preventive detention laws.
When ordered to give security for:
Good Behaviour for keeping peace and public tranquillity
Good behaviour from person disseminating seditious matter
Good behaviour from suspected persons
Good behaviour from habitual offender
However, a person may legally empowered to refuse to give measurement if the associated punishment is less than seven-years of imprisonment, except if offence is committed against a child or a woman. This is dramatic improvement where existing law is applicable on all who are or can be punished with more than one year of Rigurous Imprisonment (RI).
What will be measured and record kept? The existing law allows measurement of:
Height, weight and any other body part
finger impressions
foot-print impressions
AND Photographs (in 1920)
The bill in the Parliament proposes measurements of:
Height, weight and any other body part
finger impressions
palm-print impressions
foot-print impressions
Photographs
Iris and retina scan
Physical, biological samples and their analysis (basically any anthropological interest)
Behavioural attributes.
Relevant biological measurements and DNA (only) in rape cases
Physical and Biological samples include teeth impression or nail size etc. But not DNA. DNA in specific is not included in general measurements because of several restriction imposed by the Supreme Court of India. Similarly, Voice measurements are not included due to existing bar by the Supreme court that such sample should be taken only with due permission of the concerned court.
Under the both laws, Courts can issue orders to take any types of listed and unlisted measurement to be collected but by giving detailed reasons in writing. For example, while granting bail to an accused or furlough to a convict who had earlier refused to oblige to give measurements. Also, for any specific requirement to ensure tracking of such person.
Please note, unlike previous era, modern technologies can be used for analytical purpose and almost live tracking.
Control over Measurements
Both laws do direct the concern police/prison officers to exercise due control during the life cycle of the measurements, but new safeguards are built in the new law.
The National Crime Record Bureau (NCRB) is made central repository through this law for collecting, sharing, storing and destroying all such measurements taken. The State governments are to (through respective legislation or notification) identify the manner and police/ prison officers and entities who will be authorised to collect, preserve and share such measurements. However, all measurements are to be shared with NCRB. All law enforcement agencies can get necessary support from NCRB central repository of measurements for appropriate investigation. This means that any person whose data was previously collected can be easily identified and repeat offenders will be under check.
Life of all measurement in the existing act is till perpetuity except in case accused person is not sent for trial, discharged or acquitted, then his photograph only (all negatives and positives) to be either handed over to him or destroyed except when so clearly ordered by the court not to do so. While in the Criminal Procedure (Identification) Bill, 2022, all measurements are to be in electronic form and are set to a life of 75 years. And in cases where accused person is not sent for (released without) trial, discharged or acquitted, then such records to be destroyed by NCRB on finality of such decision.
Use of force to get measurements
Both laws allow the use of appropriate force as given in the relevant rule to get the measurement from the convict or accused person. However new bill permits accused / convicts/ detainee of punishment of less than seven years, may not be to oblige to give such measurements except in case of crime against child or woman or if ordered by the court. In last more than 100 years there have been no challenge ever to the Identification of Prisoners Act, 1920 in respect of it permitting coercive power to get the measurement, hence any objection to it is without grounds. In fact, in some ruling the Supreme Court has direct to use necessary force to get the signature, when so ordered by the trial magistrate.
Additionally, the proposed Bill recommends invoking Section 186 of IPC if the accused/prisoner/detainee refuse to give measurement. A refusal to give measurements may amount to obstruction a government official from doing his duty and the punishment for such an act can be up to six months of jail time or/and Rs 5000/- fine. This incorporation is based on the Law Commision report of 1980.
Interestingly the new bill has Henry VIII clause. It allows the government to make rules which can modify the law to overcome any difficulty in implementation but only in accordance with the “spirit of law”. This is not the part of existing The Identification of Prisoners Act, nor was recommended by the Law Commision.
Is it illegal or Unconstitutional?
The Criminal Procedure (Identification) Bill, 2022 is not unlawful or illegal as it is almost copy of existing statue and most of the amendments including change of heading is in accordance with the Law Commision report.
There are two competing interests, on one side the privacy of a person protected under Article 21 and Protection of Self-incrimination by a person as a fundamental right under Article 20(3)
Article 21 provides for expectation when such fundamental rights are curtailed by the due procedure established by law. Therefore, the bill establishes the procedure for collection of such Sensitive Personal Identifiable Information (SPII). Infact it is better to create formal procedure in light of Justice Puttaswamy Vs UOI judgement. Therefore, it is with in the constitutional duty of the legislature to establish procedure where the Fundamental Rights are being curtailed in any manner, and this Bill meets the requirement.
There has been legal discussion around Article 20(3) of the Constitutions as to what constitute “self-incrimination”. Through various and repeated judgements, the Supreme Court has unambiguously ruled that “non-Communicative” evidences are not prohibited by the constitution. The list of items placed under the new definition of ‘measurement’, all falls under the “non-communicative” assessment of the accused/detainee/ convict hence will not be barred by the Constitution under fundamental rights.
The legislature is fully with in its power to overrule/modify any law made through the judgements of the Supreme Court and the High Courts. However, the proposed bill is aligned with the general trend followed by the courts in respect of Voice and DNA. Voice sampling could very well be included in the Bill; however, it has not been done probably because of multiple rulings where such sampling should be taken in front or with specific approval of the trial court. Though Voice sampling is recommended by the Law Commision. The signature is also not covered under the proposed bill because same is covered under Section 73 of The Indian Evidence Act, 1872. Hence Voice samples and Signature are part of judicial proceedings (and not investigation) to link the collected evidence with the accused or to set him free.
The Criminal Procedure (Identification) Bill, 2022 also ‘indirectly’ impacts the Foreigner’s Act and the Passport Act, where collection of such Personal Identifiable measurements can become the part. Now all these measurements can be collected for grant of passport to Indians and Visa to foreigners.
Challenges by Modern Technologies
On the legal and constitutional front, the Criminal Procedure (Identification) Bill 2022 is on firm ground. However, the technology is moving at revolutionary pace and therefore poses serious challenges to the proposed Bill.
The bill does not cover the aspect of cybersecurity and appropriate technological and procedural controls for any loss or misuse. The Personal Data Protection Act or Data Protection Act is some distance away. It is also possible that NCRB may come under exempted list of PDPA/DPA. There is no provision for loss of such measurements or their abuse. Under present legal structure, it is nearly impossible to prosecute any police officer from such abuse.
Technologies like Artificial Intelligence and 3D Printing creates challenges which find no mention in the Bill. There are multiple rulings where the courts have held that “A fingerprint is an unforgeable signature of a person”. Same is no more true. Using 3D printing it is possible to create finger print of a person who has never met the creator of forged finger print. There have been instances where one can get his finger-print forged copy to undertake attendance while the person is not present. Even Iris can be copied in eye lens and can be worn to implicate an innocent. No protection is built for creating false evidence. Sadly, various rulings of the Supreme Court have made Section 193 to 197 IPC ineffective. These section deals with dirtying the course of law. Probably these laws require revival either through case laws or through legislation.
Deep fakes, filters and many Artificial Intelligence technologies are in the hands of common people creates own challenge. Deep fakes can create almost real voice and video of a person using Artificial Intelligence. The proposed bill should have built in safeguards to protect innocents.
Conclusion
The Criminal Procedure (Identification) Bill, 2022 is nothing but overdue amendments to the Identification of Prisoners Act, 1920. Nomenclature and other changes are in accordance with the recommendation by the Law Commision way back in 1980. It does breach any Fundamental Rights and have additional safeguards. However, the proposed Bill does not look into near future which will have direct impact on it using 3D Printing and Artificial Intelligence.
31 March 2022
Comments