tl;dr
The Criminal Procedure (Identification) Act, 2022, grants broad powers to collect personal data from individuals in the criminal justice system, with indefinite retention and sharing between agencies, raising privacy concerns. We challenged its constitutionality in the Supreme Court, where the Division Bench directed us to approach the High Court instead.
Why should you care?
The Criminal Procedure (Identification) Act, 2022, and its rules grant excessive powers to authorities to collect highly sensitive personal data from individuals in the criminal justice system, without linking this collection to the nature of the alleged crime. This arbitrary data collection lacks safeguards and fails to limit retention periods, allowing data to be stored for up to 75 years. The Criminal Procedure (Identification) Act, 2022, and its Rules also permit the sharing of sensitive information with law enforcement agencies without clear regulations, perpetuating privacy risks, and do not mandate data deletion after acquittal. Moreover, the Act delegates critical decisions on data handling to secondary legislation, bypassing proper democratic oversight and scrutiny.
Background
On April 18, 2022, the President gave assent to the Criminal Procedure (Identification) Act, 2022, [“Criminal Identification Act, 2022”] which grants law enforcement agencies sweeping powers to collect sensitive personal data from "convicts and others". It replaces the older Identification of Prisoners Act, 1920, which permitted the collection of identifying information such as fingerprints and footprints from convicts and arrested individuals.
While the Identification of Prisoners Act, 1920, did allow for the collection of personal information, its scope was far more limited. However, the Criminal Identification Act, 2022 significantly expands the authorities' power. The Criminal Identification Act, 2022, allows for the collection of far more detailed data, and its implementation has raised serious concerns, particularly around privacy. The Criminal Procedure (Identification) Rules, 2022, notified on September 19, 2022, carry forward many of the issues in the Criminal Identification Act, 2022, including excessive delegation that makes them unconstitutional and goes beyond the Criminal Identification Act, 2022's scope.
One of the most concerning aspects of the Criminal Identification Act, 2022, and its Rules is its shift from identification to criminal profiling. It explicitly aims to "establish the crime of the accused," expanding surveillance powers significantly. With little oversight, this could lead to serious privacy violations. The Criminal Identification Act, 2022, was introduced without public consultation, and its privacy implications are substantial.
We approached the Supreme Court
IFF, in collaboration with the Criminal Justice and Police Accountability Project [“CPAP”], filed a Public Interest Litigation [“PIL”] challenging the constitutionality of the Criminal Identification Act, 2022, and corresponding Rules, in the Supreme Court, titled Internet Freedom Foundation and Ors. v. Union of India and Ors. [W.P. (Crl.) Diary No. 53491 of 2023]. It was argued that firstly, the Act and Rules grant excessive powers to collect sensitive data (e.g., fingerprints, iris scans, biological samples) from nearly anyone in the criminal justice system, without clear links to the nature of the offense. This makes the collection arbitrary and open to misuse.
Secondly, the Criminal Identification Act, 2022, allows indefinite data retention (up to 75 years) without sufficient safeguards, violating privacy rights. It also permits the sharing of sensitive data between agencies without regulation and fails to mandate deletion after acquittal, further risking privacy violations.
Thirdly, the Criminal Identification Act, 2022, delegates key decisions on data collection and sharing to secondary legislation and an unaccountable SOP, bypassing necessary legislative scrutiny.
What happened in the Supreme Court?
The matter was heard by a Division Bench consisting of Justices Sanjiv Khanna and Dipankar Datta. Despite the Petitioners' efforts to seek intervention by the Supreme Court, the Bench was not inclined to entertain the writ petition under Article 32 of the Constitution. The Court directed the Petitioners to approach the relevant High Court instead. As a result, the Supreme Court dismissed the petition but granted the organisation the liberty to file a petition before the jurisdictional High Court under Article 226.
#SupremeCourt refuses to entertain Internet Freedom Foundation's PIL against Criminal Procedure (Identification) Act, 2022 and rules; grants it liberty to approach the high court for suitable relief. @internetfreedom#SupremeCourtofIndia #RightToPrivacy pic.twitter.com/S4w8mab6Fm
— Live Law (@LiveLawIndia) February 12, 2024
We are immensely grateful to CPAP for collaborating with us in challenging the Criminal Identification Act, 2022, and for their steadfast commitment to protecting privacy rights and data security. Our sincere thanks to IFF Of-Counsel Advocate Abhinav Sekhri for his expert leadership in presenting the case. We also express our gratitude to Advocates Vrinda Bhandari, Gautam Bhatia, Radhika Roy, Gayatri Malhotra, Madhav Aggarwal, and Arzoo Prakash for their vital support. We will keep you updated on what happens next!