The Proposed Regulation of DNA Profiling Raises Critical Privacy Concerns

The Union Cabinet recently approved the DNA Technology (Use and Application) Regulation Bill, 2018 (“DNA Profiling Bill”), which is scheduled to be introduced in Parliament today (31st July). The Bill is largely based on the 2017 Law Commission Report on “Human DNA Profiling – A draft Bill for the Use and Regulation of DNA-Based Technology”, which seeks to expand “the application of DNA-based forensic technologies to support and strengthen the justice delivery system of the country.

Apart from identifying suspects and maintaining a registry of offenders, the Bill seeks to enable cross-matching between missing persons and unidentified dead bodies, and establishing victim identity in mass disasters.

Features of the Bill:

The Bill envisages the setting up of a DNA profiling board which shall function as the regulatory authority and lay down guidelines, standards and procedures for the functioning of DNA laboratories and grant them accreditation. The board will also assist the government in setting up new data banks and advise the government on “all issues relating to DNA laboratories”. In addition, it will make recommendations on legislation and practices relating to privacy issues around storage and access to DNA samples.  

DNA data banks will also be established, consisting of a national data bank as well as the required number of regional data banks. Regional data banks must mandatorily share all their information with the national data bank. Every data bank shall maintain databases of five categories of data – crime scenes, suspects or undertrials, offenders, missing persons, and unknown deceased persons.

The 2017 draft has made significant changes to address concerns raised about the previous 2015 draft. These include removing the index of voluntarily submitted DNA profiles, deleting the provision allowing the DNA profiling board to create any other index as necessary, detailing serious offences for DNA collection, divesting the database manager of discretionary powers, and introducing redressal mechanisms by allowing any aggrieved person to approach the courts. Additionally, it has added legislative provisions authorising licensed laboratories, police stations and courts to collect and analyse DNA from certain categories of people, store it in data banks and use it to identify missing/ unidentified persons and as evidence during trial.

The new Bill has attempted to address previous concerns by limiting the purpose of DNA profiling, stating that it shall be undertaken exclusively for identification of a person and not to extract any other information. Safeguards have been put in place against misuse in the form of punishments for disclosure to unauthorised persons.

The Bill mandates consent of an accused before collection of bodily substances for offences other than specified. However, any refusal, if considered to be without good cause, can be disregarded by a Magistrate if there is reasonable cause to believe that such substances can prove or disprove guilt. Any person present during commission of a crime, questioned regarding a crime, or seeking a missing family member, may volunteer in writing to provide bodily substances. The collection of substances from minors and disabled persons requires the written consent of their parents or guardians. Collection from victims or relatives of missing persons requires the written consent of the victim or relative. Details of persons who are not offenders or suspects in a crime cannot be compared to the offenders’ or suspects’ index, and any communication of details can only be to authorised persons.

Areas of Concern:

Although the Bill claims that DNA testing is 99.9% foolproof, doubts have recently been raised about the possibility of a higher error rate than previously claimed. This highlights the need for the proposed legislation to provide safeguards in the event of error or abuse.

The issue of security of all the data concentrated in data banks is of paramount importance in light of its value to both government and private entities. The Bill fails to clearly spell out restrictions or to specify who has access to these data banks.

Previous iterations of the Bill have prompted civil society to express their reservations about the circumstances under which DNA can be collected, issues of consent to collection, access to and retention of data, and whether such information can be exploited for purposes beyond those envisaged in the legislation. As in the case of Aadhaar, important questions arise regarding how such valuable genetic information will be safeguarded against theft or contamination, and to what extent this information can be accessed by different agencies. The present Bill has reduced the number of CODIS loci that can be processed from 17 to 13, thus restricting identification only to the necessary extent. However, this provision has not been explicitly stated in the provisions of the legislation itself, casting doubt over the manner in which it will be implemented.

Written consent is mandatory before obtaining a DNA sample, however withholding of consent can be overruled by a Magistrate if deemed necessary. An individual’s DNA profile can only be compared against crime scene, missing person or unknown deceased person indices. A court order is required to expunge the profile of an undertrial or a suspect, whose profile can also be removed after filing of a police report. Any person who is not a suspect or a convicted offender can only have their profile removed on a written petition to the director of the data bank. The consent clause is also waived if a person has been accused of a crime punishable either by death or more than seven years in prison. However, the Bill is silent on how such a person’s profile is to be removed on acquittal.

Moreover, the Bill states that “the information contained in the crime scene index shall be retained”. The crime scene index captures a much wider data set as compared to the offenders’ index, since it includes all DNA evidence found around the crime scene, on the victim, or on any person who may be associated with the crime. The indefinite retention of most of these categories of data is unnecessary, as well as contrary to earlier provisions that provide for such data to be expunged. However, the government has claimed that such information will be removed “subject to judicial orders”. Importantly, the Bill does not contain a sunset provision that would ensure that records are automatically expunged after a prescribed period.

While the Bill provides strict penalties for deliberate tampering or contamination of biological evidence, the actual mechanisms for carrying out quality control and analysis have been left out of the parent legislation and left to the purview of the rules.

Crucially, the Bill has not explicitly defined privacy and security protections such as implementation of safeguards, use and dissemination of genetic information, security and confidentiality and other privacy concerns within the legislation itself – leaving such considerations to the purview of regulation (and out of parliamentary oversight). The recently released Personal Data Protection Bill, 2018 does little to allay these concerns. As per this Bill, DNA Banks will be classified as significant data fiduciaries, and thus subject to audits, data protection impact assessments, and appointment of a special data protection officer. However, although genetic information is classified as sensitive personal data, the Data Protection Bill does not provide sufficient safeguards against the processing of such data by the State. In light of the proposed data protection framework, and the Supreme Court confirming that the right to privacy (including the right to bodily integrity) is a fundamental right, the DNA Profiling Bill as it stands in its present form cannot be implemented without violating the fundamental right to privacy.

Advertisements

Dealing With Revenge Porn in India

In March of 2018, a man in West Bengal was sentenced to five years imprisonment and fined Rs 9,000 for uploading private pictures and videos of a girl without her consent as revenge for ending their relationship. Under the promise of marriage, the accused pressured the complainant into providing explicit images of herself, and leveraged his threats to upload these pictures onto social media to acquire more pictures. Later, he accessed her phone without her knowledge to retrieve more private pictures and videos. When the complainant refused to continue their relationship, he uploaded this material onto a popular pornographic website along with both her and her father’s names. In addition to the defendant’s imprisonment and fine, the state government was directed to treat the victim as a survivor of rape and grant appropriate compensation. With evidence provided by service providers Reliance Jio and Google, the perpetrator was convicted under Sections 354A, 354C, 354 and 509 of the IPC as well as Sections 66E, 66C, 67 and 67A of the IT Act, in what is likely the first revenge porn conviction in India.

Revenge porn is a form of non-consensual pornography that came to international attention with the 2010 launch (and subsequent 2012 takedown) of the popular website IsAnyoneUp, which allowed users to upload nude photographs. While a number of these images were ostensibly self-submitted, many were revealed to have been submitted by angry ex-lovers, which would amount to ‘revenge porn’. Compounding the issue was the fact that these explicit images deliberately linked to the social media profiles of the person in the image.

According to Halder and Jaishankar, the essential elements of revenge porn are that the perpetrator and the victim shared an intimate relationship, and that the former has deliberately (and without the victim’s consent) released sexually explicit information online in order to cause distress and harm to the victim’s reputation.

While revenge porn is often used interchangeably with the term “non-consensual pornography”, it is distinct from other forms of non-consensual pornography such as rape videos, morphing or voyeurism. For instance, non-consensual pornography includes within its ambit sexually explicit images captured without a person’s knowledge or consent. However, revenge porn often includes such sensitive information that has voluntarily been captured or sent to the perpetrator in good faith in the course of an intimate relationship. Further, unlike in the case of revenge porn, not all perpetrators of non-consensual pornography are motivated by personal feelings such as revenge (as in the case of hackers who released intimate photos of more than 100 female celebrities after gaining access to their private iCloud accounts).

As a result, researchers are moving away from the term “revenge porn” as it can be somewhat misleading. “Revenge” limits the scope of this offence to motivations of personal vengeance, whereas such an act could be motivated by a desire for profit, notoriety, entertainment, or no reason at all. “Porn” implies that all images of nudity are intrinsically pornographic. Sexually explicit images created and shared within a private relationship should not be considered pornographic, unless they are distributed without consent, as this results in a private image being converted into public sexual entertainment. Accordingly, many victim advocates prefer to use the term “non-consensual pornography” or non-consensual sharing of intimate images.

Although the National Crime Records Bureau documents cyber-crimes against women, there are no official statistics available that pertain specifically to revenge porn in India. A 2010 report suggests that “only 35 per cent of the women have reported about their victimization, 46.7 per cent have not reported and 18.3 per cent have been unaware of the fact that they have been victimized … women prefer not to report about their victimization owing to social issues.” Victim-shaming (both by the criminal justice system and the public at large) is common, and the potential social fallout often extends to the victim’s family as well.

The recent surfeit of revenge porn has prompted many countries to enact legislation that criminalises it. These include the UK, many states in the USA, Canada, Australia, Japan and the Philippines.

At present however, there are no legal provisions that directly address revenge porn in India. While certain sections in the Indian Penal Code (IPC) and Information Technology (IT) Act can be invoked by victims, they fail to fully encompass the complexity of such cases and do not specifically target non-consensual pornography published online.

Section 354C of the IPC makes voyeurism punishable, and Explanation 2 to the Section deals with the non-consensual dissemination of consensually-captured images. However, this section limits its scope to female victims and male offenders.

In cases of non-consensual pornography (particularly those that involve morphing), victims can also seek recourse under Section 499 of the IPC for criminal defamation.

Section 66E of the IT Act punishes the transmission of images depicting the private areas of a person. The Explanation to the section limits private area to “… the naked or undergarment clad genitals, pubic area, buttocks or female breast”. This provision is gender-neutral and captures every aspect of revenge porn while not addressing it by name. However, the narrow definition of “private areas” in this case could limit the applicability of the act in cases where the victim is captured in an intimate position without showing those particular areas.

Section 67A of the IT Act punishes publication or transmission of “material containing sexually explicit acts, etc. in electronic form”. While this can effectively punish perpetrators, it also risks including within its ambit, victims who may have voluntarily captured and shared such private content with their partners.

The recent Supreme Court judgment recognising privacy as a fundamental right could have substantial implications on revenge porn and non-consensual pornography in general, in light of arguments recognising the right to bodily integrity. Copyright law could also potentially be used by victims, particularly when the content is a selfie. By claiming a violation of their copyright, a victim could potentially get such material taken down. While Indian copyright law does not presently provide any relief to victims of revenge porn, some victims in the US have successfully enforced their copyright to get such images taken down.

Social media platforms are often used to disseminate such content. Until recently, their role was limited to removing non-consensual pornography and other offensive images. However, there have been calls for them to play a more active role and filter this content before it is uploaded. Facebook has attempted to prevent the re-posting of revenge porn by cataloguing content which had been previously reported as revenge porn on its site.

The gender disparity in victims of non-consensual pornography is a reflection of the hostility still faced by women on the internet today. Involuntary porn today can be considered “the sexual harassment of 20 years ago. It’s an easy way to punish women for behaving in ways that they don’t approve of – for leaving them, for rejecting them, for being happy without them.”