“You cannot put the cart before the horse”.

The importance of Mr. Shashi Tharoor’s statement, spoken during the initial discussions regarding the DNA Technology (Use and Application) Regulation Bill, 2019 (DNA Bill), may dawn upon the audience in the backdrop of the statements made by Justice B.N Saikrishna (Retd.) regarding privacy and related.  It is needless to say that the Personal Data Protection Bill, 2019 (PDP Bill) must be enacted prior to the enactment of the DNA Bill to ensure that the sensitive personal data of individuals is protected, which can be accessed and stored by State powers without the consent of the individual in certain situations under the provisions of the DNA Bill.

DNA Bill.

While a detailed analysis of the DNA Bill exposes several incidences of violations of the constitutional rights afforded to an individual, the DNA Bill further curtails the right to privacy of the suspects/undertrials, offenders, missing persons, unknown deceased persons whose DNA may be collected for use in criminal investigations and identification of missing persons.

The DNA Bill allows the investigative authorities to collect and process the DNA information of a person accused in a criminal matter if the punishment of the matter is beyond 7 years. While the DNA Bill does provide for a consent requirement for collection of data of individuals arrested for an offence that carries punishment up to seven years, there is very limited scope of seeking consent from a person who is being subject to criminal proceedings as it is; this becomes more apparent in the absence of any legal provision specifically affording a right to this effect. One of the lower hanging fruits for processing of consent in such cases, would be enabling admission of consent to a Magistrate instead of the investigative authority. The DNA Bill further permits the collection of data for both civil and criminal matters which would be stored in a unified database. This may lead to an institutional bias and as we have witnessed this past year systemic bias has been plaguing even the most developed and civilized jurisdictions like the United States of America. It is noteworthy that the seemingly equivalent legislation of the United States of America, has consumed large volumes of DNA samples, and is believed to have caused further bias against vulnerable communities.

It is pertinent to note that the extant Bill would be the first legislation which would regulate the collection of DNA evidence in India. However, the Bill seemingly disregards the contours of the 3-prong test (Legitimate Aim-Proportionality-Legality) to invade upon the right to privacy of an individual set up by the apex court in the matter of Justice KS Puttaswamy (Retd) v. Union of India[1], Puttaswamy Judgment, while holding that the Right to Privacy is an intrinsic element of right to life and livelihood granted under Article 21 of the Constitution. The DNA Bill does not effectively state the retention period of the DNA records of a person and may lead to cases of wrongful prosecution due to the presence of distant DNA samples at a crime scene. Furthermore, in the event that the consent of an individual is necessary for the collection of their DNA sample, a Magistrate may easily override the consent requirement and can order the collection under Section 21 of the DNA Bill.

The ambiguity with regards to the retention period of the data is further violative of Section 9 of the PDP Bill, wherein the data must not be stored beyond the period necessary to satisfy the purpose for its collection and processing. While the DNA Bill does provide for a procedure for the erasure of data for undertrials, suspects; the Bill falls short of providing a procedure for the removal of data of a person who has been involved in a civil matter. It is important to note that there is no automatic procedure which is trigged for purging the data, which is available with the authorities, an individual will have to move the appropriate court of law to have the data banks purge their records, and there is no guarantee provided for the same.

Will the Personal Data Protection Bill, 2019 help?

While it is a long-held belief that the enactment of the PDP Bill could offset the infirmities of the DNA Bill with regards to the right of erasure and requirements of informed consent for the collection of sensitive personal data, the PDP Bill can be likened to the DNA Bill with regard to the overreaching power and authority granted to State machinery. Section 36 of the PDP Bill provides an exception for the investigation and prosecution of offences, and consequently spares the observance of the fundamental principles of the PDP Bill. Interestingly, the PDP Bill empowers the State under Section 92 to bar a data fiduciary from the processing of certain notified forms of biometric data. It remains to be seen, however, whether this Section is included in the latest iteration of the PDP Bill and the forms of biometric data which the State may choose to prohibit from processing.


The DNA Bill will most likely lean on ideologies of public interest and prevention of criminal activities as its primary purpose for enactment. However, in the absence of any data protection legislation in the country, the DNA Bill would severely curtail the rights of the public under its ambit. While DNA collection drives have become commonplace in jurisdictions like USA, Ireland, China; the absence of any preceding legislation regulating DNA collection or personal data collection would leave the public without any legislative safeguards over the violation of their right to privacy. Furthermore, the effectiveness and the purpose of the DNA collection drive must be scrutinized closely, wherein false positives for DNA identification have become commonplace due to the vast multitude of medical procedures which permit intermixing of genetic information. The DNA Bill is still at the discussion stage, and is likely to be heavily amended, given that the Bill was first drafted before the Puttaswamy judgment and before the erstwhile PDP Bill, 2019 (which itself is undergoing amendments). It would be interesting to note the differences which would be made in any new iteration of the DNA Bill, given the ever-evolving nature of data privacy and protection principles. The DNA Bill does not seem to account for the social sensitivities of the country, as it does little to build awareness, or to enforce awareness amongst the ones who will be subject to the specifics of the DNA Bill. In a country where people are not even aware of basic legal procedures, or their enforceable right to privacy, this DNA Bill is bound to be frenzied.

[1] (2017) 10 SCC 1


Ms. Bagmisikha Puhan, Associate Partner, TMT Law Practice

Bagmisikha is an Associate Partner at the Firm. She graduated in 2014, and specializes in Technology Law, advising clients in the ITeS, media, healthcare and pharmaceuticals, space sectors on regulatory, policy, compliance, and transactions. A member of the Telemedicine Society of India, Bagmisikha also conducts capacity-building and training programmes. Bagmisikha has worked in-house as part of the Global Data Privacy Team of an Indian MNC and worked extensively in matters pertaining to the data privacy and data protection laws of several jurisdictions.

Pro bono advisory also forms a significant portion of Bagmisikha’ work. A member of the Right to Free Education movement in Odisha, she provides free legal services to the students and their families.

Mr. Siddhant Gupta, Associate

Siddhant Gupta is an Associate with TMT Law Practice. He is a graduate of the 2015-2020 batch from Symbiosis Law School, Pune and his core areas of interest lies in the areas of Intellectual Property Laws, Media and Entertainment Laws. Siddhant has previous internship experience in intellectual property and litigation fields and interned with TMT Law Practice in 2020. During his time with TMT Law Practice, Siddhant gained valuable experience in the sectors of Telemedicine, Data Privacy, Gaming Laws and Corporate Laws.

Siddhant has obtained an online certification from the Duke University on ‘Copyright for Multimedia’. He’s also co-authored an article for Lexology titled ‘Project Red Card and Privacy Concerns’.

Outside of law, Siddhant is an avid fan of sports having represented his college’s football team in outstation fests.

    Work With Us