India’s Digital Personal Data Protection Bill passed: “it’s a bad law”

India’s Criminal Procedure (Identification) Bill jeopardizes privacy — it must not be enforced

In a blow for human rights, the Parliament of India has today, April 6, passed the Criminal Procedure (Identification) Bill, which will severely jeopardize people’s privacy and expand the scope for surveillance. Once the bill receives the president’s assent, it will turn into law — it must not be enforced. 

“The Criminal Procedure (Identification) Bill fundamentally contravenes the Supreme Court’s rulings on the fundamental right to privacy guaranteed by the Indian Constitution,” said Raman Jit Singh Chima, Senior International Counsel and Asia Pacific Policy Director at Access Now. “Instead of responding to the need of the hour and propelling reforms over government surveillance and databases, the Indian government has fast-tracked a bill through parliament that exacerbates the threat of mass surveillance, and attacks people’s fundamental rights and freedoms. This bill must not be enforced in its current form.”

The contentious bill empowers the police, and any agency notified by the government, to collect, retain, and share an alarming range of personal information. This includes biometric data such as fingerprints, palm prints, footprints, photographs, iris and retinal scans, and other physical and biological samples. This data can be collected from people who have been convicted, arrested, or merely detained under India’s preventive detention laws, and can be retained in digital forms for at least 75 years. In doing so, the bill goes far beyond the 1920 colonial era law it claims to replace, with no meaningful oversight mechanisms or guarantees on remedy for individuals facing abuse by authorities. Resisting the collection of information under the bill would amount to an offense.

As many members of parliament have highlighted this week, the bill is “draconian” and will facilitate a “police state.” There is an absolute lack of judicial remedy as the bill places a bar on suits arising from any actions undertaken under the bill.

“The bill expands the scope and authority for surveillance, and  in conjunction with other imminent laws designed to control people’s data, will adversely impact fundamental rights,” said Namrata Maheshwari, Asia Pacific Policy Counsel at Access Now. “For instance, if the Personal Data Protection Bill is passed in its current form, the collective impact will be impunity for government, law enforcement agencies to collect, retain and process vast amounts of personal data.”

Access Now urges the Indian government to respect people’s right to privacy, and not enforce the Criminal Procedure (Identification) Bill. Instead, it should urgently consult with state governments, criminal justice experts, and civil society on the safeguards and oversight mechanisms that must be urgently brought in on police storage and retention of identity information.