REGULATION OF NATIONAL GENETIC IDENTITY DATABASES: LEGAL FRAMEWORK AND CASE LAWS

1. INTRODUCTION

National genetic identity databases are centralised or interconnected repositories of DNA profiles used to identify individuals, investigate crimes, identify missing persons, and assist in identifying unidentified deceased persons. They may contain DNA profiles obtained from crime-scene evidence, biological samples, and reference samples collected from individuals under lawful authority.

Although such databases can support criminal investigations and disaster-victim identification, they create significant legal concerns involving privacy, bodily integrity, consent, wrongful identification, data security, discriminatory surveillance, and the retention of genetic information after acquittal.

In India, the legal framework is not based on a single comprehensive DNA database statute. The Criminal Procedure (Identification) Act, 2022, the constitutional right to privacy, criminal-procedure safeguards, and applicable evidence and data-protection laws are relevant. Importantly, the DNA Technology (Use and Application) Regulation Bill, 2019, was withdrawn in July 2023 and should not be treated as an enacted law. <Cite refs={["turn633931search2","turn808960search36"]}/>

2. LEGAL AND REGULATORY FRAMEWORK

A. CRIMINAL PROCEDURE (IDENTIFICATION) ACT, 2022

The Act authorises the collection of specified measurements, including biological samples and their analysis, from designated categories of persons for criminal investigation and identification. It empowers the National Crime Records Bureau (NCRB) to collect, preserve, process, and share records in accordance with the statutory framework.

Section 4 generally provides for retention of measurement records for 75 years, subject to the statutory exception concerning eligible persons who are released without trial, discharged, or acquitted after exhausting legal remedies, unless a court or Magistrate directs otherwise for recorded reasons.

The Act is not equivalent to the comprehensive National DNA Data Bank framework proposed in the withdrawn 2019 Bill. Its provisions must be applied according to their actual scope, including the applicable conditions governing biological samples. <Cite refs={["turn808960search36","turn808960search6","turn633931search2"]}/>

B. CONSTITUTIONAL PRIVACY AND BODILY INTEGRITY

Article 21 of the Constitution protects life and personal liberty, while Article 14 requires non-arbitrary state action. Compulsory DNA collection and prolonged retention of genetic records may affect bodily autonomy, informational privacy, and equality.

A defensible database framework should provide lawful authority, a legitimate public purpose, appropriate necessity and proportionality safeguards, restricted access, and effective procedures for correction or deletion where legally warranted.

C. DNA TECHNOLOGY AND EVIDENTIARY RELIABILITY

DNA evidence must be collected, preserved, analysed, and interpreted using scientifically reliable methods. Contamination, sample substitution, incomplete records, and incorrect interpretation can undermine the reliability of a match.

DNA identification should therefore be distinguished from broader genetic analysis. A profile designed for identity matching should not automatically become a source of unrestricted information about health, ancestry, or other personal characteristics.

3. IMPORTANT CASE LAWS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Authority: Direct authority on constitutional privacy; analogous to national DNA databases.

The Supreme Court recognised privacy as a fundamental right under Article 21 and related constitutional guarantees.

Legal significance: The collection and long-term retention of genetic information by public authorities must be supported by law and appropriate safeguards. A legitimate law-enforcement objective does not eliminate the need to examine whether the intrusion is necessary and proportionate.

2. Selvi v. State of Karnataka (2010) 7 SCC 263

Authority: Direct authority on compulsory scientific investigative techniques and constitutional rights; analogous to compulsory DNA collection.

The Supreme Court held that the involuntary administration of narcoanalysis, polygraph examinations, and brain electrical activation profile tests violated constitutional protections in the circumstances examined.

Legal significance: The judgment emphasises bodily integrity, personal liberty, and protection against compelled testimonial techniques. It does not prohibit every compulsory DNA sample, because DNA collection raises distinct legal questions and may be authorised under specific statutory provisions. Its constitutional reasoning remains relevant when assessing coercive investigative practices.

3. District Registrar and Collector v. Canara Bank (2005) 1 SCC 496

Authority: Direct authority on privacy and state access to private records; analogous to genetic databases.

The Supreme Court examined statutory powers permitting access to private documents and emphasised the importance of privacy protections against unjustified intrusion.

Legal significance: Authorities responsible for genetic databases should ensure that access, disclosure, and secondary use are governed by lawful powers rather than unrestricted administrative discretion.

4. Bhabani Prasad Jena v. Convenor Secretary, Orissa State Commission for Women (2010) 8 SCC 633

Authority: Direct authority on judicially ordered DNA testing in paternity disputes.

The Supreme Court held that DNA testing should not be ordered routinely. Courts must consider the necessity of the test, the available evidence, the consequences for the individuals involved, and the relevant legal presumptions.

Legal significance: DNA technology should be used for a clearly justified purpose. The availability of scientifically powerful testing does not remove the need for judicial scrutiny and individual rights protection.

5. Banarsi Dass v. Teeku Dutta (2005) 4 SCC 449

Authority: Direct authority on DNA testing in civil proceedings.

The Supreme Court held that DNA testing should not be ordered as a matter of routine and that courts must assess whether it is justified in the particular case.

Legal significance: A national genetic database should not become a general-purpose repository for unrelated civil disputes or investigations without a valid legal basis. The purposes for which profiles may be collected, matched, retained, and disclosed should be clearly defined.

6. Goutam Kundu v. State of West Bengal (1993) 3 SCC 418

Authority: Direct authority on compulsory blood testing in paternity disputes.

The Supreme Court laid down safeguards against routine orders for blood testing and stressed the importance of considering the legal and personal consequences of compelling biological examination.

Legal significance: Genetic identification practices must account for bodily integrity, evidentiary necessity, and the consequences of testing. The decision must be read alongside later judgments and applicable statutory powers.

7. K.S. Puttaswamy (Aadhaar-5J.) v. Union of India (2019) 1 SCC 1

Authority: Direct authority on biometric identity infrastructure; analogous to genetic databases.

The Supreme Court examined the constitutional validity of the Aadhaar framework and the use of identity information in public administration. The case addressed privacy, proportionality, and limits on the use and disclosure of identity-related information.

Legal significance: Centralised identity infrastructure requires clear purpose limitations, access controls, and legal safeguards. The judgment concerns Aadhaar and biometrics rather than DNA databases specifically, but its reasoning is relevant to the design of national genetic identification systems.

4. ESSENTIAL REGULATORY SAFEGUARDS

A. PURPOSE LIMITATION: DNA profiles should be used only for legally authorised identification purposes, with restrictions on unrelated genetic analysis.

B. COLLECTION AND CONSENT: The legal basis for obtaining each sample must be recorded. Where consent is required, it should be informed and voluntary; where compulsory collection is authorised, the statutory conditions must be satisfied.

C. RETENTION AND DELETION: Records should be retained only according to applicable law, with clear procedures for destruction, correction, and review of disputed records.

D. SCIENTIFIC QUALITY CONTROL: Laboratories should maintain chain-of-custody records, validated methods, contamination controls, and auditable quality-assurance procedures.

E. ACCESS AND SECURITY: Access should be restricted to authorised personnel, with logging, authentication, security monitoring, and controls over onward disclosure.

F. INDEPENDENT OVERSIGHT: A robust system should provide independent scrutiny, complaint mechanisms, and remedies for unlawful collection, disclosure, retention, or matching.

5. PRACTICAL COMPLIANCE REQUIREMENTS

Law-enforcement agencies should document the legal basis and purpose of every sample collection, preserve chain-of-custody records, and restrict DNA matching to authorised investigations. Database operators should maintain access logs, verify the authority of users, and implement the applicable retention and destruction rules.

Where a person is acquitted or discharged, the responsible authority should examine the applicable statutory conditions and process any deletion obligation accordingly. Individuals should have a meaningful route to challenge inaccurate records or unlawful retention, subject to the governing legal framework.

6. CONCLUSION

National genetic identity databases can strengthen criminal investigations and the identification of missing persons, but their operation must respect constitutional privacy, bodily integrity, and evidentiary reliability. India's Criminal Procedure (Identification) Act, 2022, provides a statutory framework for specified measurements and records, while the proposed DNA Technology (Use and Application) Regulation Bill, 2019, was withdrawn and is not current enacted law.

The judgments in Puttaswamy, Selvi, District Registrar v. Canara Bank, Bhabani Prasad Jena, Banarsi Dass, Goutam Kundu, and the Aadhaar decision in Puttaswamy demonstrate the importance of lawful collection, limited purpose, scientific reliability, and judicial safeguards. Although several decisions are analogous rather than direct rulings on national DNA databases, they establish principles relevant to their regulation.

Ultimately, a lawful genetic identity system must balance legitimate investigative needs against the risks of excessive surveillance, wrongful identification, and permanent retention of personal genetic information. Clear statutory safeguards, independent oversight, reliable laboratory practices, and effective remedies are essential to maintaining that balance.