What the DNA profiling Bill means for your data privacy

A Bill that potentially allows the government to store a person’s most private information — his or her DNA make-up — is up for debate in Parliament. Successive governments have been toying with the DNA Technology (Use and Application) Regulation Bill since 2007. But no regime has succeeded in enacting the Bill because of its controversial nature. The Bharatiya Janata Party-led government is keen to clear its passage in its second term.

The Rajya Sabha had rejected the Bill when it came up for debate as recently as January this year. It had been passed by the last Lok Sabha, but lapsed after the rejection from the upper house. The Bill is now back. With the Cabinet recently clearing it, it was again introduced in the Lok Sabha for the third time despite protests by many Members of Parliament.

A powerful tool

Deoxyribonucleic acid or DNA is the molecule containing genetic information that is present in the cells of all living organisms. In a human, 0.1 per cent of the DNA or genetic material is unique to each individual and this identifying information can be obtained from any cell, including hair and skin.

This mode of identification finds use in ways such as reuniting parents with missing/stolen children, and identifying rapists and other criminals. Ever since DNA-based evidence was admitted in courts internationally in the ’90s, it has revolutionised forensic techniques.

The social implications of this technology is huge, says Chandrima Majumdar, a researcher in the field of chemical biology of DNA at UC Davis, University of California. “For crime scenes and missing persons, the technology does have the power to be conclusive, so if the data is secured correctly, it can be very powerful.” A serial killer on the loose in California, called the ‘Golden State Killer’, for instance, was tracked down after his DNA, recovered from a victim, was analysed 20 years later.

Misgivings

But now that the Indian government is talking of using these techniques on a national scale and regulating them through DNA banks, there is worry all around.

The DNA Bill seeks to create a national DNA data bank, and regional data banks, and have separate indexes for crime records such as crime scene, undertrials, suspects, missing persons and unknown deceased persons. It has proposed DNA sampling and profiling of citizens accused of crime or reported missing, and storing their unique genetic information for administrative purposes. Proposed by the ministry of science and technology, the Bill faces opposition in Parliament every time it comes up.

Leader of Congress in the Lok Sabha Adhir Ranjan Chowdhury said in the ongoing Budget session that the Bill violated fundamental rights of citizens.

Congress MP Shashi Tharoor said it would give rise to a surveillance state. “You cannot put the cart before the horse,” said Tharoor, pointing out that the data protection Bill needed to be passed first. Defending the Bill, Union minister of science and technology Harsh Vardhan said the Opposition’s concerns were lacking in substance.

DNA and big data

Published in the journal Science , a paper titled ‘Identity inference of genomic data using long-range familial searches’ stated that genomic databases today contained information about millions of people. Some suspects were thus caught recently in the US using genome data from distant relatives. The paper said, “Testing models of relatedness, Erlich et al. show that many individuals of European ancestry in the United States — even those that have not undergone genetic testing — can be identified on the basis of available genetic information.” It stressed the need to safeguard the privacy of individuals and organisations.

In the absence of a law, private companies such as 23andMe, which offers to trace a peson’s ancestry, are already collecting DNA data. The Andhra Pradesh government has tied up with a company called Shivom to collect DNA data from 50 million citizens for storage through blockchain technology.

Under the proposed DNA Bill, the government seeks to harvest the data with consent from some people, and without consent from others, as in the case of individuals who have committed serious crimes attracting imprisonment beyond seven years. It also has provisions for the removal of DNA data of suspects after a police report has been filed or through a court order, and in the case of undertrials, through a court order. Crime scene and missing persons’ profiles would be removed based on a written request to the police authorities.

DNA sampling is currently carried out with a magistrate’s permission. The DNA profiling Bill seeks to make this a routine procedure, without any established framework. Hyderabad-based data researcher Srinivas Kodali fears that the bill will have dangerous consequences for data privacy.

The Supreme Court established privacy as a fundamental right in 2017. The Law Commission’s report on the DNA Bill had, however, been submitted before this. Even the Srikrishna Committee report on data privacy came later. Lawmakers seem impervious to the risks to privacy posed by the DNA law.

“It is not known for how long this collected DNA will be stored, or who will have access to it. In the absence of a data privacy Bill, it is unclear what recourse one has if the data is stolen or tampered with,” says Kodali. He also points to the wider ramifications. “One’s DNA is not just one’s own. It is also inherited information. So when a government or an entity gets access to that information, it exposes the entire family that shares the DNA data.”

Genes and prejudices

Others are worried that DNA banks would reinforce institutional bias in the police and judiciary, leaving weaker sections of society even more vulnerable. According to a report in The Wire , the Hyderabad-based Centre for DNA Fingerprinting and Diagnostics (CDFD) form asks for one’s caste.

The DNA records are proposed to be stored with the Centre for Cellular and Molecular Biology in Hyderabad. “While it is a good thing that all data would be available in one place, there can be security threats associated with it,” Kodali says. He also questions the government’s wisdom in accepting DNA as a conclusive evidence. “In the current NRC [National Register of Citizens] framework, for example, DNA is not proof of residence. We need to define the scientific basis on which we declare that DNA is final proof. After all, there can be errors in collection, false positives, planting of evidence. This whole assumption that technology is always right needs a rethink,” he concludes.

COMMENT NOW