TITLE - The country’s new DNA law raises privacy concerns

• The law goes well beyond criminal matters and regulates civilian and medical use of DNA.

• Parliament is set to pass a law to regulate the use of DNA technology. Since the DNA of a person is unique, it can be used to accurately identify a person’s identity. Globally, DNA technology is used to help enforcement agencies identify both perpetrators and victims in criminal cases.
• In medicine, DNA is used to identify the susceptibility of a person to diseases such as cancer and Alzheimer’s. In civilian life, DNA can be used to establish parentage of children or sibling relationships.
• However, the use of DNA technology also raises major concerns relating to consent (i.e. the right to refuse to provide a bodily substance), privacy and data security. Hence, countries the world over have felt the need to strictly regulate the use of DNA.
• It is hoped that the new law would fill a major gap, as the use of DNA technology in India has been left unregulated. Unfortunately, there are major lacunae in the way the new law addresses core issues such as privacy and fundamental rights.

• The DNA Technology (Use and Application) Regulation Bill, 2019 was introduced in Lok Sabha by the Minister for Science and Technology in July 2019. The Bill provides for the regulation of use of DNA technology for establishing the identity of certain persons. The same Bill had been previously introduced in Lok Sabha in August 2018, but lapsed.     
• Use of DNA Data: Under the Bill, DNA testing is allowed only in respect of matters listed in the Schedule to the Bill.  These include offences under the Indian Penal Code, 1860, and for civil matters such as paternity suits.  Further, the Schedule includes DNA testing for matters related to establishment of individual identity.     
• Collection of DNA: While preparing a DNA profile, bodily substances of persons may be collected by the investigating authorities.  Authorities are required to obtain consent for collection in certain situations.  For arrested persons, authorities are required to obtain written consent if the offence carries a punishment of up to seven years. 
• If the offence carries more than seven years of imprisonment or death, consent is not required.  Further, if the person is a victim, or relative of a missing person, or a minor or disabled person, the authorities are required to obtain the written consent of such victim, or relative, or parent or guardian of the minor or disabled person.  If consent is not given in these cases, the authorities can approach a Magistrate who may order the taking of bodily substances of such persons.    
• DNA Data Bank:The Bill provides for the establishment of a National DNA Data Bank and Regional DNA Data Banks, for every state, or two or more states.  DNA laboratories are required to share DNA data prepared by them with the National and Regional DNA Data Banks.  Every Data Bank will be required to maintain indices for the following categories of data: (i) a crime scene index, (ii) a suspects’ or under trials’ index, (iii) an offenders’ index, (iv) a missing persons’ index, and (v) an unknown deceased persons’ index.
• Removal of DNA profiles:The Bill states that the criteria for entry, retention, or removal of the DNA profile will be specified by regulations.  However, the Bill provides for removal of the DNA profiles of the following persons: (i) of a suspect if a police report is filed or court order given, (ii) of an undertrial if a court order is given, and (iii) on written request, for persons who are not a suspect, offender or under trial, from the crime scene or missing persons’ index.    
• DNA Regulatory Board: The Bill provides for the establishment of a DNA Regulatory Board, which will supervise the DNA Data Banks and DNA laboratories.  The Secretary, Department of Biotechnology, will be the ex officio Chairperson of the Board.  The Board will comprise additional members including: (i) experts in the field of biological sciences, and (ii) Director General of the National Investigation Agency and the Director of the Central Bureau of Investigation. 
• Functions of the Board:The functions of the Board include: (i) advising governments on all issues related to establishing DNA laboratories or Data Banks, and (ii) granting accreditation to DNA laboratories.  Further, the Board is required to ensure that all information relating to DNA profiles with the Data Banks, laboratories, and other persons are kept confidential.  
• Offences:The Bill specifies penalties for various offences, including: (i) for disclosure of DNA information, or (ii) using DNA sample without authorization.  For instance, disclosure of DNA information will be punishable with imprisonment of up to three years and fine of up to one lakh rupees.

• In criminal cases, the law specifies the requirement of written consent before DNA samples are collected for testing from criminal suspects or under trials, offenders, victims of a crime, and missing or unidentified deceased persons.
• Once these samples are analysed by a DNA laboratory, they will be stored in a national DNA data bank under various categories depending on whether the DNA has been collected from a crime scene, suspects or offenders, or unidentified deceased persons. For such criminal cases, safeguards are specified on limiting access to the DNA data bank and conditions under which DNA information can be deleted.
• However, the new law goes well beyond criminal matters and regulates civilian and medical use of DNA. This is where major concerns arise and affect issues as diverse as parentage disputes, medical negligence, and any matter related to establishing an individual’s identity. On these issues, the new law does not prescribe any safeguards.
• For example, the law does not require the consent of an individual while giving DNA samples in civil matters such as a paternity suit. The ethic behind the need for consent is that a person’s bodily substances include DNA, which not only identifies the person, but also reveals her genetic information such as physical and medical traits. Such information may affect her privacy, and so consent offers a safeguard against DNA misuse.
• Or consider the provision related to the national DNA database that is being created under the law. As the name suggests, the database is a central repository of DNA information of individuals covered by the law. While the database will have information related to criminal offences, the law is unclear on whether DNA collected for civil cases will be stored in this database.
• This is because the law requires all DNA laboratories to share DNA test results with the data bank. Therefore, were a DNA laboratory to analyse a DNA sample in the course of a private dispute between parties (say, an in vitro fertilization clinic and a pregnant woman), would it share this information with the data bank?
• The Bill in question does not state that DNA information related to civil matters will not be stored in it. Note that the Combined DNA Index System (CODIS) in the US and the National Criminal Intelligence DNA Database in the UK are national DNA data banks with information related only to criminal investigations.
• Further, if DNA information related to civil matters is stored in the data bank, it may violate the fundamental right to privacy as laid down by the Supreme Court. The Court has stated that the right to privacy may be infringed only through the enactment of a law, and that law must achieve a public purpose that’s proportionate to the infringement of privacy. Since the storage of DNA profiles for civil matters (such as paternity suits and medical diagnoses) may not serve a public purpose, it may violate the right to privacy.
• A more fundamental issue is ambiguity on whether the law intends to regulate DNA tests conducted in medical and diagnostic settings. For instance, many laboratories across the country offer such tests to determine a person’s predisposition to cancer, diabetes and other diseases.

Conclusion:

The Bill needs rigorous scrutiny by a cross-section of experts and wider consultations. This can be achieved if the Bill is referred to a parliamentary committee. Otherwise, it could be a missed opportunity to effectively regulate the use of DNA technology.