Criminal Procedure (Identification) Act, 2022: A Menace to the Privacy of the Prisoners

One of the earliest colonial legislations that is still in effect in India is the Prisons Act of 1894.[1] These laws are directives that address institutional, operational, and managerial instructions in prisons, placing an emphasis on administration rather than on the reformation and rehabilitation of the inmates.[2] Prisons emerged to maintain social order and safeguard the populace from the individual who upended the crisis. Perhaps, the similar catastrophe that convicts experience in jail receives the least amount of attention. Due to a lack of enacting appropriate laws and regulations to bring comprehensive rehabilitation, prisoners in India are forced to endure terrible conditions.[3] Thereby listing the Prison laws as one of the forgotten laws of India. Gandhi also stated, “hate the crimes, not the criminals,” referring to them as fellow people who equally deserve to live in dignity with a civilized existence. According to a study on India’s overcrowded jails, which was reported in The Hindu, 5.54 lakh inmates are currently incarcerated, indeed the original capacity is 4.25 lakh.[4] which reflects the forsaken attitude of the government towards the prisoners. Though a person is imprisoned, he still has vested rights which cannot be curtailed except the one lost as an incident of confinement.[5] However, these rights are not absolute but restricted to an extent, among which Article 21 which is the right to life plays a pivotal role.

On August 4th 2022, the Criminal Procedure (Identification) Act came into force repealing the Identification of Prisoner act, of 1920.[6] This is the camouflage of bringing technological and modern forms of identifying criminals and increasing conviction rates of criminals.[7] In addition, it aims to lay down an effective and feasible criminal procedure for convicting criminals. Consequently, focusing on the prison administration in lieu of working on the rights of the inmates and subsequently, exaggerating the hardships of prisoners by worsening their condition.

The Criminal Procedure (Identification) Act, 2022

The Criminal Procedure (Identification) act was framed on the 87th report of the law commission of India, in 1980.[8] This act brought major changes in the 1920 act by expanding its provisions. Firstly, it has expanded the definition of ‘measurement’. Secondly, it dilates the number of persons from whom the data shall be collected, Thirdly, it widens the number of authorities who can order the collection of data. And lastly, it allows the National Crime Record Bureau (NCRB) agency to be the sole agency to maintain the records of the data collected, thereby vesting the state power on the Centre and thereby questioning its federalism.[9]

Earlier by the 1920 act only fingerprints, foot-print impressions and photographs were taken from the regarded person.[10] However, it has expanded the definition of measurements including biological samples, and behavioural attributes including signatures and handwriting.[11] Moreover, the examinations under sections 53 and 53A of CrPC will now include blood, semen, hair sample, swabs and DNA profiling. This technological transition will help the authorities to identify criminals accurately. Moreover, data shall be collected not only from the convicted or arrested person but also from ‘any’ person on a written order of the magistrate.[12] However, the biological samples shall be taken only from the person arrested for the offences against a woman or a child, or if the offence carries a minimum of seven years imprisonment. [13] Taking biological samples from convicts involved in crimes against women and children, not only aids the investigation but also moderates the act as it does not mandate other convicts arrested for crimes bearing a punishment below seven years. Furthermore, the act also authorizes the officer in charge of the police station, or of rank head constable or above and a head warder of the prison to collect the data.[14] It also empowers a Metropolitan Magistrate or a Judicial Magistrate of the first class to order the collection of data.[15] Additionally, an Executive Magistrate is also empowered in cases where a person is required to maintain good behaviour or peace.[16] The data so collected shall be stored by NCRB for 75 years in digital and electronic form. Consequently authorizing the central government to make laws in this regard, is indeed a state subject.[17]

Effect of the act on the fundamental rights

As stated earlier, incarceration will not render a person non-human. In the case State of Maharashtra v Prabhakar Pandurang Sanzgir, the Supreme court held that “every prisoner retains all such rights that are enjoyed by free citizens except the one that is lost necessarily as an incident of confinement.”[18]

Though this act was passed to bring an effective criminal procedure using modern techniques and aid a smooth investigation, has backed a lot of criticism. As it not only violates the rights of the prisoners but also puts the rights of the citizens at stake.

Right to Privacy

The amended act empowers the authorities to collect biological samples of all the prisoners serving sentences of seven years or more irrespective of one’s will or consent.[19] Nevertheless, this mandate on every long-serving inmate (person serving imprisonment of seven years or above) to give their biological samples regardless of their consent violates their privacy. Moreover, storing the data for 75 years increases the threat of dissemination of data.

The right to privacy is a fundamental right guaranteed by the Indian Constitution. The Universal Declaration of Human Rights Act of 1948, has recognized the right to privacy as a basic human right, under Article 12. It reads that: “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attack upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.” [20] This also implies that ‘prisoners’ can exercise this right as it is granted to ‘everyone’. Thereby Prisoners are also entitled to the right to privacy. However, fundamental rights are not absolute but restrictive in nature. Justice J. Chelameswar also opined that “every legal right is restrictive in nature. Therefore, the right to privacy also has limitations which shall be identified on case-to-case basis depending upon the nature of privacy interest claimed.”[21]

In the case of KS Puttuswamy, the right to privacy was upheld by the court to be a fundamental right. And was recognized to be a part of the right to life. It was held that the right to privacy can be restricted on “well-defined” circumstances- 1) There is a legitimate state interest in restricting the right. 2) The restriction is necessary and proportionate to achieve the interest. 3) The restriction is by law.[22] Constitution doesn’t guarantee absolute fundamental rights, thereby it allows state intervention within constitutional limits. Wherein the state’s intervention should be reasonable and non-arbitrary. The Criminal Procedure (Identification) act, is a law that thereby satisfies the third condition. The question here arises, is whether there is a ‘legitimate state interest’. In the recent judgment pronounced in the Aadhaar case, Justice D.Y. Chandrachud opined that for determining whether the state interest is legitimate, the court refers to a three-step process-“Firstly, there must be an existing law justifying an encroachment. Secondly, there must be a legitimate state ‘aim’, ensuring that the restriction of the statute falls within the zone of reasonableness mandated by Article 14. Thirdly, the means which are adopted by the legislature must be proportional to the object and needs of the legislation/provision.”[23] For limiting the fundamental rights of the citizen, there should be a compelling and indispensable state’s interest which supersedes citizens’ interest. However, making a digitalized criminal procedure will not override one’s right to privacy. Additionally, there are no stronger privacy laws in India which can encrypt and protect sensitive data. Earlier in India, the website of the Ministry of health of the government of India was hacked and all the links in the website were diverted to some other illegal websites, which reflects the weaker privacy laws in India.[24] Recently. Chinese hackers were accused of stealing the data of the United States which has the world’s most highly secured network that is the network of Pentagon whose privacy laws are comparatively more secure than Indian privacy laws.[25] Therefore, in a country like India with weaker privacy laws, it is ‘unreasonable’ to restrict one’s right to secure sensitive information for modernizing the procedure. Though introducing modern techniques is a legitimate aim, it may not be a legitimate state aim because it is unreasonable to keep one’s privacy at stake, by storing personal information just to facilitate a smooth investigation. Therefore, this cannot be a legitimate state aim because the ultimate aim of the state is to protect and further the interests of the citizens. Furthermore, the objects of the law should be proportional to the means achieved. However, applying this rational nexus, introducing modern techniques is not proportional to compromising the right to privacy. This act compromises the fundamental rights of all citizens to increase the conviction rate and modernize the procedure. Thereby losing its rational nexus. Enacting this act government choose retributive justice in spite of reformative justice. In the case State of Gujarat v High Court of Gujarat, the Supreme court opined that reformation should be the dominant object of punishment.[26]

Moreover, this law also enables the authorities to take measurements from ‘any person’ on the written sanction of the magistrate and preserve them for 75 years, regardless of their consent. However, if that person is proven innocent, his data so collected in the investigation shall be erased. Whereby, this act intends to protect the sanctity of the right to privacy. Nonetheless, the act still provides power to the magistrate to preserve the data, by recording the reasons in a written form. According to this act, if a person refuses to give his measurements, he shall be deemed to commit an offence under section 186 of the Indian Penal Code. Therefore, though the act provides erasing the data on proving innocent of the actual offence, his data can still be preserved lawfully as he is still an accused under section 186 of IPC.[27] The “presumption of innocence” is an important principle of a fair trial, wherein the arrested person shall be treated as innocent and the burden shifts the prosecutor to prove the guilt.[28] In contrast, this act presumes the arrested person to be the accused before the investigation thereby losing the essence of a fair trial. Therefore, it also endangers Article 14, which states that a law should be fair, reasonable and equal.[29]

Furthermore, it also empowers the authorities to take measurements from a person convicted under preventive detention.[30] Subsequently, it empowers them to collect information from politicians, activists etc. Whereby this act indirectly may affect the exercise of other fundamental rights. For instance, any person exercising Article 19 can be irrationally arrested under sedition charges and collect their measurements. According to the Economic Times report, only 3 per cent of the arrested persons are convicted, which implies that 97 per cent of people are arbitrarily arrested under sedition charges.[31] As this act grants absolute powers to the authorities. Consequently, it indirectly restrains citizens from bravely vocalizing their opinion as one may be afraid of the dissemination of their personal information.

Recommendations from Justice B.N. Sri Krishna Committee

As per the recommendations given by Justice B.N. Srikrishna’s committee, to protect the sanctity of the right to privacy, the law should abide by some principles, a few of which are explained below-[32]

1)Processing Personal Data: Here the word processing includes collection, recording, analysis, disclosure etc. One’s data can only be processed if there is a “clear, specific, and lawful” purpose. Thereby it puts a cap on processing personal data which is also called as the ‘purpose restriction’. Wherein one’s data can be processed for that particular purpose. However, this act empowers the authorities to collect anyone’s data and store it for ‘75’ years and culminate without revealing the specific purpose of retaining such sensitive information. Perhaps, an exception was also laid in the report, which allows the processing of personal data for the prevention of the offence and contravention of the law.[33] By interpreting the act on the above lines, it is perspicuous that the act satisfies the above exception given that the data is only used to increase the conviction rates to aid investigation which can further reduce the crime rate. However, the NCRB is the repository of data and is empowered to share or publish the data to “any law enforcement agency”, which again lacks to give purpose, thereby amounting to dissemination.[34]

2)Right to be forgotten: This right is given to the data principal (the person who has given his personal data) can restrict or prevent any display of personal data after completion of the purpose specified. However, this act does not empower data principals (criminals or arrested persons) to control their personal data. Moreover, this data will not be restricted to be only used for the actual purpose but can be stored for 75 years.

3)Explicit consent: This committee also recommended that sensitive personal data shall not be processed unless there is ‘explicit’ consent given by the data principle. The committee further stated that sensitive personal data includes sexual orientation, passwords, financial data, biometric data, religion or caste.[35] In the case Bhabini Prasad Jena v Convenor secretary, orissa state commissioner for women and Anr., the Court weighed its reluctance upon using scientifically advanced tools which may invade privacy.[36] However, this act empowers the authorities to collect once biological data, which is a piece of sensitive information, forcefully, which implies that this act does not take ‘consent’ into account.

Ambiguous provisions

The new act also contains some ambiguous provisions which may increase the risk of invading one’s fundamental rights. The phrase ‘biological samples’ is not specifically elaborated or described which may involve bodily invasions. Subsequently, it leaves the discretion upon the authorities to interpret the phrase accordingly. In Addition, for collecting biological samples, one needs a written sanction from the magistrate but not the consent of the individual. This further puts one’s right against self-incrimination at stake given under Article 20(3) of the Indian Constitution. As this act implicitly allows compelling the individual to give their biological samples which might also include Narco analysis and brain mapping.[37] The Supreme court in the case Miranda v Arizona held that all individuals have the right to not answer questions.[38] Thereby, affecting one’s right to life and liberty as it fails to perform the right to a free and fair trial.

87th law commission report

This report was laid with the aim to strike a balance between the rights of individuals and the imperative needs of society for the protection and punishment of crime. The committee has identified two main purposes of criminal law- the identification of accused persons and the identification of the same person who has been charged with different crimes.[39] Wherein the report emphasized the phrase “identification of the same person, accused of a different crime”, wherein they referred to the cities of the U.S.A and Europe that keep a permanent record of the arrested persons. Keeping such records enhances the conviction rate. The committee has only recommended collecting physical evidence (blood group, fingerprints, etc.) and some pieces of evidence from the scene of the crime but not the biological evidence alike the amended act. The committee also stated that while expanding the scope of the provisions they maintained that thin line of not invading an individual’s freedom for improving procedures. Further, it stated that it assured not to invade one’s privacy. In addition, the report also mentions that the act will not explicitly empower any police officer or a court to take a specimen of the accused’s voice also.[40] Perhaps, it empowers the magistrate to take a such specimen of the signature at the trial stage. Moreover, it also upheld that authorities can use all lawful means against a person resisting the collection of measurements.

This act also describes laws in different countries. In England, only the police above the rank of inspector can invoke the power of taking fingerprints. Moreover, it also cites the U.S.A. where it is held that ‘due process of law’ which includes ‘free and fair trial’ should be employed in the area of criminal procedure. In the USA the case Schmerber v California, it was held that the privilege of compelling communication will not be violated if the compulsion makes the accused a source of real or physical evidence.[41] The report also consisted of the proposal of the American Institute which stated that the identification procedure can only be taken from a person upon whom there is a reasonable ground for suspicion.

The report has also granted the power to the police officer above the rank of sub-inspector, unlike the amended act which empowers police officers above the rank of sub-constable and a prison warder. The committee also expanded ‘measurements’ which were restricted to fingerprints and photographs only.


Despite the fact that this legislation was passed to enhance procedural tools, some of its provisions may violate people’s fundamental rights. Perhaps, it appears that enacting the new act not only invade rights of individual but worsen the rights of inmates.Obtaining the concent of the  stakeholder can moderate the laws and can maintain the sanctity of the right to privacy. Moreover, enacting  clear and robust laws without any ambiguity can protect the other rights of individuals. although this  is a positive step toward modernising criminal procedure and increasing conviction rates, India should nevertheless establish strict privacy laws to safeguard the transmission of information.   Advocate Harshit Goel has submitted a PIL to the Delhi High Court seeking for judicial review of a few clauses of the legislation and praying for declaring them unconstitutional.

Since the inception of the right to privacy, the judiciary has maintained a balance by defining the limits on a case-by-case basis. As a result, the PIL ruling will demonstrate the judiciary’s power in weighing the interests of the people against the interests of the state.

[1] Ayushi Gupta, Rights of prisoners by Ayushi Gupta, My lawman (April 22, 2021), 2021/04/legal-article-rights-of-prisoners-by.html.

[2] Shagun Bahl, Prison laws in India- the forgotten laws, IPleaders (August 24, 2017), prison-laws-india/.

[3] Md Tasnimul Hassan, From punishment to rehabilitation: there is a need for prison reforms, Newsclick (August 1, 2021),

[4] Data | Indian jails are overflowing, in 26 States prisoner count exceeds capacity – The Hindu

[5] State of Maharashtra v. Prabhakar Pandurang Sanzgir, 1966 AIR 424.

[6] Shashank Ranguwar, The new criminal procedure (identification) act, Testbook (August 8th, 2022), https://testbook .com/current-affairs/criminal-procedure-identification-act-2022-comes-into-force/

[7] FP Explainers, Explained: the row in parliament over the new bill that lets police take bio samples of accused, Firstpost (March 29, 2022),

[8] Trishee Goyal, Explained: what is the Criminal Procedure (Identification) Act, 2022, The Hindu, August 11, 2022.

[9] Vijaita Singh, Explained: how does the new Criminal Procedure (Identification) Act, 2022 propose to collect sensitive data?, The Hindu, April 3, 2022.

[10] The Criminal Procedure (Identification) bill, 2022, Prs India,

[11] The Criminal Procedure (Identification) act, 2022, Section 2(1)(b), No. 11, Acts of Parliament, 2022 (India).

[12] The Criminal Procedure (Identification) act, 2022, Section 5, No. 11, Acts of Parliament, 2022 (India).

[13] The Criminal Procedure (Identification) act, 2022, Provison of sec 3, No. 11, Acts of Parliament, 2022 (India).

[14] The Criminal Procedure (Identification) act, 2022, Section 2(1)(c), No. 11, Acts of Parliament, 2022 (India).

[15] The Criminal Procedure (Identification) act, 2022, Section 2(1)(a)(i) and (ii), No. 11, Acts of Parliament, 2022 (India).

[16] The Criminal Procedure (Identification) act, 2022, Section 2(1)(a)(iii), No. 11, Acts of Parliament, 2022 (India).

[17] The Criminal Procedure (Identification) act, 2022, Section 4, No. 11, Acts of Parliament, 2022 (India).

[18] State of Maharashtra v Prabhakar Pandurang Sanzgir, 1966 AIR 424.

[19] The Criminal Procedure (Identification) act, 2022, Section 6(1), No. 11, Acts of Parliament, 2022 (India).

[20] Universal Declaration of Human rights, Article 12,

[21] The wire, Justice Chelameswar’s Judgment, Scribd (August 24, 2017), 2121/Justice-Chelameswar-s-judgment#.

[22] Justice K. S. Puttaswamy (Retd.) V Union of India, 2017) 10 SCC 1.

[23] Kanu Agarwal, Legitimate and compelling state interest: The test for Aadhaar, Bar and Bench (31 August, 2017), 20the%20pursuit%20of%20a%20legitimate%20state,reasons%20for%20the%20collection%20and%20storage%20of%20data.

[24] Data protection laws in India, India Law Offices LLP,,in% 20a%20new%20set%20of%20complex%20legal%20issues.

[25] Ibid.

[26] State of Gujarat v High Court of Gujarat, 2022 LiveLaw (Guj).

[27] Criminal procedure (identification) act, 2022, Drishtiias (August 12, 2022),

[28] The presumption of innocence, FairTrials,

[29] INDIA CONST, art 14.

[30] The Criminal Procedure (Identification) act, 2022, Section 3(c), No. 11, Acts of Parliament, 2022 (India).

[31] Rahul Tripathi, Arrests under sedition charges rise but conviction falls to 3%, The Economic Times (February 17, 2021),

[32] Aditya Verma, Right to privacy, Central Information Commission – Report on right to privacy,file:///C:/Users/Dell/ Downloads/Right%20to%20Privacy%20and%20RTI%20by%20Aditya%20Verma%20%20(1)%20(1).pdf.

[33] Ibid.

[34] Tirtha Ajith and Akarsh Sachan, All about Criminal procedure (Identification) Act, 2022, Legal Blogs (July 12, 2022),

[35] Ibid.

[36] Bhabini Prasad Jena v Convenor secretary, orissa state commissioner for women and Anr, AIR 2010 SC 2851.

[37] Sandeep Phukan, Criminal procedure amendment bill tabeled in lok sabha amid protests, The Hindu (March 28, 2022),

[38] Miranda v Arizona, 384 U.S. 436 (1966).

[39] Law Commission of India, 87th report on Identification of Prisoners act, 1920, 2022080866.pdf.

[40] Ibid.

[41] Schmerber v Calfornia, 384 U.S. 757 (1966).

Author: Maddepally Pragna

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s