Criminal Procedure (Identification) Act 2023 - An Analysis From Evidence Law Perspective

Author: LawSphereX

Category: Criminal Law

Published: 2026-08-23T19:03:18.875Z

Updated: 2026-08-30T07:10:35.867Z

CRIMINAL PROCEDURE (IDENTIFICATION) ACT 2023:

AN

ANALYSIS

FROM EVIDENCE LAW PERSPECTIVE Harsh Raj, National Law School of India University, Bengaluru

1. Introduction

The Criminal Procedure Act, 2022 (“the Act”) passed by the Indian Parliament repealing the Identification of Prisoners Act, 1920, has sparked extensive debates regarding its impact on individual privacy, data collection, and the intersection of technology and law. The Act expands the scope of biometric and personal data that can be collected during criminal investigations and also has an expanded set of individuals who can be compelled to give such data. 1 There are multiple grounds on which the Act has been challenged in courts, which include violations of administrative law principles such as excessive delegation of power to NCRB, the Criminal Procedure (Identification) Rules, 2022 (“the Rules”) being ultra vires the scope of the Act, among others.

2 This paper analyzes the provisions of the Act with the specific focus on its implications on the Indian Evidence Law, highlighting violation of privacy and liberty rights of the accused due to lack of judicial oversight and sufficient safeguards, and scrutinizing the admissibility of biometric evidence under the Bharatiya Sakshya Adhiniyam, 2023 (“the BSA”).

The paper argues that lack of sufficient safeguards and judicial oversight of the chain of custody of the biometric samples collected under the Act pose a serious threat not only to the privacy rights of the accused but also undermines the legitimacy of the entire process. This is further exacerbated by the fact that such biometric samples shall most probably be stored as ‘electronic records’ over the 75 years timeline, and the current outdated provisions of the BSA lack the safeguards to ensure the authenticity and reliability of the modern technological records. Recent judicial attitude towards central legislations shows that it is unlikely that the Act will

1 The Act, s 3 r/w s 2(1) (b).

2 Project 39A (Anup Surendranath et al), 'An Analysis of the Criminal Procedure (Identification) Act, 2022' (Project 39A, 2022) (https://www.project39a.com/identification-act) accessed 13 September 2024. be declared ultra vires the constitution in-toto,3 despite the ongoing challenge to its constitutionality.4 Therefore, the paper submits that the judiciary must at least address the potential misuse of biometric evidence by mandating a more robust oversight framework.

2 Collection and Retention of Data

Effects of the 75-Yrs Provision The Act allows for the collection of a wide array of data, including biometric, physical, and behavioural attributes. This includes fingerprints, palm prints, retina and iris scans, handwriting samples, and perhaps even behavioural traits such as gait. 5 The Act allows for the retention of these biometric and personal data, and other physical "measurements," for a period of 75 years. 6 The expansive data collection mechanisms authorized by the Act have raised concerns regarding privacy rights, as the right to privacy has been recognized as a fundamental right under Article 21 of the Indian Constitution in the KS Puttuswamy case.

7 While there is extensive literature on how the provision violates the right to be forgotten,8 and other concerns with respect to individual autonomy,9 it is submitted that the provision also allows for violation of the safeguards present in the Indian Evidence Law which includes by-passing judicial oversight and the cornerstone principle of presumption of innocence.

2.1 Judicial Oversight

Authorization, Chain of Custody and Periodic Review Rights under Article 21 can be taken away by procedure established by law, but as the SC has held in Maneka Gandhi, such procedure must not be arbitrary, and should instead be "fair, just, and reasonable."10 However, it is submitted that the Act fails to fails to meet the standard of reasonability and fairness while impinging on the unenumerated fundamental right to privacy. The BSA weaves a golden thread of judicial safeguards through its provisions, binding them

3 SC Observer, 'SC Judgment Review 2021

Judicial Deference' (SC Observer, 28 December 2021) (https://www.scobserver.in/journal/sc-judgment-review-2021-judicial-deference-rajeev-suri-central-vista/) accessed 13 September 2024.

4 Internet Freedom Foundation & Ors. v. Union of India & Ors., SC, Diary No. 53491 of 2023

(https://www.livelaw.in/pdf_upload/5349120232024-02-12-521974.pdf).

5 The Act, s 2(1) (b).

6 The Act, s 4(2).

7 Justice K.S. Puttaswamy (Retd.) & Anr. v Union of India & Ors (2017) 10 SCC 1 [para 172].

8 Akshat Agarwal (Guest Post on Gautam Bhatia Blog), ‘The State Can’t Remember to Forget You: An Analysis of the Criminal Procedure (Identification) Act and Rules’ (Indian Constitutional Law and Philosophy, 26 July 2023) (https://indconlawphil.wordpress.com/2023/07/26/guest-post-the-state-cant-remember-to-forget-you-ananalysis-of-the-criminal-procedure-identification-act-and-rules/) accessed 20 September 2024. 9 ‘The Criminal Procedure (Identification) Bill, 2022 and the Right to Privacy’, 2022 SCC OnLine Blog Exp 29 (SCC Online, 1 April 2022) (https://www.scconline.com/blog/post/2022/04/01/the-criminal-procedureidentification-bill-2022-and-the-right-to-privacy/) accessed 13 September 2024.

10 Maneka Gandhi v Union of India (1978) 2 SCR 621, 647 (SC).

together to uphold the principles of procedural fairness in a trial that allows a non-arbitrary encroachment into private sphere of an individual. Judicial oversight is one of them. The provisions regarding confessions, hearsay (though the BSA does not use the term directly), cross-examinations, judge’s power to observe demeanour of witnesses among others ensure that the court has its inquisitive eyes over the evidence presented throughout the trial. 11 The erstwhile CrPC also had similar provision to protect the accused from arbitrary investigative processes by the police by limiting the duration of police custody. 12 However, the Act, in its current form, does not allow any sort of judicial supervision of biometric and other personal data collected from the accused persons,13 though magistrates are empowered to order collection of such samples.

14 Thus, it can be said that the biometrics of the accused perpetually stay in constructive police custody, as they can anytime access the data from the NCRB. Such a circumscription of judicial scrutiny is conspicuous at two levels: lack of authorization at the beginning stage, and absence of periodic review mechanism during the stipulated 75-yr period. The Act permits the collection of data from a wide range of individuals, including those merely arrested (even for minor offences), without requiring, firstly, judicial authorization for such data collection. 15 This lack of immediate judicial scrutiny during the collection phase raises concerns over the potential for arbitrary use of power by law enforcement agencies.

While one may argue that these are merely ‘measurements’, and even if one assumes good faith on part of the investigative agencies, the reports on alleged Aadhar data leaks suggest that such agencies are perhaps not well equipped with keeping the records safely, which may also lead to misuse of data by third parties. 16 Secondly, the Act does not provide for any regular judicial review or independent oversight body to periodically assess how collected data is being used or whether it is still necessary to retain such data. This lack of oversight on the chain of custody of biometrics and personal data may lead to misuse of such data, especially in cases where individuals are acquitted or not

11 The BSA, ss 23, 55, 149, 152, 168.

12 The Criminal Procedure Code 1973, s 167.

13 The Act, s 4(1). (Provides for NCRB alone to collect, store, process and disseminate such records.)

14 The Act, s 5.

15 The Act, s 3.

16 World Economic Forum, Global Risks Report 2019 (2019), 16 (https://www.weforum.org/reports/the-globalrisks-report-2019) accessed 13 September 2024. prosecuted. Even after acquittal, the Act and the Rules place a burden on the individual himself pray for getting the data deleted.17

2.2 Deviations from International Standards

In the UK and the EU, biometric data retention is more nuanced.18 Generally, data from unconvicted individuals has to be mandatorily deleted after a set time, with judicial oversight.19 These jurisdictions, including the United States and the European Union, also incorporate mechanisms like warrants and independent review bodies to ensure that data collection is conducted lawfully and that retention limits are observed.20 The absence of such safeguards in India's law weakens its protective framework for individual privacy and civil liberties as it diverges from these standards by: i) not seeking authorization before collection; and ii) not automatically deleting records upon acquittal or non-prosecution, creating a longer-term impact on those not found guilty. This approach is excessive compared to global data retention norms, where privacy and proportionality are prioritized.

2.3 Implications on the Principle of Presumption of Innocence

Dworkin has argued for principles being an integral part of the legal system, and challenged the Hartian construct of a strict binary of primary and secondary rules. 21 Taking a Dworkinian stance, it can be argued that the presumption of innocence not just works within the confines of enumerated provisions dictated by the BSA,22 but it is a wider principle of Evidence Law itself that pervades all spaces where the state characterizes an individual as an accused of some offence. The storage place of biometric and other personal data of an accused is one such site, where there is a possibility of violation of this principle. The long-term retention of personal data, even for those acquitted or not prosecuted, creates a perpetual association with criminal activity. It can unjustly label individuals as potential offenders for nearly their entire lives.

This defies the central mandate of the principle of presumption of innocence that individuals should not be treated as guilty unless proven

17 The Rules, rule 5.

18 The Police and Criminal Evidence Act (PACE) 1984, s 63G. (UK law)

19 S and Marper v United Kingdom (2008) 46 EHRR 2.

20 Joel R. Reidenberg, ‘The Data Surveillance State in Europe and the United States’, (2014) 49 Wake Forest L. Rev. 583 (https://ir.lawnet.fordham.edu/faculty_scholarship/645) accessed 13 September 2024.

21 Ronald Dworkin, 'The Model of Rules' (1967) 35 University of Chicago Law Review 14, 23.

22 The BSA, ss 104, 105.

otherwise in a court of law, which from a Dworkinian lens forms an indelible part of our legal system. Keeping such data for 75 years, potentially irrespective of acquittal, further batters this principle and imposes undue suspicion on innocent individuals. The Rules pose a burden on the acquitted persons to get the data deleted, for which there is no redressal mechanism if their request for the same is rejected by the concerned nodal officer.

2.4 Impact on Innocent and Marginalised Individuals

The collection retention of biometric data for an extended period could also lead to state overreach and misuse. In India, such provisions may open the door to unwarranted state intrusion into the personal lives of citizens, resembling a surveillance state. 23 The most vulnerable targets of this potential surveillance are the marginalized communities, especially Muslims, who are already under the prejudicial radar of the police and other investigative agencies. Surveys have time and again revealed the bias among the members of the police against them. 24 The mere fact that their data is retained creates a lingering association with criminality, possibly affecting future employment prospects and social interactions.

The lack of adequate legal mechanisms to challenge the retention or demand the deletion of biometric data for those acquitted or non-prosecuted (upon refusal by the nodal officer to do so) compounds the violation of their privacy and liberty rights apart from tainting the presumption of innocence.

3. Admissibility of Biometric Evidence in Court

The Act mandates that the biometrics and other personal data collected shall be stored in some form of electronic records over the course of 75-years,25 which would require expert opinion when sought to be introduced in the court. Section 39 of the BSA allows expert testimony to be admitted in court, particularly when the matter involves science or art. This provision is crucial for biometric evidence, as such data typically requires an expert to verify its authenticity and accuracy. The BSA governs the admissibility of evidence, including electronic and 23 Shaoni Das, 'The Criminal Procedure (Identification) Act, 2022 Violates Various Constitutional Mandates' (The Leaflet, 19 May 2022) (https://theleaflet. in/the-criminal-procedure-identification-act-2022-violatesvarious-constitutional-mandates/) accessed 20 September 2024.

24 The Indian Express, 'Survey: 50 per cent cops feel Muslims naturally prone to crime' (28 August 2019) (https://indianexpress. com/article/india/survey-50-per-cent-cops-feel-muslims-naturally-prone-to-crime- 5942783/) accessed 13 September 2024.

25 The Act, s 4(2).

biometric records. Two key provisions relevant to biometric evidence are section 39 itself and section 63. However, the Act has perhaps convoluted the process of obtaining expert opinion under the BSA due to the inclusion of 75-year retention period. Whereas s 39(1) of the BSA talks about scientific expert opinion in general, s 39(2) talks about expert opinion on electronic evidence in particular. Biometric evidence stored as electronic records complicates the principles governing admissibility in the BSA, as it would potentially require two simultaneous expert opinions: one on the electronic record of the biometric data and second on the biometric data itself.

The reliance on two expert opinions introduces the risk of conflicting interpretations in cases where evidence is ambiguous or of poor quality, given that there is already a cloud of uncertainty as to what mechanism would be deployed to store the data for such long period of time. Without proper judicial safeguards, the admissibility of such evidence could be contested due to potential manipulation or misuse, undermining its reliability.

3.1 Insufficient Safeguards in the BSA

The safeguards provided under section 63 of the BSA with respect to admissibility of biometrics stored in form of electronic records may not be sufficient to prevent the subversion of justice when biometric data are stored as electronic records. The requirement of a certificate authenticating electronic records is a mandatory measure; however, challenges arise when evidence is improperly stored, leading to questions of chain of custody and tampering. As highlighted earlier, due to lack of judicial supervision over the chain of custody, it is not impossible to imagine a situation where the stored data might be compromised and yet escape the eye of the court. This is primarily due to the fact that section 63 of the BSA contains outdated provisions to test the admissibility of electronic records, which fail to capture the sophisticated nature of modern technological advancements.

There is ample amount of existing literature highlighting the shortcomings of these provisions with respect to addressing contemporary intersections of technology and the law. 26 With the additional baggage of biometrics and other personal data collection under the Act, the safeguards on admissibility provided in the BSA are perhaps further going to be crushed under the mounting pressure of the question on their reliability and legitimacy in the chain of custody. 26 Ashwini Vaidialingam, 'Authenticating Electronic Evidence: §65B, Indian Evidence Act, 1872' (2016) 8 NUJS Law Review 42, 60.

4. Drawing Lessons And Way Forward

To address the potential misuse of biometric evidence, several legal, procedural, and technological safeguards are necessary to ensure that the collection, storage, and use of such data are not exploited in ways that violate individuals' rights or compromise the justice system. The Act requires several critical reforms, particularly in the areas of judicial oversight, data retention, and biometric evidence management.

4.1 Judicial Oversight

Strengthening judicial oversight is paramount. Courts must play a more active role in overseeing the collection and admissibility of biometric evidence, requiring judicial authorization for accessing sensitive biometric data. This would ensure that such data is utilized only when absolutely necessary, following standards similar to that of the EU as mentioned earlier. Moreover, mandate of regular judicial reviews should be incorporated by the courts, scrutinizing the use of biometric data and assessing whether its retention for up to 75 years is justified.

4.2 Monitoring Chain of Custody and Data Retention

Maintaining the integrity of biometric evidence is also essential. A strict chain of custody must be established to prevent tampering with biometric data. All transfers and access to biometric records should be logged and subjected to regular audits. The use of advanced technologies, such as blockchain, can perhaps further ensure the integrity and security of biometric data throughout its lifecycle, making tampering more difficult. This is one marginally redeeming option that can be considered, if we are to live with the draconian provisions under the Act. Additionally, the creation of an independent regulatory body to monitor the collection, storage, and use of biometric data would help to ensure accountability. This body should have the authority to conduct audits, enforce compliance, and impose penalties for misuse.

India could model this regulatory framework after global data privacy laws, such as those established under the General Data Protection Regulation (GDPR),27 where Data Protection Authorities play a key role in safeguarding privacy. The current framework of allocating these tasks directly to 27 European Parliament and Council, 'Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data' [2016] OJ L119/1.

NCRB and the Central government raises concerns about biasness and data security, as already highlighted earlier in the article.

4.3 Question of Consent

Informed consent and public awareness are vital in maintaining transparency and protecting individual rights. Individuals must be adequately informed about the collection and use of their biometric data and should be given the option to consent or object, particularly in cases where the necessity of such data collection is questionable. Although proviso to section 3 of the Act specifically mentions that persons arrested for offences other than those against women and children may not be obliged to allow taking of their ‘biological samples’, the ambiguity in the definition of the term may escape the psyche of a layman, who might invariably be compelled to furnish biological samples despite the statutory protection. Currently, the Act not only compels the accused to give such data/samples, but also penalises them if they refuse to comply.

28 They might be prosecuted for their refusal even if they are finally acquitted in original case against them. Therefore, it is the responsibility of the courts to make available avenues for redress in such cases to ensure both transparency and accountability.

5. Conclusion

At the time of writing of this article, the petition challenging the constitutional validity of the Act has already been rejected by the Supreme Court, directing the petitioners to first approach the High Court in this regard. 29 As earlier highlighted in the introductory section, it is unfortunately highly unlikely that the court would declare all the contested draconian provisions ultra vires the constitution, given the deference shown by the judiciary towards central legislations on matters related to security of the state and of general ‘national importance’. However, the court must try to at least issue guidelines with respect to the modus operandi of the collection and retention of the biometrics and other personal data, incorporating the essential (if not all) safeguards highlighted in the preceding section of this paper.

These safeguards are not randomly created suggestions manifested out of thin air, but a collation of analysed international frameworks that are followed generally, at least in liberal democracies.

28 The Act, s 6(2).

29 Internet Freedom Foundation (n 4).

By incorporating these safeguards, the invasionary aspects of Criminal Procedure (Identification) Act, 2022 could be mitigated to some extent by protecting individual privacy ensuring the responsible use of biometric evidence; thus, preserving the integrity and legitimacy of the justice system.