Centre rejects MP’s claims on ‘sharing’ of NEET protesters’ data

1. At a Glance

• What it is: Rajya Sabha MP A.A. Rahim has gone to court against police use of Facial Recognition Technology (FRT) and biometric surveillance at public protests, especially at Jantar Mantar. He alleges that the biometrics of NEET-UG protesters were kept illegally and passed to third parties. [1]
• The Centre's response: The Ministry of Home Affairs (MHA) filed an affidavit through the National Crime Records Bureau (NCRB). It calls the claims "sweeping" and "omnibus", and says they have no factual basis. [1]
• Why it matters for UPSC: The case brings together the right to privacy, free speech and assembly, the Criminal Procedure (Identification) Act, 2022, police databases (NAFIS, CCTNS) and the wider question of a surveillance state. These are core GS-II and GS-III themes. [1][2][6]

2. Why in the News

• On 10 October 2026, The Hindu reported that the Union government opposes Mr Rahim's claim that the biometric data of "thousands of protesters" has been entered into national criminal databases. [1]
• MHA/NCRB's position: blanket claims of indefinite retention, storage and sharing of biometric data are "not based on foundational facts". [1]
• The government says the petitioner has not pointed to a single biometric record that was unlawfully collected at Jantar Mantar, sent to NCRB, and then processed or kept in breach of any law. [1]
• MHA says an "omnibus" claim that NEET-UG protesters' biometrics were captured and stored "cannot substitute for proof" that this actually happened. [1]
• The petitioner wants biometric data deleted and erased from NAFIS, CCTNS and "every allied database". The government calls this prayer "wholly omnibus", because granting it would require identifying the specific category of record and the database holding it. [1]
• Note: The excerpt available does not name the court or give the date of the protests.

3. Background & Evolution

• Identification of Prisoners Act, 1920: the colonial-era law that let police take limited measurements, such as fingerprints and footprints, of convicts and arrested persons. [5]
• 2022: The Criminal Procedure (Identification) Bill, 2022 was introduced. It widened the types of data that can be collected and the categories of people it can be collected from. [3]
• 2022: It was enacted as The Criminal Procedure (Identification) Act, 2022 (Act No. 11 of 2022), repealing and replacing the 1920 Act. [4][7][5]
• 2022: The Criminal Procedure (Identification) Rules, 2022 were notified. They empower NCRB to issue guidelines on taking, storing, processing, matching, destroying and disposing of measurements. [2]
• NAFIS: NCRB's National Automated Fingerprint Identification System, which MHA describes as having "revolutionized" fingerprint identification in crime control. [6]
• CCTNS: the Crime and Criminal Tracking Network & Systems, which connects police stations across India for online FIR registration and records. [6]
• 2026: The Rahim petition challenges how these systems are being used against protesters. [1]

4. Core Static Facts

Item	Fact
Governing law	Criminal Procedure (Identification) Act, 2022 (Act No. 11 of 2022) [4][7]
Law it replaced	Identification of Prisoners Act, 1920 [5]
"Measurements" covered	Fingerprints, palm prints, footprints, photographs, iris and retina scans, physical and biological samples and their analysis, and behavioural attributes [3]
Central custodian	NCRB (under MHA). It can collect records from States, UTs and other law enforcement agencies, and store, process, share, disseminate and destroy them [3]
Retention period	75 years in digital or electronic form [3]
When records are destroyed	When the person is acquitted after all appeals or released without trial [3]
Rule-making	The 2022 Rules let NCRB set guidelines on the handling, storage, matching and destruction of records [2]
CCTNS coverage	99.9% of police stations (16,597) register 100% of FIRs directly. 28.98 crore police records are on the system [6]
NAFIS	NCRB's national fingerprint database [6]
Affidavit filed by	MHA through NCRB [1]
Petitioner	A.A. Rahim, Rajya Sabha MP [1]
Protest site	Jantar Mantar, New Delhi [1]

5. Multi-Dimensional Analysis

Legal / Constitutional

• The petitioner relies on the fundamental rights to privacy and to free speech and expression. NCRB argues that any claim of infringement must rest on a factual foundation. [1]
• Burden of proof: the State says a general allegation cannot replace proof that data was actually captured and kept. [1]
• The 75-year retention rule and the wide definition of "measurements" in the 2022 Act are the legal hooks for any proportionality challenge. [3]
• Remedy problem: a blanket order to delete data from "every allied database" is hard for a court to grant without the specific record and database being identified. [1]

Ethical / Governance

• The case raises the chilling effect on lawful protest: people may stay away from demonstrations if they fear being enrolled in a criminal database. [1]
• Purpose limitation: the 2022 Act lets NCRB share and disseminate records, which raises the question of who the "third parties" are and on what terms data reaches them. [3][1]
• Opacity: it is hard for citizens to prove they have been enrolled when the databases are not open to them. This information gap sits behind the dispute over what counts as "foundational facts". [1]

Scientific / Technological

• FRT matches faces from crowd footage against stored images. Its accuracy, bias and lack of a specific governing law are well-known concerns. [1]
• NAFIS and CCTNS form a national, linked policing data system, so data can spread across them. [6]

Administrative / Federal

• Policing is a State subject, but NCRB collects records from States and UTs into a central repository. This creates a centralising trend. [3]
• CCTNS reaches 16,597 police stations, which shows how wide the system is. [6]

Social

• The protesters were NEET-UG aspirants, mostly students and young people. The case links exam-governance grievances to civil liberties. [1]

6. Recent Developments (last 12–18 months)

• October 2026: The MHA/NCRB affidavit rejects Mr Rahim's claims of storage and sharing of NEET-UG protesters' biometrics, and calls his prayer for deletion "wholly omnibus". [1]
• The challenge covers FRT and biometric surveillance by police during public demonstrations at Jantar Mantar. [1]
• The 75-year retention rule under the 2022 Act remains in force. [3]

7. Prelims Hooks

• The Criminal Procedure (Identification) Act, 2022 is Act No. 11 of 2022. [4][7]
• It repealed the Identification of Prisoners Act, 1920. [5]
• Records of measurements are kept for 75 years in digital form. [3]
• NCRB is the central agency for collecting, storing, processing, sharing and destroying these records. [3]
• NCRB works under the Ministry of Home Affairs, not the Ministry of Law. [1]
• "Measurements" include iris and retina scans, biological samples and behavioural attributes. [3]
• Records are destroyed if the person is acquitted after all appeals or released without trial. [3]
• NAFIS stands for National Automated Fingerprint Identification System and is run by NCRB. [6]
• CCTNS stands for Crime and Criminal Tracking Network & Systems. [6]
• CCTNS: 16,597 police stations (99.9%) register FIRs directly, with 28.98 crore records. [6]
• The Criminal Procedure (Identification) Rules, 2022 empower NCRB to issue guidelines on the handling and disposal of records. [2]
• The petitioner is A.A. Rahim, a Rajya Sabha MP. [1]

8. Why the Rules Should Keep Most Protesters Out of the Database

• The 2022 Rules protect people detained only to stop a protest
• The Act allows measurements from convicts, arrested persons and people held under any preventive detention law (detention to stop a possible offence, not to punish one already done) [9].
• The 2022 Rules narrow this. Some people cannot be measured unless they are also charged with, or arrested for, another offence [9].

• This group includes people who break prohibitory orders under Sections 144 or 145 of the CrPC (orders that ban gatherings), and people held under Section 151 CrPC (arrest to prevent an offence) [9].

• Why this matters for the NEET-UG case

• If protesters were only detained or removed to break up the protest, the Rules say police should not take their fingerprints or photographs for the database.

• So the court has a clear question to ask: were any protesters charged with a separate offence? If not, there was no legal ground to enrol them.

• But this protection is weak

• PRS points out that by narrowing the Act, the Rules may go beyond the powers the Act gives them [9].
• The protection sits in Rules that the executive (the government, not Parliament) can change. The Act passed by Parliament still allows wider collection.

9. The Government's Strongest Point, and Where It Falls Short

• What is right about the Centre's argument
• A court cannot strike down State action on suspicion alone. A claim that a fundamental right was violated needs facts behind it [1].
• An order to delete data from "every allied database" is hard to enforce. Nobody can check compliance if the record and the database are never named [1].

• The State has not admitted that it collected the data. A court would be wrong to treat silence as an admission [1].

• Where it falls short: the citizen cannot see the evidence

• Under the Rules, records are not destroyed automatically. The person must apply to a nodal officer (an official named by the State or Centre), who then recommends destruction to NCRB [9].
• You cannot apply to delete a record you do not know exists. The databases are not open to the people listed in them.

• So the State asks for "foundational facts" that only the State holds. The proof the petitioner needs sits inside NAFIS and CCTNS.

• Other laws put the duty on the State instead

• Under the Juvenile Justice Act, 2015, the Juvenile Justice Board directs the police and courts to destroy a child's records. The child does not have to ask [9].

• Even the colonial 1920 Act said the records of an acquitted person must be destroyed [9].

• A fair middle path for the court

• Instead of asking the petitioner for proof, the court could order NCRB to state, in a sealed cover or an affidavit, whether any records linked to the Jantar Mantar protest dates exist.

10. NCRB Writes Its Own Rulebook

• NCRB sets the rules it must then follow
• The Act lets the government make Rules. The Rules hand the details to NCRB through SOPs (Standard Operating Procedures: step-by-step instructions) [9].
• These SOPs cover how data is taken, stored, matched, shared and destroyed [9].

• PRS says this breaks the separation between the body that writes guidelines and the body that follows them [9].

• Passing on power a second time

• In Siddharth Sarawagi (2014), the Supreme Court said an agency given a task by the legislature cannot pass that task on to another body [9].

• The Rules pass the government's delegated power on to NCRB. This is a case of excessive delegation (handing law-making power so far down that the legislature loses control) [9].

• Parliament may never see the SOPs

• The Rules must be placed before Parliament. It is not clear whether NCRB's SOPs will be [9].

• The questions this petition raises are all SOP questions: who counts as an authorised user, how matching works, when data is deleted. Parliament may never have reviewed the answers.

• The "third parties" question has no public answer

• On paper, sharing works like this: an authorised user (a police or prison officer cleared by NCRB) sends a request, and NCRB sends back a match report [9].
• The Act lets NCRB "share and disseminate" records with law enforcement agencies [3]. No public list says which agencies those are.

11. How a Small Arrest Can Mean 75 Years in the Database

• The net is very wide
• Data can be taken from anyone arrested for any offence. This includes minor ones such as rash driving, which carries at most six months in jail [5].

• Under Puttaswamy (2017), an invasion of privacy must be necessary and proportionate to its purpose. PRS notes that keeping records for 75 years, about a lifetime, may fail this test [5].

• Refusing to give fingerprints can make your record permanent

• Refusing to give measurements can be charged under Section 186 IPC (obstructing a public servant) [5].
• A protester may later be acquitted of the original charge but convicted for refusing. The record can then stay for 75 years [5].

• So a protester who refuses on principle may end up worse off than one who complies.

• Fewer checks on the police

• In 1980 the Law Commission recommended that magistrates record reasons when they order measurements [5].
• The 2022 Act instead lowered the rank of officer allowed to take measurements, from sub-inspector to head constable [5].

12. Facial Recognition: Already Used by Police, Still Not Governed by Law

• The government's own think-tank flagged the risks
• In 2022, NITI Aayog released a discussion paper on Facial Recognition Technology (FRT) under its Responsible AI for All series [10].
• It warned that FRT risks privacy, equality, free speech and freedom of movement [10].
• It noted that police in Punjab, Gujarat and Tamil Nadu were already using FRT [10].

• It was a draft for public comment, not a law. The police still use FRT with no law written for it.

• The 2022 Act does not cover crowd scanning

• The Act lists "photographs" as measurements, but only from convicts, arrested persons and detainees [3][9].
• FRT at a protest scans everyone in the crowd, including people who are never arrested.
• So crowd FRT is neither clearly allowed nor clearly limited by the Act. That legal grey zone is what the petition challenges.

13. Who Should Do What Next

• MHA should make deletion automatic, not on request
• Change the Rules so NCRB or the police must destroy records on acquittal or release, with no application needed.

• The Juvenile Justice Act, 2015 already works this way: a board orders destruction [9].

• MHA should place NCRB's SOPs before Parliament

• This answers PRS's concern that the most important detail escapes legislative review [9].

• Publish which agencies count as authorised users, so the "third parties" question has a public answer.

• Parliament should pass a law on police use of FRT

• Build on the risks NITI Aayog's 2022 paper listed: privacy, equality, free speech and movement [10].

• The law should say when crowd footage may be matched against police databases, and how long the images may be kept.

• NCRB should publish yearly figures

• Report how many records were added for people held under the Section 144/151-type provisions, and how many were destroyed.

• Citizens could then raise a factual claim without first needing access to the database.

• The higher courts should decide the common questions together

• Challenges to the Act itself are pending in the Delhi and Madras High Courts [9].
• The proportionality of 75-year retention should be settled once, not separately in every protest case.

14. Anchors for Answers

• Data: Records are kept for 75 years [3]. CCTNS holds 28.98 crore police records across 16,597 police stations [6].
• Report/Committee: Law Commission (1980): magistrates should record reasons when ordering measurements [5]. PRS review of the Criminal Procedure (Identification) Rules, 2022 [9]. NITI Aayog, Responsible AI for All: FRT discussion paper (2022) [10].
• Law/Case: K.S. Puttaswamy (2017): the test of necessity and proportionality [5]. Siddharth Sarawagi (2014): an agency cannot pass on a delegated task [9]. The Rules exclude people held under Sections 144/145/151 CrPC unless they are charged with another offence [9]. Section 186 IPC applies to refusal [5].
• Comparison: Juvenile Justice Act, 2015: the board orders police to destroy records, so the person does not have to apply [9]. The 1920 Act required records of acquitted persons to be destroyed [9].
• Scheme: CCTNS and NAFIS: the national police databases at the centre of the deletion request [6]. Digi Yatra: the FRT use case NITI Aayog studied in detail [10].

15. Mains Relevance

• GS-II: Fundamental rights (Articles 19 and 21); government policies and their design; statutory bodies (NCRB).
• GS-III: Internal security and the role of technology; challenges of surveillance; police modernisation.
• GS-IV: Ethics of surveillance; balancing State interest against individual dignity; accountability.
• Possible question stems: 1. The use of Facial Recognition Technology at sites of peaceful protest risks converting dissent into data. Critically examine in the light of India's privacy jurisprudence. (15 marks) 2. Evaluate whether the Criminal Procedure (Identification) Act, 2022 satisfies the test of proportionality, with reference to the scope of 'measurements' and the 75-year retention period. (15 marks) 3. Centralised police databases such as CCTNS and NAFIS improve crime control but raise concerns of function creep. Discuss the safeguards needed. (10 marks)

16. Related Topics to Study Next

• Right to Privacy judgment (K.S. Puttaswamy, 2017): the basis of the privacy claim and of the proportionality test. (Not verified in the sources retrieved for this note.)
• Digital Personal Data Protection Act, 2023: check whether, and how far, its exemptions for the State cover police biometric data. (Not verified in the sources retrieved for this note.)
• Bharatiya Nagarik Suraksha Sanhita, 2023: the new criminal procedure code that works alongside the Identification Act. [8]
• NCRB and CCTNS/ICJS: the structure of India's police data systems. [6]
• The right to protest (Article 19(1)(a) and (b)): the legal status of designated protest sites such as Jantar Mantar.
• NEET-UG controversies and the National Testing Agency (NTA): the exam-governance background to the protests.
• Cyber security under MHA (I4C): MHA's wider digital policing setup. [6]

17. NCERT Concepts to Revise

• Right to privacy (Polity): The petition's core claim is that biometric capture and retention at protests violates privacy under Article 21.
• K.S. Puttaswamy case (Polity): This 2017 ruling set the legality, necessity and proportionality test used to judge surveillance and data retention.
• Doctrine of proportionality (Polity): Challenges to 75-year retention and wide 'measurements' definition turn on whether the intrusion is no more than necessary.
• Right to protest (Polity): Protesters at Jantar Mantar claim biometric surveillance chills their freedom to demonstrate peacefully.
• Digital Personal Data Protection Act 2023 (Polity): Shows how far India's data protection law, and its State exemptions, covers police biometric data.
• Bharatiya Nagarik Suraksha Sanhita 2023 (Polity): The new criminal procedure code that works alongside the Identification Act in policing and investigation.

18. Common Errors / Trap Areas

• Wrong ministry: NCRB is under MHA, not MeitY or the Ministry of Law. [1]
• Retention period: it is 75 years, not 25 or 50. [3]
• Act it replaced: the Identification of Prisoners Act, 1920, not 1898 (the old CrPC) or 1973. [5]
• NAFIS vs CCTNS: NAFIS is the fingerprint database; CCTNS is the network for FIRs and police records. [6]
• The State did not "admit" collecting data: its position is that the petition has not proved any unlawful collection or retention. It has not conceded that data was collected and then defended it. [1]