white_paper_on_data_protection_in_india_171127_final_v2

scope and nature of business, (2) the nature and amount of data stored, and (3) the need
to ensure confidentiality of employee data, will have to be suitably provided in law; 296
d. Important economic and financial interests of a public body (South Africa); 297
e. Processing in pursuance of an order of a court. 298
(v)
Investigation and detection of crime
In India, several laws such as the Code of Criminal Procedure, 1973 (CrPC), the Unlawful
Activities (Prevention) Act, 1967, the National Investigation Agency Act, 2008, the
Prevention of Money Laundering Act, 2002 (PMLA) etc. empower law enforcement agencies
and police officers to collect personal information for the purpose of investigation of a crime.
The process of search and seizure for the purpose of criminal investigation can be understood
from the perspective of certain criminal law legislation in India. For instance, Section 91 of
the CrPC provides power to a Court or a police officer in charge of a police station to issue
summons, or an order in writing, to an individual in possession of a document or thing to
produce such documents or things if it is ‗necessary or desirable for the purpose of any
investigation, inquiry, trial or other proceeding under this Code.‘ Section 93 of the CrPC
empowers the Court to issue a ‗search warrant‘ to compel individuals to produce the
necessary documents or things in certain circumstances.
Further, the PMLA provides powers of search and seizure to a ‗Director or any other officer
not below the rank of Deputy Director.‘ 299 The authorised officer under this provision may
seize any record 300 or property found during the course of search, and may even retain the
seized property or record if the retention is necessary for to conduct an inquiry under the
PMLA. 301 The PMLA also provides certain safeguards to ensure that the powers listed above
are not exercised arbitrarily. Section 62 of the PMLA provides a penalty for officers
exercising their powers of search and seizure without reasons in writing.
Similarly, information ‗which would impede the process of investigation or apprehension or
prosecution of offenders‘ is exempted from disclosure under the Right to Information Act,
2005 (RTI Act). 302 This refers to information about ‗targets of investigation‘ or an ‗accused‘.
The term has been interpreted to include investigation during disciplinary proceedings,
investigation by income tax authorities, etc.
In the UK DPA, the purposes specified for this exemption are – ‗prevention or detection of
crime‘; or ‗apprehension or prosecution of offenders‘; or ‗assessment or collection of any tax
296 Oracle, Massachusetts Data Security Law Signals New Challenges In Personal Information Protection,
Oracle White Paper (August 2010), available at: http://www.oracle.com/us/products/database/data-security-ma-
201-wp-168633.pdf, (last accessed 17 November 2017).
297 Section 37(2)(c), POPI Act.
298 For instance, Section 35, UK DPA.
299 Section 17, PMLA.
300 ‗Records‘ include the records maintained in the form of books or stored in a computer or such other form as
may be prescribed, Section 2(w), PMLA.
301 Section 20 and 21, PMLA.
302 Section 8(1)(h), RTI Act.
56