Surveillance Without Statute: Evaluating the Constitutional Validity of Facial Recognition Technology Under Article 21
The rapid convergence of biometric processing, automated vision analytics, and machine learning algorithms has enabled state law enforcement agencies in India to deploy Facial Recognition Technology (FRT) on an unprecedented scale. From automated border control portals at international airports to real-time closed-circuit television (CCTV) surveillance during public political demonstrations and urban municipal management, automated facial identification is increasingly framed by the executive as an indispensable technological instrument for crime prevention and administrative efficiency. However, the operational normalisation of mass facial scanning presents a profound constitutional dilemma: the systematic deployment of an invasive biometric surveillance infrastructure in the total absence of a governing statutory framework enacted by Parliament or state legislatures.
Unlike traditional physical surveillance or telephone interception—which are regulated by specific procedural mechanisms under the Indian Telegraph Act, 1885, and Section 92 of the Code of Criminal Procedure, 1973 (now Section 95 of the Bharatiya Nagarik Suraksha Sanhita, 2023)—automated facial recognition operates within a statutory vacuum. State police departments and municipal authorities routinely procure and deploy automated FRT software via executive notifications, administrative tenders, or internal police manuals. This paper presents a detailed constitutional critique of non-statutory facial surveillance in India. It subjects state-wide FRT deployment to the strict judicial standards established in Justice K.S. Puttaswamy (Retd.) v. Union of India,¹ evaluates the chilling effect on fundamental freedoms guaranteed under Article 19, exposes the structural exemptions in the Digital Personal Data Protection Act, 2023 (DPDPA),² and proposes a model for statutory regulation and judicial oversight.
The Architecture of Facial Recognition and the Myth of Passive Surveillance
Facial recognition technology operates by extracting static or dynamic spatial arrangements of facial nodal points—such as the distance between the eyes, the depth of eye sockets, and the contour of the jawline—to construct a unique numerical vector known as a biometric template or ‘faceprint’. This generated template is subsequently processed through algorithmic databases, such as the National Automated Facial Recognition System (AFRS) or the Crime and Criminal Tracking Network & Systems (CCTNS), to perform either one-to-one (1:1) identity verification or one-to-many (1:N) mass identification across public crowds.
Proponents of state surveillance frequently assert that capturing facial imagery in public places does not infringe upon constitutional privacy guarantees because individuals voluntarily expose their physical features when entering the public domain. This argument relies on an obsolete, binary dichotomy between private domestic spaces and public thoroughfares—a division that Indian constitutional jurisprudence has progressively rejected. Modern constitutional principles recognise that spatial privacy, contextual integrity, and practical anonymity in public spaces are vital prerequisites for individual autonomy.
When state authorities deploy automated FRT cameras across public spaces, the state does not merely record public behaviour; it continuously extracts, processes, and catalogues the biometric identities of thousands of law-abiding citizens simultaneously without their knowledge, explicit consent, or individualised suspicion. This transforms public spaces from arenas of civic interaction into controlled zones of continuous state tracking, eroding the reasonable expectation of anonymity.
Part 2: The Puttaswamy Proportionality Test & Chilling Effects
Subjecting Non-Statutory FRT to the Puttaswamy Proportionality Standard
In the historic nine-judge Constitution Bench decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court established that the right to privacy is an intrinsic element of life and personal liberty under Article 21 of the Constitution.³ To ensure that any state intrusion into privacy remains constitutionally valid, the Court articulated a strict three-pronged test of proportionality:
Three-Pronged Test of Proportionality
| Test | Constitutional Requirement |
|---|---|
| Legality (Requirement of Law) | The state action must be explicitly authorised by a valid, clear, and accessible statutory law enacted by the legislature. |
| Legitimate State Aim | The measure must pursue a legitimate state objective, such as national security or public order. |
| Proportionality and Necessity | The intrusion must be strictly necessary to achieve the goal, employing the least restrictive means possible, accompanied by procedural safeguards to prevent administrative abuse. |
The current deployment of facial recognition technology in India fails at the very first threshold: the requirement of legality. Administrative guidelines, executive orders, and procurement tenders do not constitute ‘law’ for the purposes of restricting fundamental rights under Article 21. As established in Maneka Gandhi v. Union of India,⁴ any procedure that deprives an individual of personal liberty must be ‘just, fair, and reasonable’, anchored in a formal legislative enactment. Deploying mass surveillance systems purely through executive discretion violates the rule of law and empowers state agencies to act without statutory accountability.
Furthermore, current FRT deployments fail the proportionality standard. Mass, indiscriminate biometric scanning of general populations in public parks, transit hubs, or political rallies lacks a targeted nexus to specific, individualised suspicion. Scanning thousands of innocent citizens to identify a single prospective offender represents an excessive, disproportionate exercise of state authority that exceeds permissible constitutional limits.
The Chilling Effect on Fundamental Freedoms Under Article 19
The constitutional impact of unchecked facial surveillance extends beyond the right to privacy under Article 21; it directly threatens fundamental freedoms guaranteed under Article 19 of the Constitution.
Freedom of Speech and Expression [Article 19(1)(a)]
The awareness that state cameras are actively matching faces against police databases during peaceful political protests or public demonstrations creates a severe ‘chilling effect. ‘Citizens are discouraged from exercising their freedom of expression or displaying dissent due to reasonable fears of state profiling, blacklisting, or retrospective harassment.
Freedom of Peaceful Assembly [Article 19(1)(b)]
Mass facial recognition during public gatherings effectively strips citizens of their political anonymity. When attending a public rally exposes an individual to permanent biometric recording by enforcement agencies, the fundamental right to assemble peacefully without arms is compromised.
Freedom of Movement [Article 19(1)(d)]
Ubiquitous tracking across transit networks through interconnected FRT systems enables real-time location mapping of citizens, converting the basic freedom of movement into a tracked, state-monitored activity.
Part 3: Regulatory Lacunae, Proposed Safeguards & Endnotes
Regulatory Lacunae: The DPDP Act, 2023, and State Exemptions
The constitutional risks surrounding non-statutory FRT deployment are further compounded by legislative gaps in data governance. While the Digital Personal Data Protection Act, 2023 (DPDPA) purports to create a comprehensive framework for processing digital personal data, Section 17(1)(b) grants sweeping exemptions to state instrumentalities for the prevention, detection, or investigation of offences.²
These broad statutory exemptions leave law enforcement agencies effectively unregulated regarding biometric data retention, function creep (the practice of using data collected for one purpose for an unrelated secondary purpose), and third-party software sharing. Unlike mature international jurisdictions—such as the European Union, where the AI Act imposes strict prohibitions on real-time remote biometric identification in publicly accessible spaces⁵—Indian law currently contains no statutory limits on biometric retention periods or algorithmic sharing among law enforcement entities.
A Model Framework for Statutory Regulation and Judicial Oversight
To restore constitutional compliance and prevent arbitrary state surveillance, India requires a comprehensive legislative framework grounded in four essential safeguards:
Mandatory Primary Legislation
All existing non-statutory facial recognition systems must be suspended until Parliament enacts a dedicated, comprehensive statute defining permissible parameters, data retention limits, and strict oversight mechanisms.
Prior Judicial Warrants for Real-Time Identification
The use of real-time 1:N facial recognition in public spaces must require a prior warrant issued by a senior judicial magistrate, grounded in objective, individualised evidence of a grave threat to national security or public order.
Prohibition of Indiscriminate Mass Profiling
Blanket biometric surveillance during peaceful political protests, civil rallies, or routine public gatherings must be declared explicitly unlawful.
Independent Statutory Audit and Right to Erasure
An independent judicial authority must conduct annual technical audits of facial recognition databases. Citizens must possess a statutory right to inspect whether their biometric templates have been logged, alongside a right to demand the erasure of non-match records.
Conclusion: Preserving Anonymity in a Digital Democracy
The deployment of facial recognition technology in India stands at a critical constitutional crossroad. While technological tools offer legitimate operational benefits to law enforcement agencies, deploying mass biometric surveillance in the absence of a governing statute violates fundamental guarantees under Article 19 and Article 21.
A democratic society governed by the rule of law cannot permit executive discretion to substitute formal legislative procedure. To preserve the constitutional promise of personal liberty and individual autonomy, the judiciary and legislature must establish clear statutory boundaries. Ensuring that surveillance technologies remain strictly subordinate to constitutional safeguards is essential to protecting individual freedom in the digital age.
Endnotes
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
- Digital Personal Data Protection Act, 2023, s. 17(1)(b), No. 22, Acts of Parliament, 2023 (India).
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, at para 310.
- Maneka Gandhi v. Union of India, (1978) 1 SCC 248: AIR 1978 SC 597.
- Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), art. 5(1)(h).
- State of Maharashtra v. Madhukar Narayan Mardikar, (1991) 1 SCC 57.
- Indian Telegraph Act, 1885, s. 5(2); People’s Union for Civil Liberties (PUCL) v. Union of India, (1997) 1 SCC 301.
- Kharak Singh v. State of U.P., AIR 1963 SC 1295: (1964) 1 SCR 332.
- Gobind v. State of M.P., (1975) 2 SCC 148.
- Anuradha Bhasin v. Union of India, (2020) 3 SCC 637.
