Facial Recognition at Protests Raises Surveillance and Privacy Concerns

The constitutional right to privacy was firmly established as a fundamental right under Article 21 by a nine-judge Constitution Bench in Justice K.S. Puttaswamy v. Union of India (2017). The judgment held that informational privacy, including control over biometric data, is an intrinsic part of the right to life and personal liberty. Any state intrusion must satisfy a triple test: legality (a valid law authorising the action), a legitimate aim, and proportionality between the means used and the objective sought.

The right to peaceful assembly is separately protected under Article 19(1)(b), subject only to reasonable restrictions under Article 19(3) on grounds of sovereignty, public order, or morality. These two rights together form the constitutional baseline against which any surveillance of protesters must be measured. The Criminal Procedure (Identification) Act, 2022 replaced the colonial-era Identification of Prisoners Act and expanded the categories of biometric data, including facial measurements, that police may collect. Critically, the Act restricts collection to specific categories of persons: those arrested, convicted, or detained. It does not authorise collection from persons attending a lawful public assembly.

The Digital Personal Data Protection (DPDP) Act governs how personal data, including biometric identifiers, may be collected and processed. However, its data-processing obligations are not yet in force, and the Act contains broad exemptions for state agencies, creating a significant accountability gap.