AI, Facial Recognition and the State: How Much Surveillance Can a Democracy Allow?

Aspiro Living | UPSC Current Affairs | 9 min read

Delhi Police deployed facial recognition technology at Prayagraj Kumbh 2025 and identified thousands of individuals in hours. The technology found missing persons, located wanted criminals, and managed crowd movement with unprecedented efficiency.

It also flagged innocent people incorrectly. It operated without explicit consent of those scanned. And it was deployed in a constitutional environment where there is still no specific legislation governing AI-based surveillance.

This is the surveillance dilemma India is living, without having resolved it. And for UPSC, it is the constitutional, technological, and governance question that sits at the intersection of Articles 19, 21, the Puttaswamy judgment, and the Digital Personal Data Protection Act, 2023.

What Facial Recognition Technology Actually Is

Facial recognition is a form of biometric identification that maps and analyses facial features from images or video. Modern systems use deep learning algorithms trained on millions of face images. The system extracts a numerical 'faceprint' from an image and compares it against a database.

The technology has two distinct applications that are often conflated:

• One-to-one verification: Confirming that a person is who they claim to be. Used at airport e-gates and mobile phone unlocking. Lower error rates. Consent is typically explicit.
• One-to-many identification: Matching an unknown face against a database of known faces. Used for crowd surveillance and criminal identification. Higher error rates. Consent is typically absent.

It is the second application, one-to-many identification in public spaces, that raises the serious constitutional concerns. And it is the second application that police forces are deploying at scale.

The Constitutional Framework

Article 21 and the Puttaswamy Judgment

In Justice K.S. Puttaswamy v Union of India (2017), a nine-judge Constitution Bench unanimously held that the right to privacy is a fundamental right under Article 21. The judgment identified multiple dimensions of privacy: informational privacy (control over personal data), decisional privacy (autonomy over personal choices), and bodily integrity.

Informational privacy is directly engaged by facial recognition surveillance. When your face is scanned in a public space, mapped to a database, and your identity determined without your knowledge, you have lost control over personal biometric information without consent.

The Puttaswamy judgment held that privacy restrictions must satisfy three conditions: legality (backed by law), legitimate aim, and proportionality. Mass facial recognition surveillance in public spaces faces a difficult proportionality test: does the security benefit justify the privacy cost imposed on millions of innocent people scanned to locate a small number of wanted individuals?

Article 19: The Chilling Effect

Mass surveillance of public spaces does not merely identify criminals. It identifies everyone. A person who knows they are being identified at a protest, a political meeting, or a religious gathering may self-censor their public activities, what constitutional scholars call the chilling effect on freedom of expression and assembly.

This chilling effect was explicitly recognised in Anuradha Bhasin v Union of India (2020) in the internet shutdown context. The same logic applies to physical surveillance: the knowledge of surveillance changes behaviour even among those with nothing to hide. This is constitutionally significant because the right to protest, assemble, and express dissent is protected and is chilled by pervasive surveillance.

Algorithmic Bias: The False Positive Problem

Facial recognition systems do not perform equally across demographic groups. Multiple peer-reviewed studies, including MIT Media Lab research by Joy Buolamwini (2018) and NIST's Face Recognition Vendor Test, have documented significantly higher error rates for darker-skinned individuals and women compared to light-skinned men.

In a policing context, a false positive, incorrectly matching an innocent person to a criminal record, can result in wrongful arrest, detention, and reputational harm. The burden of proving innocence then falls on the wrongly identified individual.

For India, where the criminal justice system already produces documented false conviction rates, algorithmic errors layered on top of existing systemic failures create a compounded risk for communities that are already most likely to face law enforcement attention.

The Digital Personal Data Protection Act, 2023

India's DPDP Act, 2023 is the primary framework governing the processing of personal data. It creates obligations for 'data fiduciaries', entities that determine how personal data is processed, including obtaining consent, limiting data collection to what is necessary, and implementing security safeguards.

The Act has significant exemptions for state processing. The central government can exempt any instrumentality of the state from the Act's requirements in the interest of national security, public order, or sovereignty. This exemption is broad enough to potentially cover most police and intelligence surveillance.

The Act does not specifically address biometric data in surveillance contexts. A separate AI governance framework, which multiple government consultation papers have gestured toward but which does not yet exist, would be needed to specifically regulate facial recognition deployment by law enforcement.

What AI Governance Actually Requires

The question is not whether the state should have surveillance capabilities. It should. Effective policing in a country of 1.4 billion people requires technology. The question is what constraints must govern that capability for it to be compatible with a constitutional democracy.

1. Legal basis: Facial recognition deployment by law enforcement must be authorised by specific legislation, not just general police powers. This is the Puttaswamy legality requirement.
2. Proportionality assessment: Each deployment should be accompanied by a documented assessment of whether the surveillance is proportionate to the specific security objective.
3. Accuracy standards: Minimum accuracy requirements before deployment, with disaggregated testing across demographic groups.
4. Audit and oversight: An independent body with access to system logs and the ability to review false positive rates and outcomes.
5. Redress mechanism: A clear, accessible process for individuals who believe they have been incorrectly identified or adversely affected.
6. Data retention limits: Images and faceprints collected for crowd management at a public event should not be retained indefinitely or repurposed for other investigations.

Mains framing: 'Artificial intelligence can make the State more capable, but not necessarily more accountable.' Discuss in the context of surveillance technologies. A strong answer covers: Puttaswamy, DPDP Act, algorithmic bias, the chilling effect on Article 19 rights, and a proposed governance framework.

UPSC Mapping

Prelims MCQ Practice

7. The Puttaswamy judgment was delivered by a bench of how many judges? (a) Five (b) Seven (c) Nine (d) Eleven | Answer: (c)
8. The Digital Personal Data Protection Act was passed in: (a) 2021 (b) 2022 (c) 2023 (d) 2024 | Answer: (c)
9. The 'chilling effect' on fundamental rights refers to: (a) Physical harm caused by state action (b) Self-censorship induced by fear of surveillance or punishment (c) Economic impact of rights restrictions (d) Cooling of relations between institutions | Answer: (b)
10. One-to-many facial recognition identification is most controversial because: (a) It is less accurate (b) It operates without explicit consent in public spaces (c) It requires expensive equipment (d) It can only work indoors | Answer: (b)
11. The DPDP Act 2023 exempts state processing primarily on grounds of: (a) Public health (b) National security, public order, sovereignty (c) Economic development (d) Judicial proceedings | Answer: (b)

Mains GS-II and GS-III Question

'Artificial intelligence can make the State more capable, but not necessarily more accountable.' Discuss with reference to the deployment of facial recognition technology by Indian law enforcement, and suggest a governance framework that balances security objectives with constitutional rights.

Preparing for UPSC from Delhi? Aspiro Living in Karol Bagh is built for serious aspirants - study zones, five daily meals, biometric security, and a community that gets it. Visit aspiroliving.com to book a tour.