Policing by Face: Facial Recognition Technology and the Constitutional Test of Proportionality

Introduction:
When a Face Becomes Evidence

Facial Recognition Technology (FRT) has
quietly become part of Indian policing. From manual station diaries and
physical verification, police forces have moved to centralised databases, CCTV
networks and algorithmic identification[1]. The official
justification is straightforward — technology will help identify criminals
faster, prevent disorder and make investigation more efficient.

That
justification is most severely tested not in a police station, but at a
peaceful protest.

Consider a
simple illustration. A final-year student attends a demonstration at Jantar
Mantar against an alleged leak in a competitive examination. She carries no
prohibited item, does not engage in violence, raises a slogan and returns to
her hostel in the evening. On that day, a camera mounted at the protest site
may have captured her face, converted it into a biometric template, compared it
with a police database of known persons, and logged her presence at a political
gathering. She may never be summoned by the police. Yet information about her —
that she was present at a particular protest on a particular date, expressing a
particular viewpoint — now exists in a system she cannot access, cannot verify,
and cannot seek deletion of.

Does the
Constitution permit this? Does the visibility of a face in a public place mean
the State can biometrically identify that person, retain that information, and
link it to political activity?

This question
became concrete in July 2026. In proceedings before the Supreme Court, Delhi
Police reportedly stated that its facial recognition system had identified
2,873 individuals with criminal records at Jantar Mantar during protests[2]. The statement was
intended to demonstrate effectiveness. Subsequent journalistic verification,
however, complicated that claim. Reporters found that at least 25 persons shown
on the police list as facing serious allegations were already lodged in jail on
the relevant dates. The significance of that reporting is not that every match
was false — it is more foundational. A technological match is not evidence of
presence, and presence at a protest is not evidence of criminality.

It is in this
context that this article examines police use of FRT at protests through
Articles 14, 19 and 21 of the Constitution[3], the doctrine of
proportionality, and the existing statutory framework under the Criminal
Procedure (Identification) Act, 2022 and the Digital Personal Data Protection
Act, 2023. Drawing on recent litigation before the Delhi High Court in a
petition associated with activist Aishe Ghosh and before the Supreme Court in a
petition by CPI(M) MP A.A. Rahim, both concerning surveillance at Jantar Mantar
in 2026, and on comparative jurisprudence from the United Kingdom in R
(Bridges) v. South Wales Police[4] and from the European
Court of Human Rights in Glukhin v. Russia[5], it argues that the core
constitutional problem is not technology itself.

The problem is the
absence of clear law, independent oversight and enforceable safeguards. This
article therefore does not argue for a blanket ban on facial recognition. The
police must retain power to investigate offences and prevent violence. The
argument is narrower and more constitutional — validity must depend on
demonstrable legal authority, individualised necessity and enforceable
safeguards, not on the mere availability of technology and a general invocation
of public order.

The Legal Controversy: From Recording to
Identification

From Recording to Identification — Why FRT is Different.
It is important not to conflate two things — recording a public event and
subjecting that recording to biometric identification.

A video recording preserves what happened. It can
show whether barricades were broken, whether violence occurred, and by whom.
Courts are familiar with appreciating such evidence.

Facial recognition introduces a second operation. The
system extracts facial geometry, creates a template, and compares it against a
reference database. Depending on system design, that database may contain
images of wanted persons, persons with criminal records, or other datasets. The
system then produces possible matches with a similarity score.

That second operation changes the nature of
surveillance. It moves from observing conduct to identifying persons. It
enables the State not only to know what happened, but to know who was there.
Where the setting is a political protest, that shift has constitutional
consequences.

In 2026, this shift became the subject of direct
litigation. A petition associated with activist Aishe Ghosh was filed before
the Delhi High Court challenging surveillance at Jantar Mantar, including use
of facial recognition. Around the same time, a petition filed by CPI(M) MP A.A.
Rahim raising similar questions was taken up by the Supreme Court. Both
petitions raise pending questions concerning statutory authority under the
Criminal Procedure (Identification) Act, 2022, applicability of the Digital
Personal Data Protection Act, 2023, and constitutional compliance with Articles
14, 19 and 21. These proceedings have not yet resulted in final adjudication
that every use is unlawful. But they make clear that legality cannot be
presumed.

A legitimate aim — maintaining public order or
tracing wanted persons — does not validate every method. Searching video
footage for a named suspect in connection with a specific FIR is one thing.
Running facial recognition on an entire crowd and generating a list of 2,873
persons for further police action is quite another. The second requires a much
higher and more specific justification.

The constitutional inquiry, therefore, must look at
the deployment itself — its stated purpose, the watchlist used, the matching
threshold, whether human verification was done, how long data is retained, and
what consequences follow for persons identified.

III. Constitutional Foundations: Privacy, Liberty
and Equality

Article 21 and
informational privacy

Constitutional Foundations A. Article 21 and
Informational Privacy In K.S. Puttaswamy v. Union of India (2017), a nine-judge
Constitution Bench recognised privacy as a fundamental right under Article 21[6]. The
judgment made clear that privacy is not only about secrecy in the home, but
also about informational autonomy and decisional autonomy. It includes the
right to control information about oneself[7].

A face is visible in public, but that does not mean
a person has waived every privacy interest in it. A person attending a protest
may expect to be seen by others present, but may not reasonably expect that her
face will be converted into a biometric identifier, matched against a criminal
database, and retained for future use. The harm in such cases lies not only in
initial capture, but in what the State can infer and do afterwards.

This does not mean every use of facial recognition
is unconstitutional. Where police have credible information about a specific
person wanted for a serious offence and have lawful authority to identify him,
targeted use may be permissible subject to safeguards. What Article 21 does not
permit is treating public presence as an automatic licence for biometric
identification of all attendees.

Articles 19(1)(a) and
19(1)(b): Expression and assembly

Political protest is a core democratic activity. Citizens express
disagreement, criticise policy and demand accountability through assembly.
Articles 19(1)(a) and 19(1)(b) protect speech and peaceful assembly, subject to
reasonable restrictions under Articles 19(2) and 19(3)[8].

Surveillance at protests does not need to result in arrest to affect these
freedoms. If a student, journalist or worker believes that attending a
demonstration will lead to identification, profiling, or future police
scrutiny, she may choose not to attend. That is the chilling effect. It
operates without force, through anticipated consequences.

In Anuradha Bhasin v. Union of India (2020)[9], the
Supreme Court, while dealing with internet shutdowns in Jammu and Kashmir,
emphasised that restrictions affecting expression must be supported by law and
subject to proportionality analysis. While the case did not concern facial
recognition, its reasoning is relevant — executive measures that burden
protected freedoms must be justified within the constitutional framework, not
merely asserted in the name of public order[10].

Article 14 and
non-arbitrariness

Article 14 provides a separate ground of scrutiny.
A surveillance power becomes arbitrary when its exercise is governed by
undefined purposes, opaque criteria and unguided discretion[11]. Who
decides when facial recognition will be deployed at a protest? Who decides
which databases will be used as reference? What is the threshold for a match?
Who authorises retention?

Reliability is also an Article 14 issue. Research
globally shows that error rates of facial recognition systems can vary across
demographic groups, including age and gender. A similarity score is not a
finding of identity. Without independent testing, documented error rates and
mandatory human verification, a system risks producing arbitrary consequences —
some persons may be wrongly flagged and subjected to police action.

The State cannot answer a fundamental rights
challenge by invoking commercial confidentiality of the algorithm. Some
disclosure regarding testing, accuracy, safeguards and audit is essential for
effective judicial review, even if specific operational details are
legitimately protected.

The proportionality test

The proportionality doctrine, considered in Modern Dental College and
Research Centre v. State of Madhya Pradesh[12],
and the privacy jurisprudence, requires more than an assertion that
surveillance serves public safety.

Four questions are particularly important:

1. Legitimate
   aim: Is the deployment directed towards a
   constitutionally permissible objective, such as investigating a serious
   offence?
2. Rational
   connection: Is the chosen system reasonably capable of
   advancing that objective?
3. Necessity: Could
   the objective be achieved through a less intrusive method with comparable
   effectiveness?
4. Balancing: Does
   the expected benefit justify the interference with privacy, expression and
   assembly?

The third question is decisive in many protest-related situations. If the
objective is to locate a named suspect, targeted examination of relevant
footage may suffice. Scanning every attendee requires an additional
justification.

Proportionality must also operate throughout the surveillance lifecycle. A
deployment that is justified initially may become disproportionate through
indefinite retention, unrelated database searches or unrestricted sharing.

Legality: Do Existing
Statutes Authorise Protest Surveillance?

India currently lacks a dedicated statute governing police use of facial
recognition at protests. Two laws are frequently cited, but neither provides
the comprehensive authorisation that constitutional law demands.

The Criminal Procedure (Identification) Act, 2022 permits taking and
storing of specified measurements from defined categories of persons. Its scope
must be read carefully — the categories of persons covered, the types of
measurements authorised, and the procedure prescribed. The Act cannot be read
as a general power to subject every person attending a lawful protest to
biometric identification. The State must point to the specific provision that
authorises the particular collection and processing in question[13].

The Digital Personal Data Protection Act, 2023 adds another layer. Section
17[14]
exempts certain processing connected with prevention, detection, investigation
or prosecution of offences from some obligations under the Act. The precise
applicability of that exemption depends on notification, purpose, and
compliance with other requirements of the Act. But an exemption from data
protection obligations is not the same as a positive grant of power to deploy
facial recognition. Even where an exemption applies, constitutional
requirements of legality, necessity and proportionality continue to operate.

What is needed, therefore, is a specific legal framework for police use of
FRT. Such a framework should define permissible purposes, seriousness of
offences that may justify deployment, authorisation process, restrictions on
watchlists, retention limits, and rights of affected individuals. Without such
a law, deployment remains vulnerable to challenge on grounds of legality and
arbitrariness..

Documented Case Studies
and Comparative Jurisprudence

The Jantar Mantar controversy illustrates why
procedure matters more than claims of technological success. Police reported
2,873 identifications. Journalistic verification raised doubts about some
entries. The legal lesson is not that every match was false, but that four
different claims must be distinguished — the system generated a match, the
person was correctly identified, the person was present at the protest, and the
person committed wrongdoing at the protest. Each requires independent proof. A
system match by itself proves none of the others.Comparative jurisprudence
offers useful cautionary guidance, not as binding precedent, but as persuasive
material on safeguards.

In R (Bridges) v. Chief Constable of South Wales
Police EWCA Civ 1058, the Court of Appeal of England and Wales examined live
automated facial recognition deployed by police. The Court found aspects of
deployment unlawful, including because the framework left too much discretion
to individual officers regarding where the technology could be used and who
could be placed on a watchlist. It also found deficiencies in the equality
impact assessment and the data protection impact assessment. The message for
India is clear—even a legitimate policing purpose fails if clear rules do not
constrain operational discretion.[2020]

In Glukhin v. Russia (ECtHR, 2023), the European
Court of Human Rights considered facial recognition used to identify and detain
a peaceful demonstrator in Moscow. The Court found violations of Articles 8
(private life) and 10 (freedom of expression) of the European Convention on
Human Rights. It emphasised that facial recognition is highly intrusive and may
have a chilling effect on participation in lawful demonstrations. The Court did
not accept that technical capability alone justified use — necessity in a
democratic society had to be demonstrated.

India is not bound by these decisions. But their
reasoning on discretion, necessity, oversight and chilling effect is directly
relevant to adjudication under Articles 14, 19 and 21.

Judicial Developments: A
Timeline

The significance of this timeline lies in the convergence of established
constitutional principles and newer technological challenges. Indian courts
need not invent a separate fundamental right against every new surveillance
tool. They must determine how existing rights constrain technologies that
intensify the State’s capacity to identify, classify and monitor citizens.

Compensation,
Accountability and Legal Remedies

A constitutional framework is incomplete if it identifies unlawful
surveillance, but leaves affected individuals without an effective remedy.

A. Judicial remedies

An affected individual may approach the
jurisdictional High Court under Article 226 or the Supreme Court under Article
32, depending on the circumstances and the nature of the rights violation.

Appropriate relief may include a declaration of
illegality, an injunction against unlawful processing, directions for
disclosure of relevant policies, preservation of evidence and deletion of
unlawfully retained data[15]
where justified.

Courts may also require the State to explain the
legal authority for deployment, identify the databases involved and disclose
applicable retention policies. Where disclosure creates legitimate security
concerns, carefully designed confidential review may protect sensitive
operational information without excluding judicial scrutiny altogether.

Compensation under public
law may be appropriate where unlawful action results in demonstrable violation
of fundamental rights. Not every instance of image capture will justify
damages. Courts will need to consider the nature of the interference, whether
there was wrongful identification, whether data was retained or shared
unlawfully, whether adverse action such as detention followed, and what injury
is established. Where a wrong biometric match leads to wrongful arrest or
detention, the compensation case is materially stronger.

Accountability must go
beyond individual cases. Most persons subjected to facial recognition will
never know that their biometric data was processed, making challenge
impossible. Effective accountability therefore requires systemic safeguards —
public policies governing use, prior authorisation for protest deployments,
maintenance of deployment registers, audit trails, independent audits,
complaint mechanisms and disciplinary consequences for misuse. Contracts with
private vendors must specify data ownership, access controls, security
requirements, deletion obligations and penalties for non-compliance.
Outsourcing technical operations does not outsource constitutional
responsibility.

Rights-Based Regulatory
Framework

A workable regulatory model should distinguish targeted criminal
investigation from generalised surveillance of political participation.

These safeguards should not operate as procedural formalities. They should
determine whether a deployment is permitted in the first place.

Real-time facial recognition at a peaceful protest should ordinarily be
prohibited unless the State demonstrates a compelling, specific necessity under
clear law and subject to independent authorisation. Where an urgent threat
makes prior approval impracticable, a narrowly defined emergency exception
should require prompt subsequent review.

The burden of justification should increase with the scale of surveillance,
the sensitivity of the setting and the consequences of identification.

Conclusion: Constitutional Limits in an Age of
Automated Policing

Facial recognition may help investigate crime, but
technological possibility cannot replace constitutional justification. The fact
that the State can identify every face in a crowd does not mean it should, nor
does it answer whether that information may be retained and linked to political
activity.

Articles 14, 19 and 21 require the State to show
lawful authority, necessity, proportionality and adequate safeguards against
arbitrariness. Comparative experience from the UK and Europe reinforces that
clear rules, independent oversight and effective remedies are indispensable.
Recent litigation concerning Jantar Mantar shows why these questions are urgent
in India.

India does not need to choose between public safety
and liberty. Targeted, accountable use of technology may serve legitimate
public interests. Indiscriminate biometric identification of citizens
exercising democratic freedoms, however, places the burden of surveillance on
participation itself.

A constitutional democracy must preserve a
distinction that is easy to lose in the language of technology — investigating
unlawful conduct is legitimate, treating participation in public life as a
ground for suspicion is not. The ultimate test is not whether the State can
recognise every face, but whether it can justify, in law and fact, its decision
to do so.