The Original Article Was Published in Constitutional Law and Philosophy by Nitya Singhania, 29.08.2026
Introduction
Recently, the Supreme Court began hearing petitions on the Delhi Police’s use of an Automated Facial Recognition System (AFRS) at the Cockroach Janta Party’s Jantar Mantar protests. Such Facial Recognition Technologies (FRT) generally work by comparing the image of an unidentified person with existing databases, which contain both the individual’s image and a comprehensive set of information about them.
This approach has been defended by the State as being necessary for identifying disturbance-spreading elements at the protest. The State claims that FIRs were registered only against 2,873 persons with prior criminal antecedents and students were ‘presumed’ to not have taken part in any violent acts. However, concerns have been raised about the surveillance’s lack of legality, its effect on the right to protest and violations of data privacy.
This is the first challenge to the deployment of facial recognition at such a scale against a peaceful protest, in comparison to previous cases which dealt with either targeted surveillance or welfare-based databases. This blog will seek to establish how FRT usage at a protest fails the test of proportionality laid down in KS Puttaswamy vs Union of India (2017) (“Puttaswamy”).
Assessing FRT Surveillance Against the Proportionality Test
In Puttaswamy, it was held that any interference with the Right to Privacy must meet the three-fold criteria of (a) legality (b) legitimate state aim and (c) proportionality [para 180]. The blog will analyze how the requirements under each of these prongs have been interpreted and how the usage of FRT at the Jantar Mantar protest fails each of these.
- Valid Law
In Puttaswamy (I), the Court held that there must be a valid ‘law’, like a statute, rule or regulation, to restrict the scope of a fundamental right [para 180]. According to KS Puttaswamy vs Union of India (II) (2018) (“Puttaswamy (II)”), purely executive orders like recommendations, circulars etc., without statutory backing, would not come within that ambit [para 329].
Crucially, the ‘law’ validating surveillance at Jantar Mantar is simply a Delhi Police Standing Order. A police Standing Order is ordinarily an administrative instrument which governs the exercise of specific police functions and cannot create a power to restrict a fundamental right.
The Criminal Procedure Identification Act doesn’t apply to data collected for FIR registration, and sets in only in cases of arrests or convictions. The Digital Personal Data Protection Act, 2023 hasn’t been completely notified yet. Even otherwise, it governs data processing in general, doesn’t have any specific provisions for FRT and accords the government the power to exempt the Delhi Police from adhering to any obligations. Hence, there is no statutory authorisation for FRT usage.
- Legitimate State Aim
A Legitimate State Aim should be reasonable within the scope of Article 14 and not suffer from any manifest arbitrariness [para 180]. For checking the presence of manifest arbitrariness, the Court would ask whether the measure is ‘drastically unreasonable’ or ‘lacks an adequate determining principle.’
At the protests, the claimed ‘legitimate state aim’ was preventing violence by identifying any potential future criminals. However, the Indian state surveilled all protestors – including peaceful students – to identify said criminals. Initially, FIRs were registered indiscriminately against history-sheeters and students alike, and some FIRs against the students were withdrawn only later. It is difficult to establish the ‘determining principle’ behind considering peaceful students without any criminal antecedent as likely to cause violence, indicating that perhaps the real aim was indeed to surveil all protestors.
Alternatively, even if the State believed that only certain history-sheeters with criminal antecedents would have created disturbance, there is no rational basis for (a) considering history sheeters as a singular class, without any differentiation based on the gravity of the harm committed by them in the past and (b) merely identifying those with prior criminal antecedents, without establishing proof of violence or harm caused by them.
In contrast, other jurisdictions have narrowly interpreted state interests for the purposes of FRT usage. Article 5(1)(h) of the EU’s AI Act (2025) prohibits FRT usage in publicly accessible spaces for law enforcement purposes, subject only to exceptions like ‘imminent terrorist attacks’, ‘finding missing persons’ etc. This is similar to approaches followed in USA and Sweden, where only restricted FRT usage is permissible and that too requires external approval and oversight.
- Proportionality
Even if the state aim were to be accepted as legitimate, the limitation imposed by the State must be proportionate. This means that there must be (i) a rational nexus between the aim and the means adopted [para 182] and according to Kaul J.’s concurring opinion, (ii) no less restrictive alternatives and (iii) a balance between the restriction imposed and the advantage gained [para 71-73].
- Rational Nexus
The rational nexus test requires that the measures adopted be suitable i.e. they should be connected to the aim sought to be achieved [para 182]. In this case, the State pursued its objectives by three inter-connected means:
It deployed an extensive FRT system including AI-enabled CCTV cameras, Automatic Number Plate Recognition Technology, crowd density monitoring, hand gesture recognition, body-worn cameras, mobile surveillance vans like DP Drishti and Ikshana, mobile command-and-control vehicles and Meta and Ajna-Lens smart glasses to ensure comprehensive data collection. There was an integrated Command, Control, Communication and Computer Centre (“C4I”) to consolidate all the collected data. This would have ensured comprehensive data collection and furthered the aim of identifying any potential criminals.
Secondly, this data would have been connected to multiple other databases, thereby increasing the aggregation of data concerning a particular person. According to the MHA, over 17,000 police stations use the Crime and Criminal Tracking Network and Systems (“CCTNS”). CCTNS maintains a database of complaints, investigations and criminal cases, including photographs of suspects and convicts. Through the Interoperable Criminal Justice System, it also cross-references external databases including Vahan and Sarathi (for transport) and IVFRT (for immigration and visas). The Crime Kundli database was also used to integrate available biometric data.
Additionally, the police had the capacity for further cross-database linkages, even though the actual occurrence of the same cannot be established. They could have integrated outputs from the Crime Mapping, Analysis and Predictive System (CMAPS), which collects data every 3 minutes from ISRO’s satellites to identify ‘crime hotspots’, and is used for geographic and environmental profiling of crime. Then, while they don’t have direct access to the National Intelligence Grid (“NATGRID”), they can send it requests for information. NATGRID incorporates data from various databases like Aadhaar, National Population Register, CCTNS etc and provides an almost 360-degree profile of an individual.
Information generated through one system may be combined with information contained in other systems. This ‘aggregation’ of data from the protest site with criminal history and even with records of civil activities may lead to the creation of a comprehensive digital profile of a person. While aggregation of past criminal data would have furthered the designated aim, usage of non-criminal data from databases like Saarthi or IVFRT could have led to the profiling of peaceful protestors.
Lastly, after the data collection stage, FIR registration was significantly influenced by algorithmic decision-making. The Delhi Police has admitted that an 80% match identified by an algorithm is considered a ‘positive result’, while only those below 80% require additional ‘corroborative evidence’. Beyond this, there also remains the possibility of an inaccuracy in the 80% match. Algorithms do not possess any original decision-making capacities and operate by making predictions. They may hallucinate where the data is incomplete or reach incorrect conclusions even where it is accurate. However, the exact probability of such errors is not known. Such decision-making has no nexus with the aim as it may let the targeted ‘potential’ criminals get away, while simultaneously catching innocent protestors.
Thus, the State’s actions fail the suitability requirement.
- Necessity
According to the second requirement, necessity, the means adopted should be the least intrusive way to achieve a particular objective [para 71].
It may be claimed that any FRT system would necessarily have to analyze all faces and thus, cannot raise any concerns of mass surveillance. However, such a comprehensive scan would be carried out only to recognize a particular person, rather than to process the data of all those present. Under the EU AI Act, FRT usage has been restricted to confirming the identity of a specifically targeted individual [Article 5(1)(h)(iii)].
Conversely, when employing FRT at Jantar Mantar, the police did not seek any specific person or known risk. Instead, they identified all people present at the protest, matched all of them against the database, and then determined which people had a prior criminal history. They did not have any pre-existing list of history-sheeters they were supposed to be targeting. This reverses the direction of suspicion and puts all protestors, even those who neither engaged in violence nor have any criminal history, under surveillance for a particular period of time.
Previously, the State had tried to justify similar dragnet surveillance by requiring mandatory linkage of Aadhaar with Sim Cards for the entire population, based on the presumption that anonymous criminals, terrorists and money launderers also use mobile connections. However, in Puttaswamy (II), the prospect of catching criminals was not accepted as a valid justification for restricting the privacy of every citizen [para 442]. In his dissenting opinion, Chandrachud J., while criticizing the Aadhaar ecosystem itself, observed that an entire population cannot be viewed through the lens of criminality due to welfare leakages and thus be given a diminished expectation of privacy [para 217]. Daniel Solove also has considered ‘particularized suspicion’ necessary to keep the State’s investigative powers in check.
However, the State’s extensive surveillance apparatus’ ensured that all protestors were put under continuous surveillance to identify just a few, and then all data at the protest site relating to all persons, their associations, their activities etc was recorded, leaving nothing out. Furthermore, this data was then combined with other databases, leading the police to gain access to even non-criminal details like travel history, and assisting them in building profiles of the protestors. Finally, the FIR registration process was influenced by an 80% identification finding of an algorithm.
If the State’s aim was to prevent violence at the protests, it could have achieved that by much less intrusive means. Police could have surveilled only those who were partaking in violent activities or seemed reasonably suspicious. Even otherwise, access to databases with non-criminal information should have been restricted. Then, FIRs could have been registered based on a higher accuracy rate. Due to this, the adopted measures would not fulfil the ‘necessity’ criterion.
- Balancing
For the last requirement, there must be a balance between the importance of achieving the State’s Aim and preventing the limitation on the fundamental right [para 73].
In Kharak Singh vs State of UP, Justice Subba Rao had recognized that a ‘citizen under the shadow of surveillance cannot move, speak or associate freely’. The above analysis shows that all protestors were scanned without their consent, with the data collected potentially combined with other databases. Such comprehensive and continuous surveillance creates a significant chilling effect on the right to protest.
Additionally, large-scale data processing for surveillance in the absence of law or judicial oversight, combined with the possibility of private involvement, creates significant data privacy violations. Post this data collection, the protestors could have had an FIR registered against them on the basis of an algorithmic determination which would not have been fully accurate.
Taken together, this imposes a burden on privacy and the right to protest that is disproportionate to the State’s aim of preventing any potential future disturbances or criminal activity at the protest.
Conclusion
The AI Global Surveillance Index shows that, internationally, governments increasingly tend to use FRTs to suppress legitimate protests. The issue discussed in this piece is not to do with the usage of FRT in itself (that is a separate debate), but rather the manner in which it is used – without a law, without judicial authorisation, without any required threshold for suspicion and without any safeguards. If the argument is that a modern facial recognition system is necessary for policing and law enforcement, the argument in this piece is that, whatever the validity of that claim, it cannot be built by establishing blanket suspicion over its entire population.
