Application of Facial Recognition Technology: Utility or Constitutional Violation

This Blog is Written by Arihant Chatterjee, BBA LLB, Sister Nivedita University, Kolkata.

Introduction

A system designed to automatically identify or verify a person through his/her facial features is called facial recognition technology (FRT). It is based on the principles of the use of computer vision and AI to map and analyse a person's facial features to produce a digitized version of that person for comparison. While biometric technologies like fingerprints are common at this time, FRT is gaining widespread acceptance because the technology can operate without the person's knowledge. In facial recognition technology, a camera takes a picture of or records a video of a person's face. The computer measures distances between facial features (i.e., the distance between eyes, shape of the nose, curve of the lips, etc.) and creates a unique facial print. This facial print can then be compared with other facial prints stored in the database of the facial recognition technology system for matching or verifying an identity.  The use of FRT in many different areas (e.g., mobile phone unlocking and security screening at airports) has led to much debate regarding the actual privacy and security risks associated with FRT because FRT has the ability to track individuals without their knowledge. The legal framework for biometric technologies and facial recognition in India is still developing. The Information Technology (IT) Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 provide limited data protection guidance, generally not addressing the unique challenges that biometric technologies present. The introduction of Aadhaar, India's biometric-based identification system, has been one of the primary drivers of biometric technology adoption in India. The Aadhaar Act, 2016 provides guidance on the use of Aadhaar data, data protection, and privacy, but as Aadhaar is used for a large number of purposes, after being successfully implemented, there are growing concerns surrounding Aadhaar privacy and data security.3 The Supreme Court of India, in 2017, declared that privacy is a constitutional right, and upheld the validity of Aadhaar but only with certain limitations placed upon its use for defined purposes and only with appropriate safeguards for the protection of personal information.

Current Scenario

One of the major concerns regarding biometrics and facial recognition technology in India is the question of privacy and consent. Biometric information is extremely sensitive, and the use of such information without the consent of the individual can violate the privacy rights of the person. In the historic case of Justice K.S. Puttaswamy (Retd.) vs. Union of India (2017), the Supreme Court of India upheld the right to privacy as a fundamental right under the Indian Constitution. The judgment highlighted the need for proper regulation to ensure that the privacy rights of individuals are not violated in the digital age, including the use of biometric technology. There is a lack of proper regulation regarding the use of biometric and facial recognition technology in India. There is still no effective regulation surrounding the protection of data. In light of this, the Digital Personal Data Protection Act, 2023 was enacted as a step forward or a beginning point; however, it does not provide sufficient regulatory detail related to the creation and use of both biometric data and facial recognition data. Currently, the National Crime Records Bureau’s Automated Facial Recognition System (AFRS) has plans to build a national base of photographs to identify criminals, missing persons and unidentified bodies; however, civil rights advocates believe that the AFRS lacks adequate legislative authority, operational transparency and sufficient protective measures. Additionally, although the Aadhaar program is primarily designed to use fingerprints and iris scans, it has tested facial recognition as an authentication method. Furthermore, both the expansion of Aadhaar into a number of social welfare programs, and the associated data collection and retention required by these programs raises questions about the government’s (both state and federal) surveillance capability, the potential for individuals to be excluded from seeing services due to multiple databases containing biometric information (e.g., managing databases by matching names with photographs derived from multiple sources), and the potential for misuse of data.

Path Ahead

To ensure the Facial Recognition Technology (FRT) used in India provides proper equal protection for both state security and constitutional rights, it will be necessary to adopt a comprehensive, multi-layered framework that addresses legal, procedural and technological safeguards to prevent misuse of FRT while respecting individual autonomy.

• Regulation by Legislation: A dedicated Facial Recognition Regulation Act is needed in India, which will define what constitutes permissible uses of FRT, set timelines for retention and deletion of biometric data and provide strict penalties for unlawful collection and/or misuse of FRT biometric data by any person. The Act must separate investigative uses of FRT from administrative uses of FRT and mass surveillance to limit indiscriminate use of FRT for security purposes. The Act must also require periodic audits and accountability of public and private entities who collect and/or handle FRT biometric data.
• Oversight Through Judicial Review: FRT will only be used in criminal investigations when authorized by the courts prior to use, as is currently required for searches, seizures or interception of communication. Court review will ensure the use of biometric data is authorized, justified, meets proportionality requirements, and is subject to independent scrutiny before any subsequent use can take place, thereby reducing the risk of arbitrary surveillance or police overreach through FRT. Courts will set out precise guidelines for approving, monitoring and reviewing requests for using FRT. Algorithmic Transparency and Accountability: The AI algorithms that drive FRT must be transparent, traceable, and periodically tested for accuracy, bias, and fairness. Independent entities or regulatory bodies must periodically test these systems to ensure that they do not lead to any form of discriminatory outcomes or false positives.
• Right to Explanation and Informational Autonomy: Persons must be granted the right to know when their biometric data is collected, stored, or used in any investigative or administrative manner. Citizens must be informed about how information generated through FRT is used in decision-making, and they must have access to facilities for correction or redress in case of misuse or inaccuracies. This is in keeping with the right of informational self-determination, as held in the Puttaswamy judgment, and helps to ensure public trust in digital surveillance technology.
• Public Awareness and Safeguards: In addition to legal and procedural safeguards, there must be an attempt to ensure that the public is informed about the functioning, advantages, and disadvantages of FRT. Guidelines on consent, transparency, and legal recourse must be made widely available to ensure that citizens are informed about their rights and the scope of state surveillance.
• Data Minimization and Purpose Limitation: FRT systems must be designed in such a way that they collect only the minimum amount of data necessary for a specific investigation or legal purpose. The collection of unnecessary or general facial templates, especially in public areas or social media platforms, must be prohibited. The data must not be used for other investigations or for profiling individuals beyond the scope of the legal purpose.

Conclusion

With India preparing to implement AI forensics in the Criminal Justice System it’s critical that we approach the use of Facial Recognition Technology cautiously. Other technologies such as Gait Analysis, Emotion Detection, and Voice Recognition are also being explored without sufficient regulation and have the potential to violate peoples’ basic rights. The challenge is that we have to balance the efficiency of technology with the freedom of an individual. FRT can provide faster investigation times and greater accuracy in the identification of repeat offenders; however, these processes must not violate the foundational justice principles. When used responsibly, FRT can provide valuable assistance to law enforcement in their quests to solve crimes committed against our citizens. However, FRT must be uniformly checked for accuracy and legally vetted by expert witnesses in order to ensure due process is afforded to individuals charged with crimes based on FRT-generated evidence. In India, where there is not yet a statutory law addressed specifically to the use of FRT, it’s important that India Courts be cautious in their use of this technology; ensuring that any FRT-derived evidence meets a very high level of reliability and upholds Constitutional Rights. The rights to a fair trial and the presumption of innocence are the two cornerstones of our legal system, and any FRT-derived evidence must not only be validated for relevancy, but also validated for fairness, as a lack of appropriate checks could mean that the promise of FRT becomes a danger to our civil liberties. However, with the inclusion of legislative approaches, judicial review, data minimization, algorithmic accountability, and the right to explanation, India can create a balanced approach that harnesses the benefits of FRT while ensuring the protection of individual rights. A futuristic framework will ensure that technological development does not compromise the fundamental principles of privacy, dignity, and constitutional autonomy.