A Digital Panopticon: The DPDP Act, Facial Recognition, and the Chilling of Dissent in India

This Blog is Written by Shuchi Kumari, 2nd Year, BA LLB, NLUT, Tripura.

Blog 24 | Edition VII

Introduction

In July 2026, student protesters at Delhi's Jantar Mantar found themselves under the watchful gaze of an invisible observer. The Delhi Police deployed the 'Ikshana' AI-powered surveillance vehicle equipped with eight 360-degree cameras and facial recognition software alongside AI-enabled smart glasses, drones, and a mobile command-and-control centre. What made this deployment remarkable was not the technology itself, but the complete absence of any statutory framework authorizing such surveillance of peaceful citizens exercising their constitutional right to assembly. This incident crystallizes a profound constitutional crisis in India's digital age. The Supreme Court's unanimous 2017 ruling in Justice K.S. Puttaswamy v. Union of India established privacy as a fundamental right under Articles 14, 19, and 21. Yet the Digital Personal Data Protection Act, 2023, meant to operationalize this guarantee grants sweeping exemptions to state agencies, enabling the very unaccountable surveillance the Court sought to prevent. This blog critically examines this tension. Using the Jantar Mantar incident as a lens, it analyses the legal vacuum governing facial recognition technology, scrutinizes the DPDP Act's government exemptions, evaluates the surveillance against the Puttaswamy proportionality test, and proposes reforms to reconcile security imperatives with fundamental rights.

Conceptual and Jurisprudential Framework

India's constitutional jurisprudence on privacy remained ambiguous for decades. Early judgments, M.P. Sharma v. Satish Chandra (1954) and Kharak Singh v. State of Uttar Pradesh (1962) denied the existence of a fundamental right to privacy. This uncertainty persisted until the Puttaswamy judgment (2017), where a nine-judge Constitution Bench unanimously overruled earlier decisions and held that privacy is a fundamental right. Justice Chandrachud articulated that privacy encompasses three dimensions: bodily privacy (protection of physical integrity), decisional privacy (autonomy in personal choices), and informational privacy (control over personal data). The judgment located privacy in the "trinity" of fundamental rights articles 14, 19, and 21 emphasizing that liberty and dignity cannot be preserved without privacy.

The Court recognized that privacy is not absolute and may be restricted. However, any State action infringing privacy must satisfy a four-pronged test:

1. Legality: Based on a valid law, not executive discretion,
2. Legitimate State Aim: Serving a legitimate purpose like national security or public order,
3. Proportionality: Means employed must be proportionate, with minimal impairment of rights,
4. Procedural Safeguards: The law must contain adequate safeguards against misuse.

Justice Kaul emphasized that procedural safeguards are "an essential ingredient of the test of proportionality." This framework created a rigorous constitutional standard for evaluating State surveillance actions.

Legal Issues

The Digital Personal Data Protection Act, 2023, received Presidential assent on 11 August 2023. However, the Act's architecture raises profound constitutional concerns.

Section 17 of the DPDP Act permits the government to process personal data without consent for purposes including sovereignty, security, public order, and investigation of offences. These exemptions create a parallel regime for state agencies, exempting them from the Act's core protections consent requirements, purpose limitation, and breach notification obligations.

Critics have identified several deficiencies:

• No Judicial Pre-Authorisation: Unlike the EU's GDPR, the DPDP Act allows executive authorities to access personal data without prior judicial review,
• Vague Language: Terms like "public order" lack precise definition, enabling broad interpretation,
• No Transparency Obligations: Data fiduciaries need not publish statistics on government data requests,
• Minimal Oversight: The Data Protection Board's jurisdiction over state surveillance remains unclear.

Scholars characterize this as enabling "dragnet surveillance", wholesale data collection without individualized suspicion. India lacks any comprehensive statutory framework regulating the deployment of facial recognition technology for law enforcement. The Delhi Police justified their surveillance under existing police powers to "identify known criminals." However, neither the Delhi Police Standing Orders nor the Criminal Procedure (Identification) Act, 2022, authorizes indiscriminate biometric surveillance of civilians at peaceful assemblies. The 2022 Act only applies to convicted persons, those arrested, or those detained categories wholly distinct from peaceful protesters.

The Indian Position: The Jantar Mantar Case Study

On 23-24 July 2026, the Delhi Police deployed a sophisticated surveillance apparatus at the Jantar Mantar protest:

1. Ikshana Surveillance Vehicle: A mobile van with eight 360-degree cameras, face detection and recognition, automatic number plate recognition, and real-time video analytics, operated in partnership with CP Plus.
2. Mobile Command and Control Vehicle: Streaming live CCTV footage for real-time monitoring.
3. AI-Enabled Smart Glasses: Smart spectacles with facial recognition and thermal imaging developed by AjnaLens.

The footage was processed through facial recognition software and compared against police criminal databases. The surveillance had an immediate impact on protest participation. Students covered their faces fearing repercussions for future employment, particularly government jobs requiring background checks. One student preparing for the UPSC exam expressed concern about being "profiled in police databases." This "chilling effect" demonstrates how surveillance, even without prosecution, can deter citizens from exercising fundamental rights.

In August 2026, Rajya Sabha MP AA Rahim filed a Supreme Court petition challenging the deployment, arguing:

• Delhi Police conducted biometric surveillance in a "complete legal vacuum,"
• Neither police standing orders nor the Criminal Procedure (Identification) Act, 2022, authorize such surveillance,
• The surveillance fails the Puttaswamy tests of legality and proportionality.

Senior advocate Menaka Guruswamy raised concerns about private entities, Aditya Infotech Ltd. and Dimension NXG Pvt. Ltd, hosting surveillance data "in violation of the DPDP Act." A bench of Chief Justice Surya Kant agreed to hear the petition.

Critical Analysis

Evaluating the Jantar Mantar surveillance against the Puttaswamy framework reveals constitutional infirmities at every step:

• Legality: The surveillance lacks statutory backing, resting on executive orders and police manuals. As Bar and Bench observes, "executive orders are not legislation and every official document is not a law. The Puttaswamy requirement of "law" demands parliamentary legislation, not executive discretion.
• Legitimate State Aim: While identifying criminals is legitimate, the surveillance was indiscriminate scanning all protesters, journalists, and bystanders regardless of suspicion. A senior officer admitted footage would be retained indefinitely because an investigation "could merit either today or three months from now.
• Proportionality: Deploying AI-powered facial recognition against peaceful protesters is disproportionate. Thousands of innocent citizens were subjected to biometric data collection without individualized suspicion.
• Procedural Safeguards: The absence of any privacy impact assessment, transparency protocols, or judicial authorisation renders the surveillance procedurally deficient.

The DPDP Act's exemptions undermine the Puttaswamy framework. Critics argue the government can collect citizens' data "without any check or balances. The Act's exemption provisions have been characterized as "the least constrained provision in the DPDP Act itself." As one analysis warns, "the DPDP Act risks becoming a legitimizing facade for a panopticon state." The EU's Artificial Intelligence Act (2025) classifies real-time biometric identification in public spaces as an "unacceptable risk" and prohibits it except for three narrow exceptions requiring prior judicial authorisation. As Bar and Bench observed, "If Europe believes that watching its own citizens in real time poses a threat to the free society, then India should not become the place where these rights are ignored based on discretion."

Facial recognition systems are not neutral. U.S. NIST testing found "differences in error rates across demographic groups." In India, marginalized communities, Dalits, Adivasis, Muslims already disproportionately impacted by criminal justice systems, risk amplified structural inequality. Samyukta Ramaswamy warns that "AI-generated outputs derived from opaque systems are increasingly introduced as evidence without clear standards for reliability, admissibility, or constitutional compliance."

Way Forward

1. Enact a Surveillance-Specific Law: India requires a comprehensive statutory framework regulating facial recognition and biometric surveillance for law enforcement, satisfying the Puttaswamy test, legal authority, precise legitimate aims, proportionality safeguards, and procedural protections.
2. Amend the DPDP Act: Government exemption provisions must be narrowed, with precise definitions of "public order" and "security of the State." Independent oversight mechanisms should be established for government data processing.

The Supreme Court's Pending Adjudication is an Opportunity to:

1. Establish clear guidelines on legality, proportionality, and procedural safeguards for surveillance technology deployment,
2. Direct deletion of biometric data collected from peaceful protesters without legal basis.

Institutional Safeguards

1. Data Protection Board Empowerment: Clear jurisdiction to investigate state surveillance practices and enforce compliance.
2. Independent Oversight Committee: Multi-stakeholder mechanism including judges, privacy experts, civil society, and technologists to review surveillance deployments.

Conclusion

India stands at a crossroads. The Puttaswamy judgment affirmed privacy as fundamental to dignity, liberty, and democracy. Yet the DPDP Act's broad exemptions and the Jantar Mantar surveillance deployment demonstrate how state power can intrude into fundamental rights without adequate safeguards. As one analysis warns, "India is increasingly becoming a surveillance state" where executive discretion substitutes for legislative authorization. Reversing this trajectory requires legislative reform, judicial oversight, and institutional safeguards. Democracy demands citizens can protest without fear of permanent biometric profiling. Dignity requires rights protected against algorithmic overreach. Liberty depends on ensuring the State's digital panopticon does not become the new normal. The Court's forthcoming ruling will be a defining moment for India's constitutional democracy.

(Write to the author at kumarishuchi054@gmail.com.)