Why in News?
India’s privacy challenge has moved beyond conventional State surveillance towards a diffuse data ecosystem involving government agencies, private technology firms, social-media platforms and AI systems.
K.S. Puttaswamy v. Union of India (2017) recognised privacy as a fundamental right and established safeguards based on legality, legitimate purpose, necessity and proportionality.
Recent cases show that privacy now concerns not only watching citizens, but also identifying, profiling, exposing, manipulating and potentially excluding them.
Expanding Dimensions of Privacy Threats
Facial recognition: During the 2026 Jantar Mantar protests, Delhi Police informed the Supreme Court that its facial-recognition system identified 2,873 persons with previous criminal records => Police maintained that it was intended to identify known criminals rather than indiscriminately profile protesters.
Algorithmic error: An investigation reported that at least 25 persons among those flagged were actually in jail, highlighting why automated facial-recognition matches require independent verification.
Doxxing: In Narendra Kumar Goswami v. Union of India (2026), the Supreme Court considered concerns involving doxxing, threats, unauthorised disclosure of children's details and harmful deepfakes and directed authorities to consider remedial measures.
Deepfakes: Recent judicial proceedings concerning AI-generated content demonstrate that synthetic media can threaten privacy, dignity, reputation and personality rights.
Privacy, Identity and Democratic Participation
Electoral verification: Bihar’s Special Intensive Revision began with approximately 7.89 crore electors and resulted in a final roll of around 7.42 crore, demonstrating the enormous scale of identity verification.
Risk of exclusion: Errors in documentation or verification can affect electoral registration, making privacy concerns closely connected with due process and democratic participation.
Data exposure: Excessive accessibility of electoral information can facilitate profiling and data mining, requiring a balance between electoral transparency and voter privacy.
Historical continuity: Population identification predates digital technology.
- William Herschel used handprints in India in 1858, while fingerprint classification was subsequently developed in Bengal.
- Aadhaar, biometric databases and facial recognition represent technologically advanced forms of this identification function.
Legal and Institutional Gaps
Constitutional protection: Puttaswamy requires restrictions on privacy to satisfy legality, legitimate state purpose and proportionality.
DPDP Act, 2023: The Act establishes statutory protection for digital personal data but permits specified exemptions for State instrumentalities, making independent oversight particularly important.
Pegasus: The Supreme Court-appointed technical committee found malware in some examined devices but could not establish that it was Pegasus, demonstrating difficulties in attributing sophisticated spyware.
Public-private nexus: When police surveillance involves private companies for AI analytics, biometric processing or data storage, responsibility can become fragmented among the State, contractors and technology providers.
Regulatory gap: India requires clearer, dedicated safeguards governing police use of facial recognition and AI-enabled surveillance, particularly concerning authorisation, retention, accuracy and citizen remedies.
Way Forward
Comprehensive safeguards: Clearly define lawful purposes, authorisation, retention, deletion and access requirements for surveillance data.
Independent oversight: Subject biometric and AI surveillance to judicial, parliamentary and technical audits.
Human verification: Automated facial-recognition results should not alone determine adverse action + reported errors during the Jantar Mantar exercise reinforce the need for corroboration.
Privacy-by-design: Mandate data minimisation, purpose limitation, cybersecurity and privacy-impact assessments in government technology procurement.
Rapid digital remedies: Establish time-bound mechanisms against doxxing, deepfakes and threats while protecting legitimate expression.
Electoral safeguards: Provide notice, correction opportunities and accessible appeals during voter verification.
Vendor accountability: Contracts should regulate secondary use, data sharing, retention and security by private and foreign technology providers.
