Facial recognition expands across India despite concerns over privacy, surveillance and legal safeguards.
Technology aids policing and services, but lacks dedicated regulations and accountability mechanisms.
European restrictions highlight risks of misuse, discrimination and mass biometric surveillance.
Every day, millions of people pass through India's railway stations, airports, and religious sites under the watch of facial recognition cameras, often without their knowledge. These systems scan crowds in real time, matching faces against police and government databases as part of a rapidly expanding surveillance infrastructure across the country.
A joint investigation by The Reporters' Collective and Investigate Europe has found that facial recognition technology supplied by a Spanish company is being used by several Indian law enforcement agencies and public authorities. The deployment comes even as similar real-time surveillance systems face strict restrictions in the European Union.
The findings have renewed questions over privacy, mass surveillance, accuracy, accountability, and the absence of a dedicated legal framework governing facial recognition technology in India.
Facial recognition technology (FRT) is a biometric system that identifies or verifies a person's identity by analysing facial features from a photograph, video or live camera feed. It compares the captured image with a database of stored photographs to determine a possible match.
The system measures distinctive facial features, including the distance between the eyes, the shape of the nose, jawline and other facial landmarks. These measurements are converted into a digital template and matched against images stored in a database.
The use of facial recognition technology has expanded rapidly across policing, transport and public surveillance in India, despite the absence of a dedicated law regulating its use.
One of the largest proposed initiatives is the National Crime Records Bureau's Automated Facial Recognition System, which aims to enable law enforcement agencies to match facial images against multiple databases, including CCTV footage, passport records, prison records and missing persons' databases.
The technology has also been adopted at airports through the Ministry of Civil Aviation's DigiYatra programme. First introduced at Hyderabad airport in 2018, it uses facial recognition to verify passengers at various checkpoints, reducing the need for repeated boarding pass and identity verification.
Facial recognition is also being deployed under Safe City projects and the Smart Cities Mission. Several cities have integrated facial analytics with CCTV networks for crowd management, traffic monitoring and identifying repeat offenders.
Several European countries have imposed strict limits on the use of facial recognition technology, citing concerns over privacy, civil liberties, discrimination and mass surveillance. The European Union (EU) has also introduced legal safeguards governing the use of biometric technologies.
European laws treat facial data as sensitive personal information. Policymakers argue that unrestricted facial recognition in public spaces could allow continuous monitoring of individuals, raising concerns about privacy and fundamental rights.
Concerns have also been raised over the accuracy of facial recognition systems. Studies have found that some systems are more likely to misidentify women and people from certain ethnic groups, increasing the risk of discrimination and wrongful identification.
Under the European Union's Artificial Intelligence Act, the use of real-time facial recognition by law enforcement in public places is largely prohibited, except in limited circumstances such as locating missing persons, preventing an imminent terrorist threat or investigating certain serious crimes. Even then, its use requires judicial authorisation and other legal safeguards.
The EU also prohibits the creation of facial recognition databases through the indiscriminate collection of images from the internet or CCTV footage. In addition, the General Data Protection Regulation (GDPR) classifies biometric data as sensitive personal data and imposes strict conditions on its collection and processing.
Facial recognition technology has prompted concerns over privacy, surveillance, accuracy and accountability, particularly as artificial intelligence has made it possible to analyse large volumes of biometric data in real time.
Privacy advocates argue that people are often scanned without their knowledge or consent, while there is limited transparency about how facial data is collected, stored, shared or retained. Unlike passwords, facial data cannot be changed if compromised, making data breaches a long-term risk.
Studies have also found that some facial recognition systems are more likely to misidentify women and people from certain ethnic groups, increasing the risk of wrongful identification, particularly in policing.
Civil liberties groups have also warned that widespread use of facial recognition in public spaces could enable mass surveillance, allowing authorities to monitor individuals, protests and public gatherings.
Concerns have further been raised over the commercial collection of facial images without consent and the absence of uniform global standards, independent oversight and accountability mechanisms governing the technology.
India does not have a dedicated law regulating facial recognition technology. While the Digital Personal Data Protection Act, 2023, governs the processing of digital personal data, it does not specifically regulate the use of facial recognition.
The use of facial recognition by government agencies and private organisations has raised concerns over the collection and processing of biometric data, particularly where facial images are captured without explicit consent.
Courts have recognised privacy as a fundamental right and have held that any intrusion must meet legal and procedural standards. .
