MASS BIOMETRIC SURVEILLANCE AND AI-POWERED POLICING: A CONSTITUTIONAL ANALYSIS OF CJP-LED GEN Z PROTEST AT JANTAR MANTAR

I. INTRODUCTION

What does it mean to exercise the constitutional right to protest when the very act of attending a demonstration subjects every participant to biometric surveillance? That question came into sharp focus during the 2026 NEET-UG protests at Delhi’s Jantar Mantar. Thousands of Gen Z and Gen Alpha students gathered to demand accountability for the examination paper leak, and the movement ultimately culminated in the resignation of the Union Education Minister. Yet, while public attention remained on the political outcome, another constitutional question went largely unnoticed. In a city increasingly characterised by AI-enabled policing and extensive surveillance infrastructure, peaceful protesters were subjected to facial recognition systems and other advanced biometric monitoring technologies. This article argues that the constitutional concern extends beyond surveillance itself to the overlooked intersection between the right to protest under Article 19(1)(b) and the right to informational privacy under Article 21. It examines the legal framework governing biometric surveillance, analyses its constitutional and data protection implications, and proposes safeguards to ensure that democratic dissent does not come at the cost of informational privacy.

II. LEGAL FRAMEWORK GOVERNING BIOMETRIC DATA

A. India

i. Information Technology Act, 2000 & SPDI Rules, 2011

India regulates biometric data primarily through the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The SPDI Rules classify biometric information as sensitive personal data and require prior consent, notice, purpose limitation, reasonable security practices, and disclosure of the purpose and duration of data retention. However, these safeguards offer limited protection against State-led biometric surveillance.¹

ii. Aadhaar Act, 2016

The Aadhaar Act governs the collection and use of fingerprints, iris scans, and photographs for authentication within the Aadhaar ecosystem. It restricts access to authorised entities and incorporates safeguards against unauthorised disclosure. In the Aadhaar Case, the Supreme Court upheld Aadhaar while emphasising that biometric collection must satisfy the test of proportionality.²

iii. Digital Personal Data Protection Act, 2023

India does not have a dedicated statute regulating facial recognition technology. The Digital Personal Data Protection Act, 2023 adopts a broad definition of “personal data,” capable of encompassing biometric information. It introduces a consent-based framework governing the collection and processing of personal data, while recognising rights such as correction, erasure and grievance redressal. The Act also establishes the Data Protection Board of India to oversee compliance. The Central Government notified the Digital Personal Data Protection Rules, 2025 in November 2025, bringing the Act into force on a phased implementation timeline; however, the wide exemptions available to the State, together with the staggered rollout of data-principal rights, have raised concerns regarding its effectiveness in regulating police-operated biometric surveillance systems.³

B. European Union

i. General Data Protection Regulation (GDPR)

The GDPR treats biometric data used for identification as a special category of personal data deserving enhanced protection. Processing is generally prohibited unless one of the specified legal bases applies, including explicit consent or substantial public interest. The Regulation further incorporates principles such as purpose limitation, data minimisation, storage limitation, transparency and accountability, while requiring Data Protection Impact Assessments for high-risk processing activities.⁴

ii. Artificial Intelligence Act (Proposed)

The proposed AI Act supplements the GDPR by specifically regulating artificial intelligence systems. It adopts a risk-based approach towards biometric identification technologies, with the European Parliament advocating stringent restrictions on real-time remote biometric identification in publicly accessible spaces, particularly for law enforcement purposes.⁵

C. United States

i. Illinois Biometric Information Privacy Act (BIPA)

Illinois enacted the Biometric Information Privacy Act (BIPA), one of the world’s earliest biometric-specific laws. It requires informed written consent before collecting biometric identifiers, mandates publicly available retention schedules, and grants individuals a private right of action for violations.⁶

ii. California Consumer Privacy Act (CCPA) & California Privacy Rights Act (CPRA)

The CCPA and CPRA strengthen consumer control over personal information by recognising rights to know, access, delete and opt out of certain processing activities. Although not exclusively directed towards biometric data, they extend important privacy protections to such information.⁷

D. United Kingdom

Following Brexit, the United Kingdom retained a GDPR-based framework through the UK GDPR. Organisations processing biometric data must obtain explicit consent where required, maintain transparency regarding processing activities and implement appropriate technical and organisational safeguards.⁸

E. Australia

Australia regulates biometric information under the Privacy Act 1988. The Act requires organisations to notify individuals about data collection, obtain consent where applicable, permit access and correction, and ensure secure handling of biometric information.⁹

F. South Africa

The Protection of Personal Information Act (POPIA) expressly recognises biometric information as personal information requiring protection. It mandates consent-based processing, grants individuals rights over their personal information and establishes the Information Regulator to oversee compliance. Serious violations may attract both financial penalties and criminal sanctions.¹⁰

G. Brazil

Brazil’s Lei Geral de Proteção de Dados (LGPD) classifies biometric information as sensitive personal data. Processing generally requires explicit consent, and organisations must ensure transparency regarding collection, retention and deletion while providing individuals meaningful control over their information.¹¹

III. CASE ANALYSIS

i. S.Q. Masood v. State of Telangana¹²

The Incident: In May 2021, during the COVID-19 lockdown, social activist S.Q. Masood was stopped in Hyderabad by police and forced to remove his mask for a facial photograph via a handheld tablet. The image was processed through the TSCOP application to match against criminal databases without consent.

The Litigation: Masood filed a Public Interest Litigation in the Telangana High Court.

Legal Arguments: The petitioner contended that deploying Facial Recognition Technology lacks statutory backing under the Puttaswamy legality test and violates the presumption of innocence by profiling citizens without reasonable suspicion.

Judicial Status: The case remains sub judice following notices issued to the state government.

ii. A.A. Rahim v. Union of India & Ors.¹³

The Incident: In July 2026, Delhi Police deployed real-time Facial Recognition Technology vehicles (“Ikshana”), smart spectacles (“AjnaLens”), drones, and fingerprint applications to scan demonstrators at Jantar Mantar.

The Litigation: Member of Parliament A.A. Rahim filed a Public Interest Litigation in the Supreme Court of India.

Legal Arguments: The petitioner argued that mass algorithmic extraction and interlinking of protest biometric data with national criminal databases operates in a legal vacuum, creating an unconstitutional chilling effect on free assembly and privacy.

Judicial Status: The petition is pending before the Supreme Court, which has tagged it with related pending matters concerning the same protests, seeking a declaration that unauthorized biometric surveillance at peaceful assemblies is unconstitutional.

iii. R (Bridges) v. Chief Constable of South Wales Police¹⁴

The Incident: UK law enforcement deployed live Facial Recognition Technology in public spaces to scan general crowds and compare faces against police watchlists.

The Litigation: Civil rights advocate Edward Bridges challenged the police deployment before the UK Court of Appeal.

Legal Arguments: The challenge asserted that deploying live Facial Recognition Technology without explicit legislative authorization or binding guidelines gave police unfettered discretion, violating statutory privacy rights.

Ruling: The UK Court of Appeal held the deployment unlawful due to the absence of a dedicated statutory framework.

iv. In re Mandatory Biometric Attendance v. State of Bihar¹⁵

The Incident: In January 2026, the Bihar government mandated GPS-enabled Facial Recognition Technology attendance systems for state medical college faculty.

The Litigation: Medical professionals challenged the mandate in the Patna High Court.

Legal Arguments: Petitioners alleged constant biometric tracking infringed personal dignity, while the state argued it served a legitimate governance aim of ensuring public doctor attendance.

Ruling: The Patna High Court upheld the system, ruling that public servants have lower privacy expectations during official duties.

IV. COMPARATIVE ANALYSIS & JURISPRUDENTIAL TRENDS

A. Statutory Mandate

A clear consensus across jurisdictions is that law enforcement cannot deploy facial recognition tools without explicit parliamentary backing. The UK Court of Appeal in Bridges¹⁶ held that operating live FRT without clear legal guidelines grants police unchecked discretion, violating Article 8 of the ECHR. This ruling offers persuasive value for Indian courts assessing cases like S.Q. Masood.¹⁷ Capturing biometric data on police tablets (such as TSCOP) without a clear statutory framework or criminal suspicion directly fails the legality test set down in Puttaswamy.¹⁸

B. Privacy Expectations: Protesters vs. Public Servants

The case law shows a distinct split depending on who is being scanned and where. In A.A. Rahim, scanning peaceful protesters with facial recognition vehicles and smart glasses interlinks assembly data with police records, directly restricting free speech and peaceful assembly under Article 19. Conversely, In re Mandatory Biometric Attendance¹⁹ establishes that public sector employees have a reduced expectation of privacy during official hours, allowing the state to use FRT for basic workplace oversight.

Courts consistently distinguish between routine state management and public surveillance. Biometric tracking is generally tolerated for internal administrative duties, but broad public surveillance fails constitutional standards without a specific law passed by Parliament. This distinction becomes especially significant when applied to protest sites, where the state’s justification for surveillance is weakest and the chilling effect on fundamental rights is greatest — the subject of the critical analysis that follows.

V. CRITICAL ANALYSIS

A. Was Facial Recognition Really Necessary? – A Failure of Proportionality

The deployment of facial recognition technology also raises concerns under the constitutional requirement that any restriction on the right to privacy must satisfy the tests of legality, necessity, and proportionality laid down by the Supreme Court. If the primary objective of the Delhi Police was to identify criminals or detect individuals attempting to infiltrate the protest, it is difficult to see why that objective could not have been achieved through the conventional surveillance measures already deployed at the site. Reports indicate that the protest was extensively monitored through CCTV cameras, videographers, drones, and other surveillance equipment. These methods allow authorities to identify individuals involved in unlawful activities by reviewing the footage whenever necessary, without subjecting every person entering the protest site to real-time biometric scanning. Facial recognition technology, on the other hand, actively captures and processes the biometric data of every individual who passes through the protest site, irrespective of whether they are suspected of any wrongdoing. This indiscriminate collection of biometric data directly affects the right to privacy recognised under Article 21, while also creating a chilling effect on the exercise of the right to assemble peacefully under Article 19(1)(b). In the absence of any explanation as to why these less intrusive measures were considered inadequate, the use of facial recognition technology appears difficult to justify. Where the same law enforcement objective can reasonably be achieved through measures that interfere less with fundamental rights, choosing the more intrusive alternative falls short of the constitutional requirement of proportionality.

B. Acquitted, Yet Still in the Database – The Illusion of Correction and Erasure

Even assuming that such biometric collection is constitutionally justified, a second and equally significant concern arises once the data enters the system. The right to seek correction is one of the key safeguards envisaged under any data protection regime such as the GDPR and the DPDP Act, ensuring that inaccurate or outdated personal data does not continue to affect an individual. The problem, however, does not end once a Gen Z protester is identified through the facial recognition system. If a protester is marked through the “red box” system because of a pending criminal case but is later acquitted and given a clean chit by the competent court, there is no clear mechanism to have that information corrected or updated. This concern remains serious notwithstanding the notification of the Digital Personal Data Protection Rules, 2025, because implementation of the Act is proceeding in a phased manner and several data-principal rights, including correction and erasure, are not yet fully operative in practice. Further, the DPDP Act gives the Central Government broad powers to exempt its agencies from several obligations on grounds such as public order, State security, or the prevention and investigation of offences. As a result, the very agencies using facial recognition technology at protest sites could be exempt from complying with requests for correction or erasure. This raises an important question: if a person’s biometric data continues to remain in police records even after they have been acquitted, can the law truly be said to protect their informational privacy?

C. No Notice. No Choice. No Consent. – When Protest Comes at the Cost of Privacy

The shortcomings of the present framework are not limited to the absence of post-collection safeguards. They begin at the very moment biometric data is collected. Consent is the cornerstone of the data protection regime. Individuals should, as far as possible, retain control over how their personal data is collected and processed. This consent-based framework underpins both the Digital Personal Data Protection Act, 2023 and the GDPR. The deployment of facial recognition technology at protest sites, however, departs from this principle. Every individual entering the protest is subjected to biometric processing without prior notice, meaningful choice, or the opportunity to refuse consent. Consequently, the exercise of the constitutional right to assemble peacefully under Article 19(1)(b) becomes inseparable from involuntary biometric data processing. When participation in a peaceful protest is conditioned upon surrendering one’s biometric identity, consent ceases to operate as a meaningful safeguard and risks becoming a legal fiction.

D. Today’s Protest, Tomorrow’s Database – How Indefinite Retention Chills Dissent

The concerns surrounding facial recognition technology do not end with its collection or processing. They extend equally to what happens after the data is stored. There is little public information on how long the facial data collected at protest sites is retained or when it is deleted. This sits uneasily with the storage limitation principle found in modern data protection laws, which requires personal data to be kept only for as long as necessary. Without clear retention limits, biometric data collected during a peaceful protest may continue to remain in police databases long after the protest has ended. The knowledge that participation in a protest could result in one’s biometric data being stored indefinitely may discourage individuals from exercising their right to assemble peacefully under Article 19(1)(b). In this way, the absence of transparent retention limits transforms temporary surveillance into a lasting deterrent against democratic participation.

VI. CONCLUSION

The deployment of unregulated Facial Recognition Technology (FRT) at peaceful protest sites poses a significant challenge to India’s constitutional democracy. As this article has shown, indiscriminate biometric surveillance disrupts the delicate balance between the right to assemble peacefully under Article 19(1)(b) and the right to informational privacy under Article 21. In the absence of a dedicated legal framework, the use of FRT raises serious concerns relating to proportionality, consent, purpose limitation, data retention, and the right to correction and erasure.

India must therefore move beyond executive discretion and establish a comprehensive statutory framework governing the use of facial recognition technology. Such a framework should restrict FRT to exceptional circumstances, require prior judicial oversight, prescribe strict purpose and retention limits, mandate the deletion of non-target biometric data, and ensure the erasure of biometric records upon acquittal or discharge. Only through clear legal safeguards and independent oversight can the State protect public order without undermining the constitutional freedoms it is duty-bound to preserve.

REFERENCE(S):

Table of Cases

• A.A. Rahim M.P. v. Union of India, Diary No. 45049/2026 (Supreme Court of India)
• In re Mandatory Biometric Attendance v. State of Bihar, C.W.J.C. No. 105 of 2026 (Patna High Court)
• K.S. Puttaswamy (Aadhaar) v. Union of India, (2019) 1 SCC 1
• R (Bridges) v. Chief Constable of South Wales Police, [2020] EWCA Civ 1058
• S.Q. Masood v. State of Telangana, W.P. (PIL) No. 10 of 2022 (Telangana High Court)

Table of Legislation — India

• Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016
• Constitution of India, 1950, arts. 19(1)(b), 21
• Criminal Procedure (Identification) Act, 2022
• Digital Personal Data Protection Act, 2023
• Digital Personal Data Protection Rules, 2025
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Information Technology Act, 2000

Table of Legislation — International

• Artificial Intelligence Act (Proposed, European Union)
• Biometric Information Privacy Act, 2008 (Illinois, United States)
• California Consumer Privacy Act (California, United States)
• California Privacy Rights Act (California, United States)
• General Data Protection Regulation (EU) 2016/679 (GDPR)
• Lei Geral de Proteção de Dados, 2018 (LGPD, Brazil)
• Privacy Act 1988 (Australia)
• Protection of Personal Information Act, 2013 (POPIA, South Africa)
• UK General Data Protection Regulation (UK GDPR)

Bibliography

• European Parliament, “Proposal for a Regulation Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act)” (EU Parliament, 2024)
• Ministry of Electronics and Information Technology, “Digital Personal Data Protection Act, 2023” (MeitY, Government of India, 2023)
• Ministry of Law and Justice, “The Information Technology Act, 2000” (Government of India, 2000)

Endnote(S):

1. Information Technology Act, No. 21 of 2000 (India); Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (India).

2. Justice K.S. Puttaswamy (Retd) v. Union of India, (2019) 1 SCC 1.

3. Digital Personal Data Protection Act, No. 22 of 2023 (India), §§ 2(t), 6–13, 17; Digital Personal Data Protection Rules, 2025 (India).

4. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), arts. 5, 9, 35.

5. Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), COM (2021) 206 final; European Parliament Position (2023).

6. Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1–99 (2008).

7. California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100–1798.199; California Privacy Rights Act of 2020.

8. UK General Data Protection Regulation, as incorporated through the Data Protection Act 2018.

9. Privacy Act 1988 (Cth) (Austl.).

10. Protection of Personal Information Act 4 of 2013 (S. Afr.).

11. Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018) (Braz.).

12. S.Q. Masood v. State of Telangana, W.P. (PIL) No. 10 of 2022.

13. A.A. Rahim M.P. v. Union of India & Ors., Diary No. 45049/2026 (S.C.), filed under Article 32, July 2026.

14. R (Bridges) v. Chief Constable of South Wales Police, [2020] EWCA Civ 1058.

15. In re Mandatory Biometric Attendance v. State of Bihar, C.W.J.C. No. 105 of 2026.

16. Bridges (n 14).

17. Masood (n 12).

18. Puttaswamy (n 2).

19. In re Mandatory Biometric Attendance (n 15).