Delhi’s use of facial recognition at student protests exposes a gap between constitutional protections and the rules governing police surveillance.
By Dhruv Gadgil, Research Analyst with the Young Professionals Program (YPP)
Under the banner of the Cockroach Janta Party, tens of thousands of young Indians gathered at Jantar Mantar, Delhi, in July 2026 to demand Education Minister Dharmendra Pradhan’s resignation over a leaked national medical-entrance exam (NEET). A mobile surveillance vehicle branded Ikshana, developed for Delhi Police with CP Plus, ran facial recognition on the crowd. A Reuters reporter saw his face on a screen inside, boxed in green beside a match metric, before an officer shut the window. The force used against the protesters—the baton charges, the tear gas and hospital-confirmed pellet injuries—took the headlines. The digital extraction deserves closer attention because it operated without a specific statutory framework governing police facial recognition.
Consider what the apparatus did. It photographed demonstrators and ran their faces against police databases. The Internet Freedom Foundation (IFF), which has sought these records since 2020, reported that right-to-information replies disclosed no specific rule governing Delhi Police’s use of the technology and no privacy impact assessment. Reporting also identified no fixed retention guidelines for the protest footage. A citizen exercising a freedom guaranteed by Article 19 of the Indian Constitution thus faced the risk of indefinite retention of images captured through privately supplied technology.
India has no dedicated law governing police facial recognition. The National Crime Records Bureau initially defended its proposed nationwide system by invoking a cabinet note, rather than legislation. In August 2025, the Home Ministry told Parliament that a Delhi Police standing order of June 2022 regulates the command centre behind the city’s cameras. IFF published its 36 pages on October 2, 2026: facial recognition, biometric, database, retention and deletion appear nowhere in them. Its closing clause limits the order to the police department’s internal functioning.
The Criminal Procedure (Identification) Act, 2022 authorises taking measurements from specified categories of people, including those convicted, arrested or preventively detained, and those ordered to furnish security for good behaviour or keeping the peace. Section 5 also permits a magistrate to order measurements from any person for an investigation or proceeding. Mere attendance at a protest does not itself establish these conditions or provide blanket authority to scan everyone present.
The Digital Personal Data Protection Act, 2023 contains broad exemptions. Section 17(2)(a) allows the central government, by notification, to exempt processing by specified state instrumentalities on grounds including state security and public order. Justice B.N. Srikrishna, who chaired the committee behind India’s 2018 draft data-protection bill, warned that comparable powers in the 2019 bill could create an “Orwellian state”. That bill was withdrawn, but broad exemption powers remain in the 2023 Act. Section 17 is scheduled to commence in May 2027. Constitutional privacy protections already apply; the coming statutory regime nevertheless contains significant routes around its safeguards.
That design is why disciplining a few overzealous officers misses the point: remove the constables who ran the recognition van and the next deployment still faces the same gap in regulation. A remedy has to reach the rules themselves. Former Jawaharlal Nehru University Students’ Union president Aishe Ghosh asked the Delhi High Court on July 15 to declare the surveillance unconstitutional and order the collected data destroyed. Solicitor General of India Tushar Mehta called a claim of privacy in a public place “ironical”. That argument collapses being seen into being enrolled. An officer filming a scuffle observes a person, while the Ikshana van converts a face into a template and matches it against police databases. Being visible in a crowd is not consent to be identified and filed. Puttaswamy recognises that privacy attaches to a person, including in public.
The Supreme Court has agreed to hear a parallel petition from CPI(M) parliamentarian A.A. Rahim, seeking to restrain indiscriminate biometric surveillance at assemblies until Parliament legislates. On September 1, the Court quashed FIRs against student protesters under Article 142, while preserving an exception for 2,873 people whom police alleged had serious criminal antecedents. That order did not resolve the surveillance’s constitutionality. The public still lacks a clear account of what protest data was retained and when it must be deleted.
Large gatherings can turn dangerous, and the July protests were not uniformly peaceful: stone-pelting and injuries to police were reported. A stone-laden truck near the site had been in police custody since an unrelated crash four days earlier, though police denied deliberately placing it there. The Rapid Action Force later barred pellet guns during its Delhi deployment; its inspector-general reportedly criticised excessive force. But crowd safety does not license indiscriminate biometric capture, and the absence of a prohibition is not a finding of proportionality. The Supreme Court’s Puttaswamy judgment requires privacy intrusions to satisfy legality, a legitimate state aim and proportionality. Scanning a crowd without clear statutory authority, retention limits or independent oversight is hard to reconcile with that standard. Police maintained that the system captured profiles only of people with serious criminal records, a claim contested in court. That defence still leaves questions about the scope of scanning, the handling of nonmatches and the retention of protest footage. A state that needs to identify a stone-thrower does not need a permanent database of every student who stood near him.
Other democratic governments want this capability too. The European Union’s AI Act has, since February 2025, generally prohibited real-time remote biometric identification in publicly accessible spaces for law enforcement, subject to narrow exceptions. Judicial or independent administrative authorisation is normally required, with an urgency exception requiring an application within 24 hours. In a July 14, 2026 opinion, Italy’s privacy watchdog challenged proposed automated processing of all entrants’ biometric data as inconsistent with the Act’s rules on targeted, retrospective recognition. India needs comparable specific safeguards.
The freedom to assemble loses its meaning if assembling risks automatic identification and indefinite cataloguing. What the biometric layer changes is duration: a retained template can follow a student who joined a protest at nineteen into future crowds, long after the demonstration ends. Dissent risks being reclassified from a right to be protected into a security event to be recorded. Undoing that means legislating what has been left unlegislated: a statute governing police facial recognition, with real limits on when it may be switched on and how long what it captures may be held, an independent check before deployment, and a narrowing of the Section 17 exemptions before they take effect in 2027. The absence of a dedicated law is not proof of lawfulness. Parliament must close the regulatory gap while the courts enforce the constitutional protections already in place.
The views expressed in this article are the author’s own and do not necessarily reflect those of Tessera Institute for Global Affairs.
Glossary
- CJP: Cockroach Janta Party, the student protest movement.
- CPI(M): Communist Party of India (Marxist).
- DPDP Act: Digital Personal Data Protection Act, 2023.
- FIR: First Information Report, the initial police record concerning a cognizable offence.
- IFF: Internet Freedom Foundation.
- NCRB: National Crime Records Bureau.
- NEET: National Eligibility cum Entrance Test, India’s national medical-entrance examination.
- RAF: Rapid Action Force, the specialised riot-control wing of the Central Reserve Police Force.
- Puttaswamy: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court judgment recognising privacy as a fundamental right.
References
European Parliament and Council. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 5, 26 and 113. Read the source.
Garante per la protezione dei dati personali. Opinion on Titles I and III of the draft decree adapting Italian law to Regulation (EU) 2024/1689, No. 531, July 14, 2026. Read the source.
Government of India. The Criminal Procedure (Identification) Act, 2022, Sections 3–5. Read the source.
Government of India. Digital Personal Data Protection Act, 2023, Section 17. Read the source.
Indian Express. “Explained: Why the Govt Has Withdrawn the Personal Data Protection Bill, and What Happens Now.” August 2022. Read the source.
Indian Express. “Live Video Feeds, AI-Aided Facial Recognition: How Police Are Surveilling Protesters at Jantar Mantar.” July 24, 2026. Read the source.
Internet Freedom Foundation. “NCRB Finally Responds to Legal Notice on Facial Recognition, We Promptly Send a Rejoinder.” November 8, 2019. Read the source.
Internet Freedom Foundation. “IFF Writes to the Commissioner of Police and Files RTIs on Live Facial Recognition at Jantar Mantar.” July 24, 2026. Read the source.
Internet Freedom Foundation. “IFF Makes Public the Delhi Police Order Cited for Facial Recognition as It Continues Evasion.” October 2, 2026. Read the source.
Jain, Debby. “Facial Recognition Tool Only Captures Persons Having Criminal Records at Protests: Delhi Police to Supreme Court.” LiveLaw, August 18, 2026. Read the source.
Kumar, Mayank. “RAF Chief Admits Use of ‘Excessive Force’. Force Bars Pellet Guns, Electric Shock Weapons at Jantar Mantar.” ThePrint, July 25, 2026. Read the source.
Ministry of Electronics and Information Technology (India). Commencement notification for the Digital Personal Data Protection Act, 2023, G.S.R. 843(E), November 13, 2025. Read the source.
Newslaundry. “Delhi Police Owns the Stone-Laden Truck after NL Report. But Their Lawyer Linked It to Protesters in HC.” July 29, 2026. Read the source.
NDTV. “‘Shards Stuck to Skin’: Hospital Report Shows Pellet Guns Used at CJP Protest.” July 24, 2026. Read the source.
Reuters. “Modi Faces Challenge from Activists over Surveillance at India Youth Protest.” July 27, 2026. Read the source.
SCC Times. “NEET-UG 2026 Protests: Supreme Court Quashes FIRs under Article 142.” September 2, 2026. Read the source.
Supreme Court of India. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, August 24, 2017. Read the source.
The Tribune. “SC Agrees to Hear Plea against Delhi Police’s Use of ‘Facial Recognition’ at Jantar Mantar Protest.” August 13, 2026. Read the source.
Times of India. “PIL in Delhi High Court Questions Continuous Surveillance of Jantar Mantar Protesters.” July 15, 2026. Read the source.
