India has deployed facial recognition technology (FRT) across airports, railway stations, and public spaces, yet no dedicated statute regulates its use. The Supreme Court's 2017 Puttaswamy ruling established privacy as a fundamental right under Article 21, and its nine-judge bench laid down the proportionality test. FRT, which processes biometric data without consent, challenges Articles 14, 19, and 21 simultaneously. The absence of a data protection framework specific to biometric surveillance leaves citizens without statutory remedy against state overreach.

The constitutional challenge to facial recognition technology rests on the architecture of three fundamental rights simultaneously.

Article 21 and the Privacy Foundation: In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge bench unanimously held that privacy is a fundamental right intrinsic to Article 21. The court identified three components of privacy — spatial (home), decisional (choices), and informational (data about oneself). FRT intrudes on all three: it maps public space, infers personal choices from movement patterns, and harvests biometric data without consent.

The Proportionality Test: Puttaswamy adopted a four-part proportionality test drawn from German constitutional law — (1) the measure must be sanctioned by law; (2) it must pursue a legitimate aim; (3) it must be the least restrictive means; and (4) there must be procedural safeguards. FRT currently fails the first limb — there is no statute authorising it. The Criminal Procedure (Identification) Act, 2022 permits collection of biometric measurements but does not specifically govern real-time facial mapping of the general public.

Article 14 — Algorithmic Arbitrariness: FRT systems globally show racial and gender bias. Arbitrary identification producing false positives and disproportionate targeting of minorities violates the non-arbitrariness strand of Article 14 established in E.P. Royappa v. State of Tamil Nadu (1974).

Article 19 — Chilling Effect: Pervasive surveillance suppresses free speech and assembly (Articles 19(1)(a) and (b)). The chilling effect doctrine, recognised in Shreya Singhal v. Union of India (2015), means that even if FRT is not used to prosecute, its presence deters constitutionally protected behaviour.

The regulatory vacuum is the central problem. The Digital Personal Data Protection Act, 2023 (DPDPA) governs personal data processing but exempts state agencies on national security grounds, leaving the core surveillance question unanswered.