India has deployed facial recognition technology (FRT) across airports, railways, and policing without any dedicated legislation authorising or regulating its use. The absence of a statutory framework means no codified limits on data retention, no consent requirement, and no independent oversight. Critics argue this creates a constitutional void: state surveillance of biometric data without a law backed by procedure established by law, directly threatening the right to privacy recognised unanimously in Puttaswamy v Union of India (2017).

The constitutional problem with India's unregulated facial recognition ecosystem sits at the intersection of three doctrines.

**Article 21 and the Right to Privacy:** In K.S. Puttaswamy v Union of India (2017), a nine-judge bench unanimously held that privacy is a fundamental right under Article 21. The court further required that any state intrusion into privacy must satisfy a three-part test: (i) legality — the intrusion must be backed by a law; (ii) legitimate aim — the law must pursue a compelling state interest; and (iii) proportionality — the means must be necessary and the least restrictive option available.

FRT deployed without statute fails the first limb immediately. There is no law that authorises the state to collect, store, process, or share facial biometric data. Executive orders and departmental circulars do not constitute 'law' within the meaning of Article 21.

**Article 14 and Arbitrariness:** Uncodified FRT deployment also attracts the Maneka Gandhi (1978) reading of Article 14 — that a procedure, even if it exists, cannot be arbitrary. Without standards governing accuracy thresholds, demographic bias, or appellate remedies for false matches, the process is constitutionally arbitrary.

**Article 19(1)(a) and (d) — Chilling Effect:** Mass surveillance suppresses free movement and expression. In PUCL v Union of India (1997), the Supreme Court struck down phone-tapping without procedural safeguards as violating Articles 19 and 21 together. The same logic extends to real-time biometric tracking.

**Comparative Position:** The EU AI Act (2024) classifies real-time remote biometric identification as a high-risk AI system and bans most public-space FRT use. The contrast sharpens India's regulatory gap.

The DPDP Act, 2023, while addressing personal data broadly, excludes government instrumentalities in security contexts from several obligations, widening rather than closing this void.