The controversial mass surveillance by the Delhi police for criminal profiling of protestors at the recent CJP protests at Jantar Mantar in Delhi has raised serious concern surrounding limits of surveillance and consequences of unauthorized processing of personal data. In July of 2026, the Delhi Police deployed the Ikshana van - a mobile surveillance vehicle with eight fixed cameras, first inducted before the 2023 G20 Summit. Deployed without justification, the facial recognition system, equipped with AI, compared live CCTV footage with existing criminal databases and records maintained by the police agencies.

A Public Interest Litigation (PIL) was filed in the Delhi High Court on 15 July 2026 challenging the surveillance. The PIL alleged unauthorized video-graphing of protestors, failing the constitutional test of “least restrictive means”, and flagrant violation of privacy, dignity, free speech and peaceful assembly. The Union's position was that there is no reasonable expectation of privacy at a public protest, and surveillance was a routine law and order measure and in compliance with the standing orders pursuant to Supreme Court directions for regulating protests. The matter is now pending before the Supreme Court.

The problem is two pronged - the first is authorization: no statute permits the police to run biometric identification on a crowd. The second is what happens to the data afterwards. Nothing in law says how long it is kept, who may see it, or when it must be deleted. India does regulate some surveillance closely. Section 5(2) of the Indian Telegraph Act, 1885 allowed interception of messages during a public emergency or in the interest of public safety on specified security and public-order grounds. Section 20 of the Telecommunications Act, 2023 modernized the framework by extending interception to telecommunication messages, subject to certain procedural safeguards. Section 69 of the Information Technology Act, 2000 enabled the government to intercept, monitor or decrypt information generated, transmitted, received or stored in computer resources. However, none of these laws govern biometric identification during public gatherings.

The Union's defense rests on standing orders that authorize recording, but recording does not mean identification. An order that allows the police to film a crowd does not, by itself, allow them to convert those faces into searchable data and match them against a database. When the protest ended, the state argued the petition had become infructuous because the surveillance had stopped and therefore, no cause of action existed. This article asks not only whether the surveillance was lawful, but why unlawful surveillance in India so rarely produces any consequences for the state.

Legality first, Proportionality second

Injury to dignity, rights of privacy, free speech, and peaceful assembly seem to be at the forefront of this controversy. The Supreme Court acknowledged the nexus between the right to privacy and surveillance state in the case of Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors. The principles developed in the landmark judgement are based on four foundational issues, namely: (i) legality; (ii) a legitimate aim; (iii) proportionality; (iv) procedural safeguards against the abuse of that power. However, it is interesting to note that the test activates only upon a prior existence of a law. Currently, no law allows biometric identification of people at a public assembly. The existing standing orders authorize recording as part of 'limiting total number of protestors', not biometric matching in criminal database. Proportionality asks whether a restriction is a minimum necessary means to a permitted end. It also presupposes that the state has been permitted the end. Where there is no law, there is nothing to balance or calibrate. However, proportionality still applies - a state action in pursuance of public order, of which surveillance and subsequent database match form a part. On 18 August 2026, the Supreme Court indicated it would examine the proportionality, which presumes the first limb (legality) is met.

The State's Two Defenses: Say Little, Show Less

Delhi Police told the Supreme Court, in an affidavit sworn by DCP (New Delhi), that the software does not capture everyone and a facial recognition match against criminal database does not automatically invoke police action against the protestors. The Solicitor General said the technology was deployed solely to identify criminals who have committed serious offences. The petition before the Court records an RTI reply in which Delhi Police confirmed that no privacy impact assessment was ever conducted before deployment of facial recognition technology. Additionally, the police had earlier maintained that facial recognition was meant for tracing missing persons and identifying the dead. A tool authorized for one purpose was used for another during a protest, and the justification arrived only after the scanning was done. The problem is compounded by silence on the data of people who did not match the criminal databases.

The lack of concern surrounding private data is not new. In Manohar Lal Sharma v Union of India, W.P. (Crl) 314/2021, the Court appointed the Justice R.V. Raveendran committee in October 2021 to examine the allegations and privacy implications of Pegasus spyware surveillance of journalists and activists. However, the exercise merely remained fact-finding, without providing remedies or full public disclosure of the findings.

Article 19(2) as a Blank Cheque

India's tryst with authorized surveillance and respect for Article 19 has always been a slippery slope. Reasonable restrictions in Article 19(2) include “sovereignty and integrity of India, the security of the State, friendly relations with foreign states, public order, decency or morality or in relation to contempt of court, defamation or incitement to an offence”. The grounds for interception in different laws are largely identical to these reasonable restrictions. The restrictions placed in Article 19 are broadly termed and subject to the tests of reasonableness or arbitrariness by the Court. However, the same words in a statute, invoked by an officer with no threshold and no review, carry no such discipline.

Instead of interpreting these grounds as principles, the state has understood them as concrete, standalone grounds for authorization. The statutes which allow interception or physical surveillance use these exact reasons without establishing basic threshold for invoking such state action. The state can carry out surveillance at its discretion or criminally profile certain class of citizens merely because the statutes lack definite, unambiguous threshold.

A Comparative look at Structural Remedies

A pattern emerges: Indian courts have shown they are capable of applying the Puttaswamy (2017) proportionality standard when a suitable petitioner and a suitable record reach them, but the doctrine has not been translated into a standing architecture that operates independently of individual litigation. Laws fail to curb unauthorized state surveillance and give little room for people to protect their personal data, even the one collected against their consent.

Ideally, interception and profiling should require sign-off from a body independent of the requesting agency before deployment. A subsequent review (like the Raveendran Committee) defeats the purpose. The United Kingdom's Investigatory Powers Act, 2016 offers a workable model in its “dual-approval” mechanism which provides that the secretary of state additionally requires approval from an independent Judicial Commissioner before issuing surveillance orders.

Article 5(1)(h) of the EU AI Act (Regulation (EU) 2024/1689) prohibits the use of real-time remote biometric identification by law enforcement in publicly accessible spaces by default, permitting it only within three narrow, judicially authorized exceptions. India has no equivalent statute at all, thereby, tools deployed by the police during the recent protest fails to meet even the basic standard the EU has set.

Laws enabling State Impunity

The legal architecture of state surveillance in India demonstrates colonial-era overreach. The laws have increasingly adapted to suit the advancing digital landscape. Originating in statutory provisions like the Indian Telegraph Act, (1885) and the Post Office Act (1898), interception by the state was permitted on “public emergency” or “public safety” thresholds. The Supreme Court introduced procedural checks in PUCL v Union of India (1997) 1 Supreme Court Cases 301, and recognized privacy as a fundamental right in the Puttaswamy judgement (2017), but statutory developments have steadily diluted these checks.

The Information Technology Amendment Act (2008) marked a crucial shift by expanding surveillance into routine digital monitoring. Section 69 of the Act enabled the governments to access, intercept, monitor or decrypt digital information on similar grounds as Article 19(2) of the Constitution. Recent laws reinforce interception of powers of the state, grant it direct access to electronic communications, and sidestep judicial oversight. The Telecommunications Act (2023) in its section 20 allows interception and disclosure of information by the governments on similar grounds. Broad state exemptions under the Digital Personal Data Protection Act (2023) apply data minimization rules in section 6(1). It provides that personal data can only be processed to the necessary extent of specified purpose and free consent of the data principal. This rule does not apply to concerned governments which may process personal data as per section 17(2)(a). Broad state exemptions under the DPDP framework leave a person with little defense to protect their personal data from the government.

Additionally, the vagueness and ambiguity of terms (like sovereignty and integrity of India, incitement to offence relating to any of these) contribute to the one-sided power structure. The grounds also do not have established evidentiary thresholds, thereby granting the executive supreme discretion. The architecture encourages pre-emptive surveillance and apprehension of a suspect with minimal justification.

Absence of Fair Notice

Foundational principles of criminal justice mandate clear, exact standards of behavior which may trigger penal or surveillance consequences. While the language of the laws mirrors the “reasonable restrictions” given under article 19(2), the absence of precise legislative definitions deprives citizens of fair notice of what conduct will expose them criminal liability. This statutory ambiguity operates as a chilling effect and causes indirect suppression of free speech and expression - Article 19(1)(a), through the threat of arbitrary, unspecified grounds for surveillance. Because people don't know the legal boundaries, self-censorship becomes a common consequence of such laws. Section 152 of the Bharatiya Nyaya Sanhita (2023) (the erstwhile section 124A of the Indian Penal Code) has only added punishment for 'electronic communication'. The section still carries its original language punishing act which “encourages feelings of separatist activities or endangers sovereignty or unity and integrity of India.” The suspect whose data upon interception by the concerned government, if interpreted as covered by these specific grounds, risks imprisonment. The doctrine of fair notice still remains missing in the new section. These ambiguous laws don't merely punish the suspects but also induce undue fear amongst others who wish to express genuine dissent as part of their free speech.

Unauthorized surveillance and biometric identification are the newest additions to a long-standing contest between the state's duty to maintain public order and individual liberty. The petitions before the Delhi High Court and the Supreme Court voice precisely this concern. A defined procedure for how data is obtained, why it is retained and when it is destroyed should not depend on litigation to secure. Erasure of data within a fixed statutory timeline should be the default, unless mandated by specific investigative requirements. It is also crucial that committees like the Raveendran Committee should not become the model because it found facts that remain sealed even four years later. Fact-finding without accountability benefits no one, especially the victims. What is needed is a permanent statutory body that reviews surveillance across agencies and reports on it regularly. A comprehensive statute governing state surveillance and its limits and exact threshold would address public order priorities of the state while providing legal route to victims to avail justice in case of unauthorized surveillance.

The doctrines and precedents governing state surveillance already exist. Puttaswamy laid the constitutional foundation and listed the safeguards any lawful surveillance regime must contain. Whatever the Supreme Court decides in the pending case, surveillance conducted without legal authority, notice, or safeguards should not escape constitutional scrutiny. The remedy sought is not a new right, but effective enforcement of the existing rights established through precedents. A right that cannot be invoked by the people it protects is not a right; it is a promise the state keeps at its own convenience.

Author Shivani Devadiya is an Advocate practicing at Delhi High Court and Supreme Court & Harshita Anand is a PhD scholar at National Law University, Delhi. Views are personal.