AI Surveillance and the Right to Privacy in India: Where Should the Law Draw the Line?

Artificial intelligence is transforming surveillance from the observation of isolated events into the continuous analysis of people, places and behaviour. The challenge for constitutional democracies is no longer merely whether the state may watch its citizens, but how far that power may extend before it threatens privacy, liberty and the rule of law.

Introduction: When Watching Becomes Knowing

Imagine walking through a railway station, entering a shopping complex, attending a public meeting or travelling along a city road. Cameras record movements, facial recognition software compares images against databases, and digital systems may connect one observation with information collected elsewhere. Individually, each observation might appear ordinary. Collectively, however, these records could reveal a detailed picture of a person's life: where they travel, whom they meet, which institutions they visit and what patterns distinguish them from others.

Surveillance is not new. Governments have long monitored communications, investigated crime and gathered intelligence. Artificial intelligence changes the speed, scale and predictive capacity of these activities. An AI-enabled system can process numerous video feeds, search for faces, identify patterns and generate alerts. When combined with location information and digital records, surveillance can become persistent, interconnected and difficult for the individual to detect.

The existence of technology capable of monitoring society does not establish a legitimate authority to use it without meaningful limits. Governments have legitimate interests in preventing terrorism, investigating serious crime and protecting public safety. Yet these objectives must remain subject to constitutional principles, statutory authority and effective safeguards. Technical capability and legal authority are separate questions.

1. From CCTV Cameras to Intelligent Surveillance Networks

Traditional CCTV systems were primarily designed to record events. AI-enabled systems can search, classify, compare and analyse visual information automatically. Facial recognition may compare an image with reference images or biometric templates; other systems may estimate crowd density, identify specified movements or flag behaviour configured as unusual. The accuracy and reliability of these tools depend on their design, data, operating environment and intended purpose.

The consequences become more significant when information from different sources is linked. A camera may record presence at a location, a transport system may record a journey, and a digital service may maintain access records. Combined, these records may reconstruct patterns of movement and association that no single dataset could reveal. The legal concern extends beyond whether an image was captured in public: it includes the purpose of processing, the inferences generated and the decisions that follow.

A narrowly targeted system used for a defined investigation is not equivalent to a network that continuously identifies everyone passing through a public space. The scope of observation, justification, retention period and risk of misuse should all shape the legal assessment. Automated monitoring also operates invisibly; a person may never know that their image was matched or their behaviour contributed to a risk assessment. This makes meaningful accountability indispensable.

2. The Constitutional Foundation: Privacy as a Fundamental Right in India

In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge Constitution Bench of the Supreme Court unanimously recognised privacy as a fundamental right protected by the Constitution. The judgment located privacy within Article 21's protection of life and personal liberty while recognising its relationship with other constitutional freedoms. Privacy protects dignity, autonomy and the ability to develop one's life without unjustified interference.

The judgment is directly relevant to AI surveillance. Privacy cannot be reduced to the proposition that people have nothing to fear if they have done nothing wrong. Individuals may have legitimate reasons to keep movements, relationships, communications and activities private. Attending a peaceful political meeting, consulting a lawyer, visiting a medical facility or meeting a journalist may engage privacy interests even when these activities occur in public or semi-public settings.

Recognition of privacy does not make every surveillance activity unconstitutional. Lawful investigation and appropriately authorised interception can be legitimate. But interference with privacy requires a legal basis and must satisfy the applicable constitutional requirements, including legitimate purpose, proportionality and safeguards against abuse. Executive convenience or technological possibility cannot independently justify an intrusion into fundamental rights.

3. The Legal Architecture of Surveillance in India

India's surveillance framework spans constitutional principles, telecommunications legislation, information technology law, procedural rules and data protection legislation. Different instruments govern different activities. The legal authority to intercept a communication for a specified purpose should not be treated as general permission for every form of digital monitoring.

Section 69 of the Information Technology Act, 2000, together with applicable rules, provides a framework for specified forms of interception, monitoring and decryption involving computer resources. Telecommunications legislation and its applicable rules also provide for specified interception measures. These powers operate subject to statutory grounds and procedural requirements; they are not a general licence for unrestricted observation.

In People's Union for Civil Liberties v. Union of India (1997), the Supreme Court considered telephone tapping and the privacy interests engaged by telephone conversations. The decision helped establish that interception must conform to legal procedure. It remains an important reference point when considering how established principles of privacy and due process apply to newer electronic monitoring technologies.

The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, are also relevant to digital personal data. The Rules were notified in November 2025, with implementation structured through phased commencement. Their precise application depends on statutory definitions, exemptions and which provisions are in force at the relevant time. The Act should not be treated as a complete code governing every form of state surveillance; constitutional safeguards and other applicable laws remain important.

The central question is one of coherence and accountability. Can a citizen, court or independent oversight body determine who authorised a surveillance operation, what information may be collected, how long it may be retained, whether it may be shared and what remedies are available if the power is misused? Where these questions lack clear answers, the problem is legal as well as technological.

4. Facial Recognition: Identification, Suspicion and the Risk of Error

Facial recognition may assist in identifying a missing person, verifying identity or supporting a targeted investigation. But a system can produce false positives, and its performance can vary with image quality, lighting, camera angle, demographic characteristics and other technical factors. A match is not, by itself, proof that a person has committed an offence.

The legal problem becomes acute when a match triggers police attention, questioning or other adverse treatment. An affected person may have no access to the information or methodology behind the match. A rights-respecting framework should distinguish an algorithmic alert from a legally sufficient basis for coercive action. Human review must be meaningful: officials should verify results with independent evidence, understand system limitations and document consequential decisions.

There is also a difference between one-to-one verification and one-to-many identification. The latter may compare a person against a large collection of identities and can have broader implications for anonymity and freedom of movement, especially when deployed continuously in public spaces. Authorities should address the source of reference images, access permissions, correction of inaccurate records and deletion of information that no longer serves a legitimate purpose.

5. The Chilling Effect: When Citizens Begin to Regulate Themselves

Surveillance can affect behaviour even when it does not result in arrest or prosecution. People may avoid expressing controversial opinions, attending peaceful demonstrations, associating with particular groups or consulting professionals because they cannot predict how collected information will be interpreted or used in the future. This is commonly described as the chilling effect.

Freedom of expression and peaceful association depend partly on the ability of citizens to form opinions and participate in public affairs without unreasonable interference. If attendance at a protest or a meeting with a journalist can be recorded and analysed, some individuals may decide that the perceived risk is not worth taking. The resulting harm can be difficult to measure, but that does not make it irrelevant.

Not every camera or lawful investigation suppresses democratic participation. The question is whether the scope, duration, method and consequences of surveillance create an unjustified burden on protected freedoms. Automated inferences about intention or risk require particular care because ordinary activities can have many innocent explanations.

6. Predictive Policing and Algorithmic Bias

Predictive policing systems analyse historical incident data, geographic patterns or other information to estimate where offences may occur or which cases deserve attention. Their usefulness depends on the quality of the data and the validity of the assumptions used. Historical records may reflect reporting rates, policing patterns and past resource allocation rather than an objective picture of criminal behaviour.

If an area has been heavily policed, more offences may be detected there than in a comparable area receiving less attention. An algorithm may interpret this concentration of recorded incidents as a reason to deploy even more policing, creating a feedback loop. Models may also use apparently neutral factors that function as proxies for sensitive characteristics and reproduce discriminatory outcomes.

A prediction about future conduct cannot, by itself, establish that a person has committed a crime. Where algorithmic assessments influence searches, detention or other exercises of state power, the resulting action must have an independently defensible legal basis. Authorities should document a system's purpose, inputs, limitations and safeguards, and provide meaningful ways to challenge errors.

7. National Security and the Limits of Executive Discretion

Governments have a duty to protect people against terrorism, organised crime, cyberattacks and other threats. Confidential monitoring may be necessary in particular circumstances. But national security cannot become an unlimited formula that removes the need for legal reasoning. A measure may pursue a genuine objective and still be excessive, insufficiently authorised or inadequately supervised.

Targeted surveillance based on legally recognised grounds differs from indiscriminate monitoring of a broad population. The burden of justification should increase as surveillance becomes more extensive, persistent or capable of generating sensitive inferences. Reviewing authorities need sufficient information to assess the grounds, scope and duration of a measure, and subsequent oversight should examine whether the operation remained within its authorised purpose.

Confidentiality and accountability are not mutually exclusive. Appropriately authorised courts, independent officials or oversight mechanisms can examine surveillance without publicly disclosing operational details that genuinely require protection. Security is an important public interest, but it is not a substitute for the rule of law.

8. Consent, Public Spaces and the Illusion of Choice

People may reasonably expect that a public street is not entirely free from observation. That does not necessarily mean they have agreed to be identified across a network of cameras, have their movements connected over time or have their behaviour analysed to generate predictions. The transition from observation to persistent automated identification changes the nature and potential consequences of monitoring.

Consent is not a universal solution. Individuals may have no realistic alternative to entering a railway station, visiting a government office or accessing an essential service. Nor does clicking acceptance on a digital platform necessarily demonstrate informed agreement to every future use of information. Some activities may rely on statutory authority rather than consent, but that authority must itself satisfy the applicable legal framework.

Purpose limitation matters because information collected for one legitimate purpose should not automatically become available for unrelated uses merely because reuse is technically convenient. Significant expansion of a database's purpose can alter its privacy implications and requires a defensible legal basis and safeguards.

9. Data Protection: What Happens to the Information?

The legal debate continues after surveillance has taken place. Collection, storage, analysis, sharing, retention and deletion each create different risks. Information may be collected lawfully but stored insecurely, retained longer than necessary or accessed by unauthorised persons. Effective regulation must address the entire information lifecycle.

The Digital Personal Data Protection Act, 2023, and the Rules notified in 2025 form part of India's digital data protection framework, subject to their scope, exclusions and commencement arrangements. Their application to a particular surveillance activity must be assessed carefully. Constitutional requirements and other applicable laws remain relevant, particularly where state powers and national security are involved.

Data minimisation, retention limits, access controls, secure storage, audit logs and documented deletion procedures can reduce misuse. Public authorities can disclose the broad purpose, legal framework and accountability arrangements of significant surveillance programmes without necessarily revealing sensitive operational details. Individuals also need practical complaint and review mechanisms, with remedies determined by the applicable law.

10. Lessons from International Approaches

Other jurisdictions have attempted to regulate facial recognition, biometric identification and automated decision-making through constitutional rights, legislation, judicial review and independent oversight. The European Union's AI Act establishes a risk-based framework and imposes restrictions and conditions on specified uses of biometric identification, including certain law-enforcement uses in publicly accessible spaces. It contains defined exceptions and should not be described as a universal ban on facial recognition.

The United States has a more fragmented landscape of constitutional protections, federal and state laws and local restrictions. International human rights principles likewise emphasise that interferences with privacy, expression and association must be justified under applicable legal standards. These approaches offer useful lessons, but no single model can simply be transplanted into India without considering its constitutional structure, security requirements and institutions.

11. A Rights-Based Framework for AI Surveillance

India needs a coherent approach that begins with legal authority and continues through system design, deployment and review. Authorities should identify the specific problem a system is intended to address and explain why the technology is suitable. Broad claims about efficiency or modernisation should not be enough to justify every form of monitoring.

Necessity and proportionality should be assessed before deployment and as systems evolve. Authorities should consider whether less intrusive methods can achieve the objective, whether monitoring is appropriately limited and whether the benefits justify the interference with rights. High-impact systems should undergo documented privacy and human-rights assessments that examine false identification, discriminatory effects, security vulnerabilities, retention and consequences for freedom of expression and association.

Human oversight must be real. Automated outputs should not become unquestionable substitutes for evidence or legal judgment. Officials should understand the limitations of tools, verify results and record reasons for consequential decisions. Data governance should establish who may access information, for which purposes it may be used, how long it may be retained and when it must be deleted.

Independent oversight and effective remedies are essential. Courts and legally authorised review bodies should be able to examine legality, while appropriate mechanisms should identify systemic failures and recurring misuse. Transparency about broad purposes and accountability arrangements, periodic review and independent evaluation can help prevent technological expansion from outrunning democratic oversight.

12. The Future of Privacy in an AI-Driven Society

As AI becomes integrated into transport, workplaces, educational institutions, public services and digital platforms, the ability to infer information about individuals will continue to expand. The law must pay attention not only to the original source of information but also to inferences and consequences. A society in which every action may be recorded and analysed risks changing the relationship between citizens and public institutions.

Rejecting every surveillance technology would ignore legitimate public needs and possible benefits. Properly controlled systems may assist investigations, locate missing persons and improve emergency responses. The objective should be neither unrestricted surveillance nor a blanket rejection of technology, but a framework in which its use is justified, limited and accountable.

Conclusion: Security Must Not Become a Licence for Unlimited Observation

Artificial intelligence makes it possible to observe more people, process more information and draw more inferences than ever before. Continuous monitoring, biometric identification, predictive analysis and linked datasets can transform isolated observations into detailed accounts of individuals' lives. These capabilities may offer benefits, but they also create risks that conventional surveillance arrangements were not always designed to address.

India's constitutional commitment to privacy, particularly as recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India, provides an essential foundation. Statutory powers may authorise particular forms of monitoring, but they must be exercised within the applicable constitutional and legal framework. The central principle is straightforward: a legitimate security objective does not automatically justify every surveillance method.

A democratic state should be able to explain not only why it needs to monitor, but also whom it monitors, what it collects, how it uses information and what prevents the power from being abused. The right to privacy is not a demand that government remain blind to genuine threats. It is a demand that the power to observe remain governed by law.

The defining question of the AI age is not whether technology will make mass surveillance possible. It already has. The question is whether constitutional democracies will establish meaningful legal boundaries before the ability to watch becomes an unchecked power to know, classify and control.

The right to privacy must evolve alongside the technology that threatens it. In a democracy, the ultimate measure of surveillance is not how much the state can see, but how effectively the law ensures that it does not see beyond its legitimate authority.

Legal and editorial note: This article is intended for legal information and public-policy discussion, not as advice on the facts of any individual case. The application of surveillance and data protection laws depends on the particular facts, governing statutory provisions and their commencement status. Legal developments should be checked before relying on this analysis for litigation or formal legal advice.