Legal gaps in India’s unregulated AI surveillance

AI Surveillance in India

• The Indian government plans to create the world’s largest facial recognition system for policing.

• AI-powered surveillance systems are being deployed across railway stations and the Delhi Police are preparing to use AI for crime patrols.

• The latest plans include launching 50 AI-powered satellites, further intensifying India’s surveillance infrastructure.

Legal and Constitutional Concerns

• The use of AI for surveillance has global parallels, often resulting in “dragnet surveillance,” indiscriminate data collection beyond just suspects or criminals.

• Even well-intended surveillance laws can result in overreach, infringing on citizens’ rights.

Lack of Proportional Safeguards

• The Telangana Police data breach revealed deep-rooted concerns about the data collection practices of Indian law enforcement agencies.

• The Digital Personal Data Protection Act (DPDPA) passed in 2023 was meant to provide a framework for managing consent and ensuring accountability for data privacy in India.

• The law has been heavily criticised for broad exemptions that grant the government unchecked power to process personal data.

The Approach in the West

• The European Union (EU) has enacted regulations that could serve as a useful guide for India.

• The EU’s Articial Intelligence Act takes a risk-based approach to AI activities, categorising them into unacceptable, high, transparency, and minimal risk levels.

• India has begun deploying AI-powered facial recognition technology and CCTV surveillance in public spaces with little to no legislative debate or risk assessment.

Addressing the Impact on Civil Liberties

• A comprehensive regulatory framework that addresses AI’s implications for civil liberties is urgently needed.

• The framework must include provisions for transparent data collection practices, where it is publicly disclosed, what data is being collected, for what purpose, and how long it will be stored.

• To mitigate risks from AI-driven surveillance, regulating “high-risk activities” through restrictions on digital personal data processing and transparent auditor oversight of data sharing is crucial.