India's Evolving Privacy Battles Beyond Surveillance
How facial recognition, electoral rolls and doxxing converge in India's privacy crisis
1Three-layered surveillance architecture
India's privacy challenges extend beyond facial recognition to include electoral roll verification (SIR) and online doxxing. The Supreme Court's 2026 PIL disposal on deepfakes and the upheld SIR process demonstrate systemic monitoring. Delhi Police's use of AI glasses and private firm data hosting during CJP protests reveals public-private surveillance partnerships. These systems disproportionately impact minorities, migrants and marginalized groups through identification mechanisms that determine voting rights and personal safety.
2Legal protections with loopholes
While Puttaswamy judgment (2017) established constitutional privacy rights, the 2023 Data Protection Act allows government exemptions for state security. The Pegasus spyware case showed enforcement gaps when the government withheld cooperation from investigations. Current laws fail to address data flows between police and private companies, creating accountability voids when protesters face identification, doxxing and threats through interconnected systems.
3Historical surveillance continuum
India's identification systems predate Aadhaar by 150+ years, beginning with British magistrate William Herschel's 1858 handprint documentation. The technological evolution from fingerprint classification to facial recognition reflects persistent state impulses for population tracking. Contemporary systems like electoral roll verification (7.89 crore to 7.42 crore in Bihar) continue colonial-era practices of bureaucratic population control through identification.
4Doxxing as digital punishment
CJP protest participants faced online harassment with personal details and threats published - mirroring UP's 2020 public shaming of CAA protesters through roadside hoardings. The Allahabad HC's privacy ruling against such displays becomes irrelevant in digital era when photos and addresses spread within hours. This creates new vulnerabilities particularly for women activists and marginalized groups participating in protests.
5Electoral exclusion mechanisms
The Supreme Court-approved SIR process removed 47 lakh voters in Bihar alone during 2026 revisions. While courts permit citizenship verification for electoral purposes, the scale creates exclusion risks. The technical process of voter list purification becomes another surveillance layer determining political participation rights, disproportionately affecting mobile populations and documentation-scarce communities.
6Private sector enablers
Two unnamed private firms hosted facial recognition data from Delhi Police's Jantar Mantar surveillance during CJP protests. This reflects growing reliance on commercial providers for state surveillance infrastructure. The 2023 Data Protection Act's exemption clauses enable such partnerships while avoiding accountability for cross-sector data flows between government and corporate entities.
7Enforcement reality gap
Pegasus investigations revealed systemic enforcement challenges when the government withheld cooperation from court-appointed committees. The 2025 Supreme Court decision to keep parts of the malware report confidential demonstrates how privacy protections erode in security contexts. Legal wins like Puttaswamy remain theoretical when facing rapidly evolving surveillance technologies and bureaucratic resistance.
8Need for holistic framework
Current privacy debates fail to address interconnected systems linking state cameras, private data processors, social media networks and bureaucratic databases. The 2026 cases demonstrate how surveillance now operates through diffuse networks rather than discrete state actions. Effective protection requires rethinking privacy beyond individual violations to encompass systemic data flows across multiple actors with competing interests and jurisdictions.