Policy | India is ill-prepared to use facial recognition sans a legal framework

Representative Image

India wants to use facial recognition technology as part of a plan to modernise its police force. On June 28, the National Criminal Records Bureau (NCRB) released a tender for an Automated Facial Recognition System. The aim is to use facial recognition as a tool for information gathering, criminal identification and for verification purposes.

Facial recognition is not a new technology. Conceptualised in the 1960s, it only became popular in past few years, especially after handheld device-makers started marketing it.

These days, to unlock most handheld devices, one does not need to key-in passwords or draw a pattern. Just look at the device to unlock it. While this has made things easier, the use of facial recognition is not limited to this. In the past few years it has become so popular that it is now being used by airport authorities, shopping centres and even law enforcement agencies across developed nations.

However, consider this. A couple of years ago when Apple was launching the first iPhone with facial recognition for unlocking the device, it did not work! That too during the considered-to-be-perfect Apple launch event.

The technology has improved since then but it is still far from being foolproof. There are glitches in the tech and those who use it are bound to make mistakes. Now, what happens when mistakes are made by the law enforcement agencies using this technology: what if they round up the wrong person to be a criminal? That’s scary. Above that, what is the guarantee that law enforcement agencies will not abuse this technology?

China has reportedly been building its own surveillance system using facial recognition and artificial intelligence (AI). This was later used in segregation of ethnic groups. What are the safeguards in place to ensure that such abuse of facial recognition will not happen in India?

As per the tender document, the system will help law enforcement agencies recognise individuals from digital sources, including CCTV footages and newspaper images, by creating a bank of images for future reference. Now, in the most likely scenario, the government is not going to seek permission from each individual for storing her pictures. How lawful is that? Besides this, isn’t it a threat to privacy (which is a fundamental right) if the law enforcement agencies and other government wings spy on individuals? Above all this, what about the danger of such a repository of data being hacked, by an individual for commercial interests or, worse, by an foreign state or non-state actor? This blurs the fine line between security and disaster.

This is not to say that the use of facial recognition is without its merits — it’s just that at the moment the risks outweigh the benefits. The biggest threat is that there is no law that regulates use of facial recognition. Before such a legislation, it must be understood that India is yet to finalise the legal framework for data protection. The proposed Personal Data Protection Bill, 2018, is silent about the rules related to the use of facial recognition and storage of data gathered through it.

The Bill, submitted by the Justice BN Srikrishna committee to the government on July 27, 2018, prescribes how organisations should collect, process and store data of Indian citizens. It is yet to be formalised.

The truth is India is ill-prepared to use facial recognition as a technology. The government should prohibit the use of facial recognition in any form until it formalises a law to govern it, securing personal data of its citizens and ensuring their privacy.