Context

• India is entering an era in which surveillance is no longer confined to the State.
• Facial recognition, biometric databases, private technology companies, social-media networks, deepfakes and electoral verification increasingly interact to determine how citizens are identified, monitored and treated.
• Recent controversies involving deepfakes and doxxing, facial recognition during protests and electoral-roll revision reveal a common challenge: personal information now moves across governments, corporations, digital platforms and anonymous actors, while legal safeguards remain fragmented.

Forms of Surveillance

• State Surveillance in Public Spaces
  • Facial recognition, drones, AI-enabled devices and command vehicles can identify individuals rapidly.
  • Allegations surrounding surveillance during protests have raised questions about biometric data collection, private-company involvement and the limits of police surveillance.
• Digital Identification and Punishment
  • Protest participants have reportedly faced doxxing, with personal information circulated alongside threats.
  • Unlike physical hoardings used in the past, digital platforms can amplify personal information instantly and globally.
  • A photograph can become a gateway to identity, location and personal vulnerability.
• Administrative Surveillance Through Identity Verification
  • Electoral-roll revision requires authorities to determine who qualifies to remain registered.
  • Although the Supreme Court has recognised the Election Commission's authority to examine citizenship for this limited purpose, large-scale verification can nevertheless affect democratic participation and access to voting rights.

Privacy in the Age of Interconnected Surveillance

• India has a strong constitutional foundation for privacy.
• In K. S. Puttaswamy v. Union of India (2017), a nine-judge Supreme Court Bench recognised privacy as a constitutionally protected right.
• However, the framework largely developed around state action, whereas today's digital environment involves multiple public and private actors.
• The Digital Personal Data Protection Act, 2023 permits the Union government to exempt state instrumentalities from its provisions through notification on specified grounds, including security of the State and public order.
• This creates questions about the consistency of privacy protection across different surveillance activities.
• Personal information may be collected by government agencies, processed by private contractors, stored by technology companies and circulated through online networks.
• Consequently, the chain of responsibility becomes difficult to identify, weakening accountability.

The Pegasus Question and Accountability

• The Pegasus controversy demonstrates the difficulties created by cross-border and privately supplied surveillance technologies.
• A Supreme Court-appointed technical committee found malware in some examined devices but could not conclusively establish that it was Pegasus. It also noted the Union government's lack of cooperation.
• The larger issue extends beyond one spyware controversy. When governments rely on private or foreign technology providers, accountability can become fragmented.
• If police collect data, a private company stores it and online actors disseminate related information, responsibility cannot remain legally undefined.

A Long History of Making People Identifiable

• The impulse to make populations identifiable predates the digital age.
• In 1858, William Herschel began using handprints on contracts, while fingerprint classification was later developed in Bengal.
• What has changed is the scale, speed, precision and interconnectedness of identification.
• Aadhaar, facial recognition, electoral databases and social-media platforms represent different forms of converting individual identity into continuously processable data.

From Isolated Surveillance to a Surveillance Ecosystem

• Modern surveillance should therefore be understood as an interconnected ecosystem rather than isolated acts.
• Governments possess regulatory and coercive authority; private companies provide technological infrastructure; social-media platforms enable amplification; and administrative databases influence access to civic rights.
• A citizen may be identified by a camera, linked to personal information, exposed online and subsequently threatened.
• Thus, privacy cannot be protected merely by regulating individual technologies.
• The entire data chain, from collection and storage to processing, sharing and dissemination, requires accountability.

The Way Forward

• India needs a comprehensive surveillance framework based on clear legal authority, necessity and proportionality.
• Citizens should have meaningful information about how their data is collected, processed and shared.
• Private companies handling sensitive or state-generated information should face clear obligations concerning data security, retention and access.
• Independent oversight should also be strengthened to ensure that surveillance powers remain subject to scrutiny.
• Electoral and identity-verification processes require transparent criteria, accessible remedies and safeguards against wrongful exclusion.
• Technological efficiency cannot substitute for procedural fairness.

Conclusion

• India's surveillance challenge is no longer simply about whether the State can watch citizens.
• It concerns how information moves between the State, corporations, digital platforms and individuals, and how these systems can reinforce one another.
• Constitutional privacy protection remains essential, but technological change requires a broader approach to accountability.
• Greater technological capacity to identify citizens must be matched by equally strong safeguards for dignity, autonomy, security and democratic participation.
• Otherwise, legal protection may remain strongest where surveillance is simplest, while complex forms of watching continue to operate in institutional gaps.