Privacy and data-protection concerns arising from large-scale ANPR deployment on national highways.

Automatic Number Plate Recognition (ANPR) is a computer-vision system that photographs and reads vehicle plates. Its pairing with FASTag in NHAI's Multi-Lane Free Flow (MLFF) tolling — launched at Daulatpura on the Delhi–Jaipur NH-48 [1] — makes tolling seamless, but converts highways into a continuous surveillance grid, demanding careful safeguards rather than rejection.

Nature of the privacy concern

• Location tracking: gantries at every plaza generate timestamped travel logs; aggregated across a corridor these reveal movement patterns, associations and routines — the "mosaic effect".
• Mass, non-consensual capture: unlike a toll booth transaction, ANPR photographs every passing vehicle, including those of non-defaulters, without individual consent [2].
• Function creep: data collected for fee recovery can be repurposed for policing, insurance profiling or commercial analytics absent an explicit purpose-limitation bar.

Data-protection gaps

• No ETC-specific rules: tolling rests on the National Highways Fee (Determination of Rates and Collection) Rules, 2008, which predate digital imaging and prescribe no retention limits or access protocols.
• The DPDP Act, 2023 applies only generally [3]; broad state-exemption provisions and a yet-maturing Data Protection Board weaken enforcement over highway data.
• Multi-party data flows: linkage across VAHAN, FASTag wallets, banks and private concessionaires multiplies breach points and blurs accountability for a leak.
• Due-process risk: E-Notices issued on misread plates — payable within 72 hours [1] — can penalise the wrong owner, with no clear appeal route.

Balancing test Under K.S. Puttaswamy (2017) [4], any privacy intrusion must satisfy legality, legitimate aim, necessity and proportionality; efficient toll recovery is legitimate, but blanket indefinite retention is not proportionate.

MLFF's gains — lower congestion, fuel use and emissions [2] — are real and should not be surrendered. The way forward is privacy-by-design: statutory retention caps with automatic deletion of non-defaulter images, encryption and audit trails, purpose limitation notified under the DPDP framework, and a grievance mechanism for misreads. Technology that serves the citizen must also protect the citizen's dignity under Article 21.