Surveillance is not the only privacy issue

1. At a Glance

• Core argument: privacy debates in India focus too narrowly on state surveillance. Harm to privacy now comes from three directions working together: the State, private firms and online networks, with citizens caught between them [1].
• The article links three separate 2026 stories: a Supreme Court PIL on doxxing and deepfakes, a petition against police facial recognition at protests, and the SC upholding the Special Intensive Revision (SIR) of electoral rolls [1].
• Two questions it raises: (a) who is responsible when a protester is identified by a camera, doxxed by anonymous accounts and then threatened at home; (b) which safeguard applies when data gathered by the police is held by a private company [1].
• UPSC relevance: it tests whether you can connect Article 21 privacy, data protection law, AI and facial recognition technology, online gendered harm, and electoral inclusion. This is typical GS-II and GS-IV material.

2. Why in the News

• May 2026: the SC upheld the Election Commission's SIR of electoral rolls. Critics had warned it could exclude a large number of eligible voters [1].
• July 2026: A.A. Rahim, a Rajya Sabha member, petitioned the SC against the Delhi Police's use of facial recognition and biometric surveillance during the Cockroach Janta Party (CJP) protests [1].
• August 2026: the SC disposed of a PIL on doxxing and deepfakes and asked the Union Ministries to take remedial measures [1].
• 30 September 2026: Op-ed by Pankhuri Agarwal (King's Business School, King's College London), The Hindu, p. 11 [1].

3. Background & Evolution

• 2017: in K.S. Puttaswamy v. Union of India, a 9-judge bench held privacy to be a fundamental right under Article 21 and laid down a proportionality test (legality, legitimate aim, proportionality, procedural safeguards) [BK — verify].
• 2000: the Information Technology Act is the base law for cyber offences and intermediary liability [BK — verify].
• 2021: the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules were notified. They set out grievance and takedown duties for platforms [BK — verify].
• 2023: the Digital Personal Data Protection (DPDP) Act was enacted. It creates the Data Protection Board of India and has broad exemptions for State instrumentalities [BK — verify].
• 2026: the three cases described in the article (SIR, CJP facial recognition petition, doxxing and deepfake PIL) show the gaps that remain [1].

4. Core Static Facts

5. Multi-Dimensional Analysis

Legal / Constitutional

• When the police collect data and private firms host it, it is unclear which safeguards and liabilities apply [1].
• Facial recognition at protests raises proportionality questions under the Puttaswamy test and may chill the right to peaceful assembly [BK — verify].
• A PIL "disposed" with directions leaves the fix to the executive rather than creating an enforceable remedy [1].

Social / Gender

• Women who took part in the CJP protests were later targeted online, with their personal details published. This is a gendered privacy harm [1].
• Mass revision of electoral rolls risks excluding eligible voters [1]. The poor and migrants are generally the most exposed to documentation-based exclusion [BK — verify].

Scientific / Technological

• The tools involved are AI-enabled smart glasses, drones and mobile command units, meaning biometric identification that moves with the police [1].
• Deepfakes and doxxing let harm to privacy spread without any action by the State [1].

Ethical / Governance

• When the State, a vendor and anonymous online accounts are all involved, accountability is spread out and no single party answers for the harm [1].
• Transparency questions: which vendors host the data, how long they keep it, and who can access it [1].

Administrative

• The SC sent the doxxing and deepfake issue back to the Union Ministries instead of framing binding guidelines [1].

6. Recent Developments (last 12–18 months)

• May 2026: SC upholds the EC's SIR of electoral rolls [1].
• July 2026: A.A. Rahim's petition against the Delhi Police's use of facial recognition and biometric surveillance at the CJP protests, Jantar Mantar [1].
• July–Aug 2026: women protesters are doxxed and targeted online [1].
• August 2026: SC disposes of the doxxing and deepfake PIL and directs remedial measures by Union Ministries [1].
• Nov 2025: DPDP Rules notified [BK — verify].

7. Prelims Hooks

• The PIL on doxxing and deepfakes was disposed of by the SC in August 2026, with a direction to Union Ministries [1].
• The petition against the Delhi Police's facial recognition use was filed by A.A. Rahim, a Rajya Sabha MP, in July 2026 [1].
• The protests in question were the Cockroach Janta Party (CJP) protests at Jantar Mantar, Delhi [1].
• Tools alleged: facial recognition, AI smart glasses, drones, mobile command vehicle [1].
• The surveillance data was allegedly hosted by two private firms [1].
• The SIR of electoral rolls was conducted by the Election Commission and upheld by the SC in May 2026 [1].
• Doxxing means publishing personal details online without consent [1].
• Privacy was declared a fundamental right in Puttaswamy (2017) by a 9-judge bench [BK — verify].
• DPDP Act, 2023: the adjudicating body is the Data Protection Board of India, not a court or regulator such as TRAI [BK — verify].
• The nodal ministry for the DPDP and IT Acts is MeitY, not MHA [BK — verify].

8. Why the Protester Cannot Use the Data Law Against the Police

• The DPDP law switches off most citizen rights when police say 'crime'
• Under the Digital Personal Data Protection (DPDP) law, the rights of the data principal (the person the data is about) do not apply when data is processed to prevent or investigate offences [2].
• The duties of the data fiduciary (the body that decides why and how data is used) are also switched off in these cases. Only the duty to keep data secure stays [2].

• So a protester scanned at Jantar Mantar has no clear legal route under this law to ask what was collected, how long it will be kept, or to have it deleted [1][2].

• The government can also exempt whole agencies

• The Centre can exempt a government agency from the law on grounds such as security of the State and public order [2].

• Policing a protest is usually justified as 'public order'. So the same ground that is used to put up the cameras can also be used to take them outside the law.

• This is why the article's question about private firms has no easy answer

• The data was allegedly hosted by two private firms [1]. If the police work is exempt, the protester has no clear claim against the firm either, because the firm is only handling the data for the police.
• PRS has warned that these exemptions may allow State data processing with no checks, and may let data be collected and kept for longer than needed [2]. Neither risk goes away when a private vendor holds the data.

9. Who Answers When the Harm Passes From Camera to Crowd

• One harm, three different legal doors
• The article describes a chain of events: a camera identifies a protester, anonymous accounts doxx her, and she is then threatened at home [1].
• Each link in that chain falls under a different body of law. Police surveillance is a constitutional question under Article 21. Hosting by a vendor comes under data protection law. Doxxing by online accounts comes under platform and criminal law.

• The victim has to knock on three doors. Each actor can point to one of the others.

• The court passed the problem back to the executive

• The SC disposed of the doxxing and deepfake PIL by asking Union Ministries to act [1]. It set no binding standard and no deadline.

• The Ministries it relied on are the same executive that controls the DPDP exemptions [2]. The body being asked to fix the gap is also the one that benefits from it.

• Why women bear more of the cost

• Women who joined the CJP protests were later targeted online, with their personal details published [1].
• Being identified at a protest carries a higher social cost for women, such as threats at home. So the same camera creates unequal risk. The unequal risk is itself a reason to stay away from protests.

10. The Case for Cameras at Protests — and Where It Stops

• The strongest argument for the police
• Protests happen in public, where anyone can see your face. Police have a legitimate duty to keep public order and to identify people who commit violence.

• Facial recognition technology (FRT, software that matches a face to a stored record) can do this faster than officers watching video by hand. Clean data systems also serve the public. The SC itself upheld the SIR, which aimed to clean electoral rolls [1].

• What this argument gets right

• Identifying a specific person suspected of a specific crime is a legitimate aim. The Puttaswamy test (see note, section 3) accepts that privacy can be limited for a legitimate aim.

• Where it stops

• The tools alleged here are drones, AI smart glasses and a mobile command vehicle [1]. They scan everyone present, not just a suspect. That fails the 'necessity' step of the proportionality test: a narrower tool was available.
• NITI Aayog's own paper on FRT warns that State use can threaten free speech by reducing anonymity in public spaces [3]. So the government's own think tank does not treat 'it happened in public' as the end of the privacy question.
• Being seen by a crowd is not the same as being permanently identified, recorded and stored by the State through a private vendor. The public-place argument covers the first, not the second.

11. What Should Change, and Who Should Do It

• Parliament should narrow the DPDP exemption for policing
• The present law turns off citizen rights for any processing linked to offences [2].

• The exemption could instead require limits on how long data is kept, and a written reason for each use. This answers PRS's warning about data being kept for longer than needed [2].

• MHA and State police should adopt NITI Aayog's FRT framework before using FRT at protests

• NITI Aayog's 2022 paper on facial recognition, prepared with the Vidhi Centre for Legal Policy, sets out recommendations for using FRT responsibly [3].

• It treats facial data as a data protection and privacy question from the start [3]. Police use at protests has so far gone ahead without any such public framework [1].

• Police should publish who holds the data

• The names of the two firms, their contract terms and their access rules were not publicly known; the petition only alleges them [1].

• Making vendor contracts public would let courts and citizens check who is responsible for the data.

• The SC should keep the doxxing issue open, not close it

• Instead of disposing of a PIL with a request to Ministries [1], the court can keep the case listed and ask for compliance reports. That keeps the executive answerable to the court.

12. Anchors for Answers

• Report/Committee: NITI Aayog, Responsible AI for All: A use case approach on Facial Recognition Technology (Nov 2022, with Vidhi Centre for Legal Policy): warns that State use of FRT can reduce public anonymity and chill free speech [3]
• Law/Case: DPDP Act, 2023: citizen rights and fiduciary duties (except data security) are switched off for prevention and investigation of offences, and the Centre can exempt agencies on public-order grounds [2]; K.S. Puttaswamy (2017) proportionality test (note, section 3)
• Law/Case: SC disposal of the doxxing and deepfake PIL (Aug 2026) with a request to Union Ministries: an example of the court passing a remedy to the executive [1]

13. Mains Relevance

• GS-II: Fundamental rights (Art. 21, 19); the judiciary; the role of statutory and constitutional bodies such as the EC; government policies on the digital domain.
• GS-III: Security challenges and cybersecurity; the role of media and social networking in internal security; AI and other emerging technology.
• GS-IV: Ethics of surveillance; accountability in public–private partnerships; probity in the use of data.
• Question stems: 1. "Privacy harms in India today arise less from the State alone than from the interplay of the State, private vendors and online networks." Critically examine. (15 marks) 2. Examine the constitutional and legal issues arising from police use of facial recognition technology at public protests. Suggest safeguards. (10 marks) 3. Doxxing and deepfakes represent a gendered threat to digital citizenship. Discuss the adequacy of India's legal framework. (15 marks)

14. Related Topics to Study Next

• Puttaswamy judgments (2017, 2018 Aadhaar): the proportionality test for any data collection by the State.
• DPDP Act 2023 & Rules: exemptions for the State and duties of data processors, e.g. private hosting firms.
• IT Rules 2021 / Sahyog portal / Sec. 79 IT Act: platform liability for doxxing and deepfakes.
• Facial recognition systems (NAFRID, DigiYatra, state police): how widely facial recognition is deployed and on what legal basis.
• Right to peaceful assembly (Art. 19(1)(b)) and reasonable restrictions: the chilling effect of surveillance on protest.
• SIR and electoral roll revision (Art. 324–326, RP Act 1950): data-driven exclusion from voting.
• Online gender-based violence: relevant provisions of the BNS and IT Act.

15. Common Errors / Trap Areas

• Treating privacy as only about surveillance. The article's central point is that doxxing by private actors and exclusion through administrative data are separate privacy harms [1].
• Confusing "disposed of" with "decided on merits." The August 2026 doxxing PIL was disposed of with a direction to ministries, not settled by a binding judgment [1].
• Misattributing the petitioner. A.A. Rahim is a Rajya Sabha member, not a Lok Sabha member [1].
• Nodal body: data protection sits with MeitY and the Data Protection Board, not the MHA or the EC [BK — verify].
• SIR outcome: the SC upheld it in May 2026; it did not strike it down [1].