Legal Gaps in India’s Unregulated AI surveillance

The evolving use of AI in surveillance highlights that there need to consider legal frameworks, gaps, and concerns surrounding it in India and how they intersect with constitutional rights, particularly the right to privacy.

Table of Contents

Use AI Surveillance in India

In 2019, the Indian government announced plans to create the world’s largest facial recognition system for policing.
AI-powered surveillance systems are in use at railway stations.
The Delhi Police is preparing to use AI for crime patrols.
Plans include launching 50 AI-powered satellites to enhance India’s surveillance infrastructure.

What are the issues associated with AI Surveillance In India?

Privacy Infringement: AI surveillance systems can lead to dragnet surveillance, a term that refers to indiscriminate data collection beyond just suspects or criminals, infringing on citizens’ right to privacy (Article 21).
- Example: Hyderabad police accessed the databases from social welfare schemes like “Samagra Vedika.”
Lack of Proportional Safeguards: Existing safeguards are insufficient to prevent misuse of AI-driven surveillance.
- The promised Digital India Act (for regulating AI) has yet to materialize.
Exemptions in the Digital Personal Data Protection Act (DPDPA), 2023: Section 7(g) waives consent requirements for processing medical data during epidemics, while Section 7(i) exempts government from consent for employment-related data processing.
- These exemptions raise concerns about misuse, especially regarding AI surveillance technologies that rely on vast amounts of personal data.
- Citizens face increased scrutiny under DPDPA provisions like Section 15(c), which mandates that individuals must not suppress any material information when submitting personal data.
Lack of Transparency and Accountability: Absence of publicly available guidelines on how data is collected, processed, stored, and protected by law enforcement agencies.
- No independent oversight to prevent potential misuse of AI technologies.
Risk of Discrimination and Bias: AI surveillance systems can perpetuate algorithmic biases and lead to unfair targeting of certain communities.
- These biases can violate the principles of equality and non-discrimination.
Data Security Concerns: High risk of data breaches and misuse due to inadequate cybersecurity infrastructure.
- Example: The Telangana Police data breach exposed vulnerabilities in law enforcement data management.
Civil Liberties Erosion: Unchecked surveillance threatens fundamental rights such as freedom of expression, association, and movement.
- Excessive surveillance may create a chilling effect on democratic participation.

Global Comparisons and Best Practices

European Union (EU) – Artificial Intelligence Act

Risk-Based Approach: Categorizes AI activities into unacceptable, high, transparency, and minimal risk.
Unacceptable Risk: Prohibits real-time remote biometric identification, except for narrowly defined exceptions (e.g., searching for victims of serious crimes).
Transparency and Accountability: Requires clear documentation and disclosure of AI system operations.
- Mandates regular audits and risk assessments for high-risk AI applications.

United States – Section 702 of FISA

Oversight Mechanisms: Surveillance programs are subject to review by the Foreign Intelligence Surveillance Court (FISC).
- However, the program has faced criticism for overreach and inadequate safeguards.

United Kingdom – Surveillance Camera Code of Practice

Principles-Based Regulation: Surveillance activities must be justified, proportionate, and transparent.
- Requires law enforcement agencies to follow a code of conduct for deploying CCTV and facial recognition technology.

Proposed Reforms for AI Surveillance in India

Comprehensive Regulatory Framework: Enact a robust legal framework to regulate AI-driven surveillance with clear guidelines on data collection, processing, storage, and deletion.
- Ensure alignment with the principles of necessity, legitimacy, and proportionality.
Transparency and Oversight Mechanisms: Mandate public disclosure of:
- What data is being collected.
- The purpose of collection.
- Duration of data retention.
Establish independent judicial oversight to review and approve surveillance activities.

Strict Consent Requirements: Narrow and specific exemptions for consent under the DPDPA, ensuring they are not overly broad or ambiguous.
- Implement transparent consent-gathering practices with proper safeguards.
Risk-Based Regulation: Adopt a risk-based approach to categorize AI activities (similar to the EU model)
Data Protection and Security: Strengthen cybersecurity infrastructure to prevent data breaches.
- Introduce penalties for unauthorized access or misuse of personal data by law enforcement agencies.
Algorithmic Fairness and Bias Mitigation: Conduct regular audits of AI systems to identify and mitigate biases.
- Ensure AI algorithms used in surveillance are transparent and explainable.
Judicial Oversight and Redressal Mechanisms: Implement judicial review for AI surveillance operations.
- Create mechanisms for citizens to challenge surveillance practices and seek redressal for violations.