Can Facial Recognition Be Used Without Consent?

Facial recognition technology (FRT) is increasingly being used for various purposes, including security surveillance, law enforcement, and customer identification. However, the use of this technology without an individual's consent raises significant concerns about privacy, personal freedoms, and the potential for abuse. In India, there is a growing need for legal frameworks to regulate its use and protect individuals’ rights. While facial recognition technology can offer benefits, its unchecked use without consent may violate the right to privacy, which is a fundamental right under Indian law.

Legal Position on the Use of Facial Recognition Without Consent in India:

Right to Privacy – Constitutional Framework:

The Right to Privacy was recognized as a fundamental right by the Supreme Court of India in the landmark Puttaswamy judgment (2017). This right protects individuals from unwarranted surveillance and intrusion into their personal life, including through the use of technologies like facial recognition.

Using facial recognition without the individual’s consent could potentially violate their right to privacy if the usage is deemed excessive, disproportionate, or without legal justification.

Information Technology Act, 2000 (IT Act):

While the IT Act does not specifically address facial recognition, certain provisions under it can apply when biometric data (like facial images) is collected or processed:

• Section 66E: This section penalizes the capturing or publishing of images of individuals in a private place without consent, which could extend to unauthorized facial recognition.
• Section 43A: It mandates that organizations handling sensitive personal data (including biometric data) must implement reasonable security practices to protect such data. Unauthorized or non-consensual use of facial recognition could result in legal consequences if data security is compromised.

Personal Data Protection Bill, 2019 (PDPB):

The Personal Data Protection Bill, 2019, currently in draft form, outlines the framework for the processing and protection of personal data in India. According to the bill:

• Consent is a central requirement before processing any personal data, including biometric data like facial images.
• Biometric data would be classified as sensitive personal data, which requires explicit consent from individuals for its collection, processing, and storage.

Non-compliance with these provisions could result in significant penalties, including fines, for organizations using facial recognition without obtaining proper consent.

Surveillance and Public Safety Laws:

Facial recognition technology is increasingly being used by law enforcement agencies for surveillance and criminal investigations. However, surveillance laws must be balanced with individuals' rights to privacy.

If facial recognition is used in public spaces without the consent of individuals, it could lead to concerns regarding excessive surveillance or mass data collection without justifiable cause.

In India, there are currently no comprehensive laws regulating mass surveillance using technologies like facial recognition, although several bills, including the National Intelligence Grid (NATGRID) and Interception Laws, may impact how such technologies are used.

Ethical Considerations and International Practices:

Internationally, countries like the European Union (under the General Data Protection Regulation - GDPR) have stricter rules governing facial recognition, including explicit consent for its use. The EU classifies facial recognition data as sensitive personal data, and its collection without consent is restricted.

Ethical concerns also arise around the potential for discrimination and bias in facial recognition systems, especially if used without proper oversight. Facial recognition systems have been shown to have higher error rates in identifying women, people of color, and individuals from marginalized communities.

State-Level and Industry-Specific Regulations:

Some state governments or local authorities in India may have implemented specific regulations regarding the use of facial recognition in public spaces, especially for security purposes like crowd control during events. However, these regulations often lack transparency and may not adequately protect privacy rights.

Private companies using facial recognition for commercial purposes, like customer identification or personalized marketing, may also face legal challenges if they use the technology without user consent.

Example:

If a private retail store uses facial recognition to track customer behavior without informing or obtaining consent from customers, it would be a violation of privacy laws under the Personal Data Protection Bill and IT Act. Customers may have the right to challenge this through consumer protection channels, demanding the cessation of the practice or compensation for unauthorized data collection.

Another example could be the use of facial recognition by law enforcement in public places for surveillance purposes. If this is done without clear legal justification or proper oversight, it may infringe upon citizens' right to privacy as protected by the Constitution.

Conclusion:

Facial recognition technology, when used without consent, raises serious legal and ethical concerns. In India, while the IT Act and PDPB provide some legal protections around data privacy and the use of biometric data, the overall regulatory framework for facial recognition remains underdeveloped. The growing use of this technology, especially in public spaces or by private entities, calls for clearer and more stringent regulations that safeguard privacy, ensure transparency, and protect individuals’ rights to consent. As India moves toward a more comprehensive data protection regime, it is likely that laws addressing facial recognition will evolve to better regulate its use.