Facial Recognition Technology Gaining Foothold in India

New Delhi — Facial recognition technology already has a foot in the door in India, but concerns over privacy and potential surveillance use have come along with it.

In October, the national education board rolled out a facial recognition feature on its website that allows students to access and download certificates using facial recognition technology. The application captures the live photograph of the student and matches it with the photograph already stored in the repository during the issuance of admit cards for yearly exams. Upon a successful match, the certificate is emailed to the student.

Other uses for facial recognition technologies are in play at the transport department of the southern state of Telangana, which allows users to get a duplicate license and other documents through its T App Folio introduced in July in the midst of the pandemic.

“With positive responses from users, the service seems to be doing pretty well,” said C. Ramesh, Telangana’s junior transport commissioner. “We have planned to bring in 11 more services that will be accessible to the public soon.”

The facial data collected by the department was shared with the state police on a few occasions, Ramesh said, but no other government department.

The state’s election commission used the technology for local elections in January.

“This technology is proposed as an additional tool to validate the identity of the voter in addition to the existing procedure,” the Telangana State Election Commission wrote in its circular.

“The system’s deep learning and artificial intelligence methods verify the voter’s picture taken by the polling officer with records in the server, all in real-time,” said Vishnu Prasad, joint director of the State Election Commission. “The system recorded a success rate of 83 percent. The application couldn’t verify pictures taken in poor light or long shots.

“We have erased all the pictures clicked during the polls from our server,” Prasad said.

Facial recognition technology also is a popular tool for law enforcement and security.

Police in Madurai, in the southern state of Tamil Nadu, started using facial recognition app FaceTagr in October to identify “suspicious” people.

In the tech hub of Bengaluru, South Western Railway started using facial recognition technology in February “to check the entrance of criminals and trace missing children.”

The national government used facial recognition technology to identify 1,922 protesters during rallies against the controversial Citizenship (Amendment) Act, 2019 in New Delhi and other parts of the country in February. India’s Home Minister Amit Shah presented the data to the Rajya Sabha, the upper House of parliament.

“Use of facial recognition against individuals protesting against the actions of the government sets a chilling precedent and also threatens the fundamental rights as guaranteed by the Constitution to each citizen including the right to freedom of expression,” the Internet Freedom Foundation, an Indian digital rights advocacy group, posted on its site.

Two laws in India govern the use of biometric data, including photos: the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.

“The relevant provisions of biometric data protection in the IT Act and the Rules apply only to corporate bodies and not to the government,” said Vijay Pal Dalmia, a senior lawyer at the Delhi High Court with expertise in intellectual property, information technology, and cyber law. Given the absence of a separate law for data protection, the automated facial recognition system would have to meet the threshold set in the right to privacy judgment in the K. S. Puttaswamy case.”

The Justice K. S. Puttaswamy v. the Union of India is a landmark case decided in August 2017, in which the Supreme Court upheld the right to privacy as protected and guaranteed under the Constitution. In an associated decision in September 2018, the court confirmed the validity of the Aadhaar Act, which collects minimal biometric data but does not expose information collected in the authentication process to the internet.

The Aadhaar Act, 2016, which has raised privacy concerns, was approved by the government for targeted delivery of subsidies, benefits and services to citizens through a system that requires the collection of biometric data.

A bill introduced in parliament last year, the Personal Data Protection Bill 2019, “will help us gain clarity on the efficient handling of biometric data,” said Dalmia, senior lawyer at the Delhi High Court.

The bill aims to “protect personal data of individuals, establishes a Data Protection Authority for the same, and governs the processing of personal data by government and private companies — both Indian and foreign.”

“The Bill categorizes certain personal data as sensitive personal data.  This includes financial data, biometric data, caste, religious or political beliefs, or any other category of data specified by the government, in consultation with the Authority and the concerned sectoral regulator,” the draft proposal states.

Meanwhile, several organizations are pushing ahead with the use of facial recognition technology.

The National Crime Records Bureau has been working on the Automated Facial Recognition System for a year and is looking for vendors who can provide technology that can identify faces with masks.

“Facial recognition on masked faces will only compound the problems of accuracy that already exist in facial-recognition systems,” said Smriti Parsheera, a lawyer and policy researcher with the National Institute of Public Finance and Policy in New Delhi. “The likelihood of false positives and false negatives will therefore increase with accompanying negative consequences for the individuals who are being subjected to these systems.”

A study by the National Institute of Standards and Technology at the U.S. Department of Commerce found that even the best of the 89 commercial facial recognition algorithms tested had error rates between 5 percent and 50 percent in matching digitally applied face masks with photos of the same person without a mask.

(Edited by Siddharthya Roy and Judith Isacoff. Map and graph by Urvashi Makwana.)