ON MARCH 28, 2026, the Union government announced that the Centre for Development of Telematics (‘C-DOT’) would deploy facial recognition and other policing technologies for Delhi Police. The system would support crowd monitoring and identity verification during deployments for maintaining law-and-order; photographs would be matched against available databases to identify suspects, missing persons and repeat offenders. The announcement says what the systems can do, but not who may place a person on a watchlist, what matching threshold applies, how a false match may be challenged, or which law authorises each use. A press release may announce capacity; it cannot supply the authority or safeguards required for coercive use, which must remain subject to rigorous constitutional oversight.
The constitutional problem is deeper than data collection, storage or use per se. A photograph becomes a query; the query produces a candidate; the candidate so produced can shape law enforcement action against actual people. A combination of databases can reveal facts no source itself discloses, while an algorithm can turn those inferences into suspicion at a very large scale. Moreover, surveillance is largely treated as a relation of power, and aggregation and secondary use as distinct privacy harms. The injury lies in the State’s new capacity to classify and act.
India’s emerging regulatory architecture risks treating procurement, general policing duties, soft AI policy and statutory exemptions as though, together, they supplied legal authority. That is a category error. An exemption is a negative rule: it disapplies specified duties under a particular enactment. Authorisation is positive: it identifies who may exercise an intrusive power, against whom, for what purpose, on what conditions and subject to what remedy. Where State action intrudes upon rights, competence cannot be inferred merely from the absence of a prohibition.
