On 2 October 2026 the Internet Freedom Foundation (IFF) published Delhi Police Standing Order No. Tech. & PI/04/2022, the 36-page order, dated 9 June 2022, that the government had pointed to as the basis for the capital's facial recognition system. IFF says the order is titled "Integrated Command, Control, Coordination and Communication (C4I) System" and makes no mention of facial recognition, biometrics, databases, retention or deletion. The only recognition technology its text search found was Automatic Number Plate Recognition.
That matters because of what the system did next. In an affidavit filed on 17 August, Delhi Police told the Supreme Court that its facial recognition system identified 2,873 people with criminal antecedents at the Jantar Mantar protest site between 20 and 26 July. A system that scans a crowd exercising a constitutional right needs a clear legal footing. On the evidence published so far, it does not have one.
The strongest case for the police
The argument for the system deserves a fair statement. Protest sites in a capital city can attract people wanted for serious offences, and police have a legitimate interest in locating absconders. Matching faces against existing records is faster than manual checks, and a match is only a lead. Delhi Police have said a flag is not a final basis for action and that identifications would go through field verification. Used narrowly, with human review, the technology can be a proportionate tool.
The problem is not that police use new tools. It is that nobody can say what rules govern this one.
What the paper trail shows
IFF reviewed 17 RTI reply letters containing 161 answers to individual questions. In 95 of those answers (59%), the office concerned said the question did not pertain to it. A further 35 (22%) said the information was nil, unavailable or not on record. Police Headquarters supplied the C4i order on 23 September, yet a separate reply dated the same day said that no such standing order or circular was available on the point asked.
The data side is no firmer. IFF reports that Delhi Police said in 2022 that reference photographs were held under the Identification of Prisoners Act, 1920, a law since repealed. It also reports that the August 2026 affidavit instead refers to a database called "Crime Kundli". The replacement statute, the Criminal Procedure (Identification) Act, 2022, replaced the 1920 law. PRS Legislative Research describes it as covering fingerprints, iris and retina scans, and behavioural attributes, with records kept for 75 years. IFF argues that it confers no power to scan the faces of people in a crowd. That reading is persuasive. The Act deals with measurements taken from convicted or arrested people and others a Magistrate orders, not live matching of bystanders. IFF also reports that the 2022 replies disclosed no privacy impact assessment had been carried out.
Why this fails the constitutional test
India's Supreme Court has already set the standard. In the Aadhaar judgment, the five-judge bench restated the three-part test from the nine-judge privacy ruling of 2017. An intrusion must be sanctioned by law, necessary in a democratic society for a legitimate aim, and proportionate to the need. Delhi's system stumbles at the first step. An internal standing order that does not mention the technology, and that police offices could not locate when asked, is a poor candidate for "law."
Proportionality is also hard to show with these numbers. IFF notes that the Supreme Court quashed the protest FIRs on 1 September, which left police free to register fresh ones against the 2,873 people on the list. It also cites an Indian Express investigation finding that at least 25 of those flagged were in jail at the time. A list that includes people who could not have been at the protest raises obvious accuracy questions. Those questions cannot be answered when error rates, thresholds and retention periods are unpublished.
The chilling effect is the larger cost. People who know a camera may match their face to a criminal database will think twice before joining a lawful assembly. The risk is sharpest when the watchers' own records are opaque. The same week-by-week pattern shows in other enforcement. EFF reported that on 3 November Delhi Police takedown requests targeted 42 URLs notified to SFLC.in, a group that documents online censorship. Scrutiny of state technology is being met with pressure rather than answers.
A proportionate path
Banning every use of facial recognition is not the only answer, and this publication does not favour reflexive bans on new technology. The workable alternative is straightforward, and none of it needs new legislation to begin:
- Publish the rules. Release the governing standing orders and SOPs, including match thresholds and human-review steps.
- Do an impact assessment first. Complete and publish a privacy impact assessment before any further deployment.
- Keep it off peaceful assemblies. Until a statute authorises it, do not run live matching on lawful protests.
- Set limits and audit. Define what databases may be used, how long match results are kept, and who audits error rates.
- Answer RTI requests properly. Replies saying a question "does not pertain" to the office in 59% of answers are not a compliance record.
Good policing and civil liberties are not opposed here. A system with published rules, tested accuracy and a legal basis would be more useful to investigators and harder to challenge in court. The Supreme Court will now have to decide how far secrecy can substitute for statute. Until Delhi Police can point to a document that actually authorises face-matching of crowds, the 2,873 list is an administrative assertion and not a lawful finding.