A Petition Born From a Legal Vacuum
On August 13, 2026, the Supreme Court of India agreed to examine a challenge to Delhi Police's use of live facial recognition and biometric tracking against protesters, tagging the matter with earlier related petitions before a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana (Biometric Update). The petition, filed by CPI(M) Rajya Sabha MP A.A. Rahim after the July 2026 NEET-UG paper-leak protests at Jantar Mantar, names a stack of surveillance tools deployed against demonstrators: the Ikshana command vehicle for real-time facial recognition, Dimension NXG's AjnaLens smart spectacles, the Abhigyan fingerprint-matching app, and facial-mapping infrastructure supplied by Aditya Infotech (The Week). The petitioner's central claim is not that any single deployment was abusive, but that none of it happened under any statute written for the purpose — it happened, as the filing puts it, in a legal vacuum, invoking the Criminal Procedure (Identification) Act 2022 and the Supreme Court's 2017 Puttaswamy privacy ruling as the only available yardsticks.
Delhi Police's defense, filed with the Court, is that the system only flagged people already in police records — history-sheeters, absconders, persons with prior serious-offence entries — and did not indiscriminately profile ordinary protesters. That may well be true as a matter of configuration. But it is also beside the point the petition is making: India has no statute that defines when live facial recognition may be pointed at a crowd, who authorizes it, how long a match is retained, or how someone wrongly flagged can contest it. The system's restraint, if real, is a policy choice by the deploying agency, not a legal constraint on it.
What Estonia Is Bound to Do Differently
That contrast is precisely what the EU's Artificial Intelligence Act was built to eliminate for its 27 member states, Estonia included. Article 5(1)(h) of Regulation (EU) 2024/1689 prohibits real-time remote biometric identification in publicly accessible spaces for law enforcement outright, subject to exactly three narrow carve-outs: searching for victims of trafficking or abduction, averting a specific and imminent threat to life, or locating a suspect in an offence carrying at least a four-year custodial sentence (EUR-Lex, Regulation 2024/1689). Even within those exceptions, deployment requires prior judicial or independent administrative authorization, a mandatory fundamental-rights impact assessment, registration in an EU database, and annual reporting to the Commission — with a 24-hour retroactive-authorization window for genuine emergencies only (EU AI Act Service Desk, European Commission). The prohibition has applied across the bloc, Estonia included, since February 2, 2025 (Artificial Intelligence Act explainer). An Estonian police force that wanted to run Delhi's exact Jantar Mantar deployment — scanning a protest crowd live, without a judge's sign-off, against watchlists of unspecified provenance — would simply be breaking the law before a single frame was matched.
Steelmanning the Indian Approach
The case for what Delhi Police is doing isn't frivolous. Protests at Jantar Mantar have, at times, been infiltrated by individuals with outstanding warrants or histories of orchestrated violence, and a facial-recognition system that flags only pre-existing criminal records is a materially narrower tool than a general dragnet — it is closer to running a watchlist than building a new one. A police force managing a large, fast-moving crowd also has a real operational argument for wanting real-time tools rather than after-the-fact identification from CCTV footage, which is slower and less useful for preventing a specific person from committing violence in the moment. Regulators who dismiss this as inherently illegitimate are ignoring that the EU AI Act's own model doesn't ban targeted biometric policing — it permits it, conditioned on independent sign-off and a four-year severity floor.
The Missing Floor, Not the Missing Ban
That conditionality is the entire point India lacks. The EU's answer to facial recognition at protests was never prohibition-in-principle; it is prohibition-by-default with a legislated, auditable exception. Delhi Police's insistence that its system "only flagged prior offenders" would be reassuring evidence in Estonia, submitted to a magistrate before deployment. In India, it is instead a post-hoc affidavit, offered after the fact to a court that has no statute to measure it against. The Digital Personal Data Protection Act 2023 remains largely unimplemented for law-enforcement contexts, and the 2022 identification law governs measurements taken from arrestees, not live scans of a public assembly.
A pro-innovation position does not require treating Estonia's regime as an obstacle to policing capability — it requires recognizing that a published, judicially-supervised threshold is what lets a facial-recognition vendor sell into government procurement without every deployment becoming a fresh constitutional emergency. India's Supreme Court now has the opportunity Parliament has not taken: to require that biometric surveillance of assemblies clear a specific severity bar, get independent authorization, and carry a deletion mechanism for people wrongly matched — not to ban the Ikshana vehicle, but to give it the same legal floor Estonia's police already stand on.