Adoption of AI Facial Recognition Technology: Challenges to Indian Legal Regime during Pandemic

I. Introduction

In today's digital infrastructure we have to interact with an increasing number of systems, both in the physical and the virtual worlds. Due to the outbreak of coronavirus, there is enhanced interaction in virtual worlds endangering an individual’s security. This increased interaction has led to shift in the usage of technologies. For example, from use of fingerprints to AI-based Facial Recognition Technology (hereinafter referred as “FRT”) for various purposes and means.

Biometrics, is defined as the automated recognition of humans based on biological or behavioural characteristics³. Biometric Recognition cannot be forgotten or misplaced because of the physiological or behavioural characteristics⁴. In government initiatives such as border protection and government-to-citizen services, along with consumer-facing applications in the health care and finance industries, biometrics are being widely used. Biometric technologies offer reliable and efficient recognition that is necessary as our real and virtual worlds are further enmeshed. As our real and virtual worlds are further enmeshed, biometric technologies deliver accurate and efficient identification that is essential.

As very said, technology is dynamic in nature and keeps evolving thereby posing many challenges. In lines of same, even the Facial Recognition adoption was indeed costlier as the usage of the same was not in demand because of other biometric identification techniques. Due to the situation posed by the occurrence of pandemic, the said technology has gained huge potential and the cost is going down dramatically⁵.

Facial scan biometrics is an automated way of identifying a person by their distinct individual facial features⁶. Face recognition being one of the kinds of biometric recognition has several advantages over other biometric identification techniques, such as fingerprint and iris scans – “besides being natural and nonintrusive, the most important advantage of face is that it can be captured at a distance and in a covert manner”⁷.

Recently, facial scans have become a growing concern in India as they are used to detect and identify someone as a potential threat. This is not, however, their only function; for many different purposes, they are used to classify and verify people. Facial scans are done via many different techniques, and involve advanced software to analyse and break down specific details and features of each face⁸.This is also, however, the precise explanation why biometric data, in general, and facial data, in particular, pose special and far-reaching privacy challenges for individuals and communities. Thus, it can be stated that along with knowledge and possession-based methods, biometric technologies also have their weaknesses.

With the increased acceptance, there is a rise in the standards expected from AI based FRT. Biometrics is not a silver bullet; it cannot provide 100% security, nor can it provide a reliable solution for every problem⁹. Thus, the Paper in the forthcoming chapters will elaborate on the Challenges put forth by this technology to the law enforcement agencies.

II. Core functions of frts: business and government agencies

The hit of Covid-19 has led to more reliance on usage of technology mainly from the health point of view. Apart from the security concerns that might bother the companies, the Covid-19 pandemic has enabled many business organisations to still maintain their productivity without face-to-face meetings leading to a greater work-at home flexibility. The reason for the same is adoption of enhanced technology and thus there is a creation of environment wherein employees work remotely from home. A study in the New England Journal of Medicine found that Covid-19 can live two to three days on plastic and stainless steel¹⁰. Paying systems, self-service kiosks and secured physical spaces also require authentication, and this allows us to connect with something we know, like a pin or something that we have, as an access card. Biometrics, like voice and face, are a contactless way to confirm the identification of an individual¹¹. This technology will contribute to existing environment by preventing the risks of viruses across corporate offices, hospitals, airports and other safe locations, which often rely on fingerprint readers, card access and manual identification checks. The digital transformation not only helps the business and consumers to accept the reality put forth by covid-19 but also prepares to equip them to the usage of the future digital transformations, flexibility and growth. As there is more consciousness developed, there is an increase in concern for privacy and security.

FRT has been used in a wide variety of contexts. The tasks that are intended to be performed by this technology is one easy way of laying classifications of the usage functions of the said technology.

The FRTs, firstly has a key feature to use the face of a person as a basis to authenticate his identity; it is a person that really appears to be and/or that tests if he or she has the right to access those systems. To better explain this feature, the instance of Unique Identification Authority of India (UIDAI) can be taken into consideration. The UIDAI announced to use FRT as the method of authentication under the Aadhar Act. In addition to this, mandatory imposition was done on telecom service by UIDAI to use the said technology for authentication of their subscribers. But all the aforesaid mandatory imposition of usage of facial recognition technology by government was not allowed by the subsequent verdict delivered in Puttaswamy case¹². Under this case, distinction was drawn between the use of Aadhaar authentication for the delivery of government welfare benefits and other purposes such as KYC verifications.

Secondly, the AI FRT helps in performing the functions of security and surveillance which refers to increased security coverage including the functions of face identification to check whether a person is an authorised user for a specific purpose. For example, the verification of passengers and immigration checks at airports. Also, recently, the Indian government has approved the use of Automated Facial Recognition System (AFRS) wherein the facial biometrics can be extracted from video and CCTV which will be matched with the image of individuals whose photos and identity information are already being saved in a database maintained by the National Crime Records Bureau (NCRB) under the purview of the Minister of State for Home Affairs (MHA)¹³.

Thirdly, in India, for the law enforcement, the said technology has been adopted. For example, CCTV footage. Here Cameras are placed in the midst of a crime scene and are regularly checked to identify and trace the movements of the suspect. Also, the traffic violations can be found out by placing the cameras at traffic signals. Other applications reported in the field may include the search for missing persons, the monitoring of trafficking in human beings and the identification of the use of false ID documents¹⁴. Fourthly, for increase of business competence like for instance, ability of retail and hospitality sectors to identify their customers or dynamically generating services and content suited for their profiles¹⁵.

Apart from the aforementioned usages and core functions of FRT, there lies another major usage. i.e use of Attendance Systems. The said technology is used for taking attendance of employees in companies and also of students in schools. For example, Delhi’s Indian Institute of Technology has a home-grown solution called Timble that is used to mark student attendance¹⁶. Proposals are also underway to roll out similar systems to mark the attendance of young school going students in Tamil Nadu’s government schools¹⁷ and for all government teachers in the State of Gujarat¹⁸.

There are many instances of FRTs being implemented in India by private and government organisations. To note, mainly in India, the implementation of the said technology is done in absence of strong data protection law. Thus, apart from the technological advantages, it is imperative to strike a balance between the benefits and concerns posed simultaneously with the usage of the said technology.

III. Legal regime of frts in india

The speedy development of FRT without proper legal basis or frameworks poses numerous challenges. It can be the lack of transparency in facial recognition systems; their consequences for privacy and civil liberties; and evidence of bias and prejudice in their findings. Although all these issues hold true for the Government as well as private entities' regarding the use of FRT, the disparity of power between the individual and the state and the possible effects of the misuse of that power makes this an alarming issue in the context of the use of law enforcement.

Indian laws do not explicitly recognise the implementation of FRTs. It’s the need of the hour for India to have a comprehensive law passed by the Parliament of India authorizing the implementation of the said technology. At present, in India there is no law which specifically deals with the deployment of these technologies¹⁹. The Information Technology Act, 2000 and its allied rules are completely silent on this aspect. This lacuna has an adverse effect on the governance and privacy. To note, there is no specific law dealing with data and privacy itself²⁰. Amidst such lack of legal backup, the implantation of the FRTs will be a major challenge for Indian legal regime. In this chapter, the Paper shall put forth the current legal scenario pertaining to the FRT in India.

(A) Facial Recognition and the Data Protection Bill, 2019

The Personal Data Protection Bill, 2019 (hereinafter referred as “PDP Bill”) mainly applies to processing of personal data of natural persons, of which sensitive personal data and critical personal data are subsets²¹. The PDP Bill, when enacted, will replace Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 which currently, in tandem with sectoral laws, provide for the data protection framework in India²². The passing of this bill has the ability of creating an impact on the usage of the said technology by the Government as well as Private entities.

Section 3 (7) of the PDP Bill defines “Biometric Data” as "biometric data" means facial images, fingerprints, iris scans, or any other similar personal data resulting from measurements or technical processing operations carried out on physical, physiological, or behavioural characteristics of a data principal, which allow or confirm the unique identification of that natural person”. Thus, facial images form a part of biometric data. Further, Section 3 (36) of the said Bill categorizes 'biometric data' as 'sensitive personal data'. The Bill classifies the data into three categories namely critical, sensitive and general. Section 33 of the PDP Bill imposes a prohibition on processing sensitive personal data and critical personal data outside of India. Section 33 specifies that sensitive personal data may be transferred outside of India but must continue to be stored in India. In effect, a local copy of all sensitive personal data must remain within India at all times. But the said transfer of 'sensitive personal data' shall be subject to conditions laid out in Clause 34 of the Bill which therein outlines the circumstances in which sensitive personal data and critical personal data may be transferred outside of India. Thus, in the future if the said bill is being passed by the Parliament of India, both the Government and private entities must comply with the legal framework set out under the Act. To note, the bill lacks clarity in certain aspects of Data processing thereby staking individuals privacy which shall be addressed in Chapter IV of this Paper.

(B) Analysis of FRTs via Puttaswamy Judgement

In India, the State’s interference in Citizen’s privacy by means of any action put forth have to pass the tests laid down by the Supreme Court in the case of K.S. Puttaswamy v. Union of India²³. The said case, affirms that privacy is a fundamental right of the citizen under Indian Constitution. The application of the aforesaid test was subsequent seen in the decision of Aadhaar Case. Moreover, there are a range of cases which are currently pending before the Supreme Court to the Constitutional validity of the surveillance architecture in India. Therefore, the way in which Courts in future will examine the validity of a mechanism like the proposed face recognition system of the NCRB is very likely to be affected in these relevant contexts by the application of the Puttaswamy tests²⁴. The Supreme Court stated that although Right to Privacy is not explicitly recognised under our Constitution, it is one of the facets of Article 21 of Indian Constitution and also satisfies the golden triangle requirement laid down under Maneka Gandhi Case²⁵ i.e Right to equality (Article 14), Right to free speech and Expression (Article 19) and Right to life and personal Liberty (Article 21). Thus, State’s intervention in citizen’s privacy must be fair, just and reasonable.

The judges then went on to explain what it would mean to be fair, just and reasonable in the context of privacy, laying down the following tests: (i) legality – the intervention should be supported by a law; (ii) legitimate goal – it should pursue a legitimate state aim; and (iii) proportionality – there should be a rational nexus between the objects and the means adopted to achieve them. Further, it was also observed that there is a need of an appropriate procedural guarantee to check against the abuse of State power²⁶.

Thus, when the Supreme Court has created a path for the State to intervene in citizen’s privacy subject to the conditions aforementioned, the implementation of the FRTs should be in parlance with the same. India being a democratic country, the ultimate objective of the State should become citizens welfare. Therfore any welfare measure brought through the usage of technology must not impinge on fundamental rights guaranteed by the Constitution. Thereby, balancing between these interest poses a real challenge to Indian Legal regime.

IV. Major concern and its suggestive measure

The increased use of FRTs ignites many controversial issues. Right to privacy forms a major issue, thereby becoming a hurdle in successful regulation of FRT. The right to privacy is a Fundamental Human Right as described in Article 12 of the Universal Declaration of Human Rights.²⁷ Thus, Privacy becomes a major aspect in striking the balance of power between citizens and the Government or an individual and large business companies. A citizen’s right to freedom of speech, freedom of religion, freedom of movement-all these are determined by privacy. The right to privacy has been significantly undermined in recent years by emerging technologies which are continuously threatening it.²⁸ For instance, the use of CCTV cameras involving the FRTs involves constant tracing of a person which is in fact an infringement of an individual’s privacy. Also, the use of surveillance technology coupled with FRTs raises a concern in a situation such as an individual using face cover in a mass protest.²⁹

In the United States, privacy has not been explicitly recognized, but several legal experts recognise that fundamental right to privacy exist amongst the Amendments.³⁰ In the US, Cities and States have been pioneers in governing facial recognition in the absence of any national legislation or policy.³¹ The two states that have settled laws which concentrate on restricting the use of biometrics, are Texas and Illinois. Laws relating to the use of technology for facial recognition are not limited to the public sector. Several States have integrated biometric data into their current data privacy laws or have developed new laws expressly geared towards collecting biometric data.³² The first State to tackle the processing of biometric data from private firms was Illinois. The Biometric Information Privacy Act (BIPA) 2008, puts major restrictions on how a person's biometric data can be obtained and used by private entities. The said Act forbids the use of biometric data, places a limitation on disclosing collected data, defines business data privacy obligations and provides write-up actions for individuals whose information has been collected or used in violation of law. This Statute benefits an individual in a situation wherein he/she is unable to prove that any violation in respect of collection or usage of data has directly affected him/her.

Texas laws provides the destruction of data after one year and prohibits the sale of biometric information and places restrictions on the way information must be stored. Other States such as Washington, California have also provided law in this regard.³³ Washington State law requires businesses, in limited conditions, to sell biometric information whereas Californian laws recognises the rights of the consumers by allowing them to obtain information about the collection and the sale of their personal information and by allowing consumers to opt out of the sale of their personal information.

Unlike the US, the right to privacy in India is not explicitly recognized by the Constitution, but it forms a facet of life and personal liberty which is enshrined under Article 21 of the Indian Constitution. However, it is enunciated that it has no active data privacy framework. In the absence of a legal framework, an ideal decision was taken to set up a Committee which was led by Justice BN Srikrishna and thereby the bill called “The Personal Data Protection Bill, 2019” becomes highly significant. Even though the said bill lays down the framework for regulation of data processing, the bill lacks clarity on the aspect of restrictions being placed on private entities in processing biometric Data. Section 92 of the Bill states that “No data fiduciary shall process such biometric data as may be notified by the Central Government, unless such processing is permitted by law”. As per the Section 3(13) of the Bill, Data Fiduciary includes company and as per aforementioned provision, there is lack of clarity on restrictions placed on Companies unlike Biometric Information Privacy Act in Illinos. Also, Section 35 provides Government agencies a wide power with respect to processing citizens’ personal data. It is suggested that when the law provides such a wide power to the Government on one hand, it becomes crucial on the other hand to provide wider law facilitating the citizens their right to get information about processing of their data by the Government.

V. Conclusion

With further advancements in the technology and the discovery of newer use-cases, the adoption of FRTs can only be expected to rise further. At the same time, increasing adoption will also exacerbate many of the concerns. The challenge therefore lies in being able to assess the tradeoffs between the drawbacks and advantages of adopting FRTs in different contexts. This sort of thinking is necessary for assessing whether, and under what circumstances, should this technology be adopted.

Thus, to conclude, it can be seen that, the outbreak of Coronavirus has intensively led to rise in the usage of FRTs. And this usage will not merely stop at this phase. Technology is dynamic in nature and will keep evolving and gradually becomes part of a human life. In such a situation forecasting the technological future, it is necessary that the legal protection accord to the citizen of the country must also be developed. The Draft PDP bill along with suitable amendments must be strictly enforced to prevent any infringement on citizens Privacy as the said aspect is recognised as fundamental right. Thus, the state must ensure that the core values of democratic country is being preserved in presence of robust framework meant to tackle the challenges put forth by FRTs in present and future.

*****