This document summarizes rights related to facial recognition software and data protection laws. It discusses how facial recognition data is considered sensitive personal data under Indian law. It also outlines the right to privacy under the Indian Constitution and key related legislations in India like the IT Act, Consumer Protection Act, and pending Personal Data Protection Bill. Additionally, it reviews positions on facial recognition data in other regions like the EU, California, and under the US Biometric Information Privacy Act.

1. Know Your Rights-
Protection against Facial
Recognition Software

2. Parties Who Might Have Interests In Your
Facial Recognition Data
Governments and law enforcement agencies
Manufacturers and service providers.

3. Can Facial Recognition Data be Identified as
‘Sensitive Personal Data’?
Under the Information Technology (Reasonable Security
Practices and Procedures and Sensitive Personal Data or
Information) Rules, 2011, personal data is any
information about a natural person that can be used
directly or indirectly to identify such a person. Thus,
according to the definition, facial recognition data can be
classified as sensitive personal data.

4. Right to Privacy
Article 21
Article 21 not only protects citizens against deprivation of life and personal liberty, but it
also grants the ‘Right to Privacy’.
Article 21 should be read with Article 14 when such laws are arbitrary and unreasonable
and it should be read with Article 19(1) when the law relates to subjects mentioned in
Article 19(2).
It was K.S Puttasawmy who stated that this ‘Right to Privacy’ consists of-
(i) Intrusion with an individual’s physical body
(ii) Informational privacy
(iii) Privacy of choice.

5. Legislations in India
The Indian Information Technology Act,
2000
Consumer Protection Act, 2019
The Personal Data Protection Bill, 2019

6. The Indian Information Technology Act, 2000
Section 43A – Compensation
Section 72A - Imprisonment or/and Fine

7. Consumer Protection Act, 2019
Section 47 (ix) of the Consumer Protection Act, 2019
(explanation) provides for relief to individuals who have had
their personal information misused. If such personal
information is released, then the producer shall be held for
product liability. They shall then be required to pay
compensation fixed by the tribunal. The 2019 Act also defines
"mental agony and emotional distress" as types of harm that
can be caused through the use of products.

8. The Personal Data Protection Bill, 2019
• In the judgment of Justice KS Puttaswamy Vs Union of India (2019), the bench set up a committee headed by Justice BN
Srikrishna that would set up proper legislation that would protect an individual’s data privacy. The result of a year’s long work
was The Personal Data Protection Bill, 2019 and is still yet to be approved by Parliament.
• The Bill seeks to regulate the processing of personal data by not only the government but by personal entities as well (for
example, companies, corporations, and firms). It takes inspiration from the European Union General Data Protection
Regulations.

9. Position in other Countries
California
European Union General Data Protection
Regulation
Biometric Privacy Act in the United States of
America

10. California
The state of California has passed a temporary three-year ban on the use of facial
recognition software by law enforcement agencies.
The bench states that through these softwares, police forces not only gain access to
our every move, but they also gain access to other private records like our finances,
hospital records and our education. Finding information of this depth would
previously require a search warrant and 6 months’ of investigation. Now such
information can be gleaned over with the use of a software.

11. European Union General Data Protection
Regulation
The EUGDPR is an extensive and exhaustive legal
framework that aims to protect an individual’s personal
data. It applies to corporations, regardless of their
location, dealing with information of citizens of the
EU. It was enacted on May 25th, 2018 and it replaced
the Protection Directive of 1995.

12. Biometric Privacy Act in the United States of
America
• Many states of the US have laws regarding the collection of biometric data. For example, The Biometric Information Privacy
Act is an Act passed in 2008 by the state of Illinois. It is a set of laws that make the collection, use, and storage of biometric
data without the consent of the user by private entities illegal. Another example is the state of Texas, which has established
and codified laws that handle the collection of biometric data. The state of Washington has also signed into law House Bill
1493 which sets requirements for businesses that collect and process data for commercial purposes.