Biometric technology—fingerprints, facial recognition, iris scans, and even DNA—is rapidly becoming the backbone of modern governance, security, and identity verification. Governments across the world are increasingly relying on biometric systems for immigration control, law enforcement, welfare delivery, and national security. However, this expansion has triggered serious legal and ethical concerns about privacy, surveillance, data protection, and fundamental rights.
A recent expert panel featuring privacy lawyers and policymakers from the United States, Mexico, and Argentina highlighted these tensions and the evolving legal frameworks governing biometric data. Their insights offer a valuable lens through which to assess India’s own biometric regime, particularly in light of Aadhaar, digital identity systems, and emerging surveillance technologies.
The United States: Fragmented Laws but Strong Constitutional Safeguards
Unlike the European Union or India, the U.S. does not have a single, comprehensive federal biometric privacy law. Instead, regulation exists at two levels:
State-Level Protection
Nineteen U.S. states have consumer privacy laws treating biometric data as “sensitive personal data.” In addition, states like Illinois, Texas, and Washington have specific biometric laws requiring:
- Informed consent before collection
- Clear retention and deletion policies
- Limited use of biometric data
- Private right of action (allowing individuals to sue for violations)
These laws have led to significant litigation against companies misusing biometric data.
Federal Framework and Law Enforcement
At the federal level, protection comes mainly from the Fourth Amendment of the U.S. Constitution, which prohibits unreasonable searches and seizures. This means law enforcement generally requires a warrant based on probable cause to access biometric data from private companies.
Post-9/11, the U.S. government expanded biometric use in:
- Airport security (TSA)
- Border control (CBP)
- Immigration and visa processing
- Facial recognition databases
A key safeguard is that facial recognition cannot be the sole basis for arrest or enforcement action—human review is required.
Comparison with India
India’s biometric landscape is far more centralized due to Aadhaar, the world’s largest biometric identity system.
Key Legal Frameworks in India
- Supreme Court Puttaswamy Judgment (2017)
- Declared privacy a fundamental right under Article 21 of the Constitution.
- Any biometric data collection must meet the tests of:
- Legality
- Necessity
- Proportionality
- Aadhaar Act, 2016
- Allows collection of fingerprints and iris scans for identity verification.
- Originally mandated for many services but later restricted after Supreme Court rulings.
- Limited government access to Aadhaar data, but concerns remain about surveillance risks.
- Digital Personal Data Protection (DPDP) Act, 2023
- Recognizes biometric data as “sensitive personal data.”
- Requires consent, purpose limitation, and data minimization.
- However, provides broad exemptions for government agencies on grounds of national security and law enforcement—raising accountability concerns.
- The Criminal Procedure (Identification) Act, 2022
- Allows police to collect fingerprints, footprints, iris scans, and even behavioral samples from arrested persons and convicts.
- Data is stored in a central database managed by the National Crime Records Bureau (NCRB).
- Unlike the U.S., there is no requirement for a warrant before collection—raising serious civil liberties concerns.
- Facial Recognition in India
- Delhi Police has used facial recognition technology in public spaces.
- There is no clear statutory framework or judicial oversight, unlike Argentina’s requirement for a privacy impact assessment.
Mexico: A New National Biometric Identity System and Rising Risks
Mexico is rolling out a centralized biometric identity platform combining:
- Fingerprints
- Iris scans
- Facial images
While the goal is improved security and governance, privacy experts warn that:
- The database could become a “honeypot” for hackers.
- Lack of an independent data protection authority increases risks.
- There must be strict purpose limitation to prevent misuse.
Argentina: Courts Actively Protect Privacy
Argentina offers one of the strongest judicial responses to biometric surveillance.
The Buenos Aires Facial Recognition Case
Buenos Aires deployed facial recognition cameras in subways and public spaces to match faces against criminal databases. However, an NGO challenged the system in court.
The appellate court ruled:
- The system violated privacy and data protection rights.
- It lacked a proper Data Protection Impact Assessment (DPIA).
- There was a risk of false positives and discrimination.
- The program was suspended until stronger safeguards were implemented.
This case established that:
- Public biometric systems must follow strict privacy principles.
- Courts can intervene to protect citizens from surveillance overreach.
What India Can Learn from Global Practices
India stands at a crossroads. While it has advanced digital infrastructure, its legal safeguards for biometric data remain inconsistent.
Lessons for India
- Mandatory Privacy Impact Assessments (DPIAs) India should require DPIAs before deploying facial recognition or biometric surveillance, similar to Argentina.
- Stronger Judicial Oversight Courts must actively scrutinize biometric programs rather than deferring to executive power.
- Independent Data Protection Authority India needs a truly independent regulator—unlike Mexico’s executive-controlled authority.
- Clear Limits on Police Access Unlike the U.S., Indian police currently have broad powers under the Identification of Prisoners Act. Warrants should be required for biometric data access.
- Ban or Strict Limits on Public Facial Recognition Like the EU’s approach, India should consider restrictions or moratoriums on real-time facial recognition in public spaces.
Conclusion
Biometrics offer undeniable benefits in security, governance, and identity management. However, without robust legal safeguards, they risk transforming democracies into surveillance states.
While the U.S. relies on constitutional protections, Argentina demonstrates the power of judicial oversight, and Mexico highlights the dangers of centralized databases without independent regulation. India, with its massive Aadhaar system and growing facial recognition use, must strengthen its privacy framework to ensure that technological progress does not come at the cost of fundamental rights.
A balanced, rights-respecting approach—rooted in necessity, proportionality, transparency, and accountability—is the only sustainable path forward.
