#Parliament Was Told an Order Governs Police Facial Recognition. The Order Is Now Public, and It Never Mentions Faces.

When the Rajya Sabha asked the Ministry of Home Affairs what approvals and safeguards apply to police facial recognition in Delhi, the Ministry answered with a document number. On 2 October 2026 that document was published in full for the first time, and across all 36 pages it does not contain the word "face".

The Internet Freedom Foundation obtained Standing Order No. Tech. & PI/04/2022 under the Right to Information Act and released the complete text. It is the only instrument the Union government has ever named to Parliament as the governing framework for facial recognition by the Delhi Police. Reading it settles a question that two courts, one parliamentary answer and three years of reporting had left open: there is no authorisation document, because the document that was supposed to be the authorisation is about something else.

#What was published on 2 October

The order is titled "Integrated Command, Control, Coordination and Communication (C4i) System". It is dated 9 June 2022 and signed by Rakesh Asthana, then Commissioner of Police, Delhi.

What it regulates is a control room. It sets out emergency call-handling procedure for console operators on the 112 line, with voice recording and GPS tracking of callers. It lists the CCTV feeds piped into the command centre — roughly a thousand cameras as of June 2022 — and names the sites, among them Jantar Mantar and Ramlila Ground, the capital's two sanctioned protest venues. It covers "digital/virtual patrolling" for traffic jams, stray cattle, "suspicious persons" and "unruly crowds". It records 204 automatic number plate recognition cameras across 35 sites. It describes the C4i itself as a proposed facility under the Safe City project; the command centre it anticipated was eventually inaugurated on 16 February 2026 at a reported cost of ₹857 crore, nearly four years later.

What it does not contain is the point. In IFF's words, "the words 'facial recognition' do not appear anywhere in it. The same is true of the words 'face', 'biometric', 'database', 'watchlist', 'threshold', 'retention', 'deletion', 'privacy' and 'audit'." The only recognition technology the order names is number plate recognition — machines reading licence plates, not faces.

There is also a smaller, telling detail about how the document reached the public. The Police Headquarters told IFF the order was already available on the Delhi Police website. It was not there, and IFF could not locate it. The public information officer replied on 17 September 2026 — the thirtieth day — offering a photocopy for ₹72. IFF received it on 23 September and published it nine days later.

#The gap between the parliamentary answer and the police facial recognition on the ground

On 6 August 2025, answering Unstarred Question No. 1996 in the Rajya Sabha, Minister of State for Home Affairs Nityanand Rai confirmed that the Safe City project includes a "Facial Recognition System on identified cameras to watch suspected persons and criminals". Asked what approvals and safeguards govern it, the answer pointed to "Standing Order No. Tech. & PI/04/2022 dated 09.06.2022".

That answer created a reasonable impression — that somewhere in the system sits an instrument setting out who may be scanned, against which database, at what match threshold, with what logging, and for how long the resulting data is kept. The order now in the public domain answers none of those questions because it never asks them.

The surrounding numbers do not reconcile either. Delhi Police put the match threshold at 80 per cent similarity in a 2022 response; reporting in 2026 on the AjnaLens smart spectacles describes a 60 per cent threshold, and no authority has confirmed which applies to which system. Figures for the size of the face database reported between 2019 and 2026 range from 20,000 to 3,50,000, with no official explanation of whether these are different databases or different counting methods. Delhi Police's own August 2026 affidavit states that its facial recognition system identified 2,873 persons with criminal antecedents at the protest site between 20 and 26 July — a scale of matching that no published instrument authorises.

Nor is the statutory basis any clearer. The photographs underpinning the system were originally held under the Identification of Prisoners Act, 1920, which has since been repealed. The affidavit refers to a database called "Crime Kundli" for which no statutory basis has been disclosed at all. The Criminal Procedure (Identification) Act, 2022 permits collection of measurements from people arrested, convicted or detained. It confers no power to scan the faces of people standing in a lawful assembly.

This is precisely the question now before the Supreme Court in A.A. Rahim M.P. v. Union of India (Diary No. 45049/2026), which a Bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana agreed on 13 August to hear alongside the other petitions arising from the July protests. K.S. Puttaswamy requires any intrusion into privacy to clear three hurdles, and the first is legality: there must be a law. An internal police standing order that binds nobody outside the force was always a weak candidate. A standing order that does not mention the activity is not a candidate at all.

#Fifty-three replies, 161 answers, twelve that contained information

The second half of IFF's disclosure is about the process, and it is the part Indian compliance teams should read most closely, because it is a case study in what an accountability record looks like when nobody has to keep one.

IFF filed five RTI applications from 24 July 2026 covering facial recognition, AI video analytics, drones, the Ikshana command vehicle, AjnaLens wearables and the C4i centre. Each was dispersed to roughly fifteen offices. By 2 October, 53 replies had come back. IFF analysed 17 of those letters containing 161 individual answers:

• 95 answers (59 per cent) said the question "does not pertain" to that office.
• 35 answers (22 per cent) said the information was nil, not available, or not on record.
• 15 declined without citing any exemption under the RTI Act.
• 4 redirected to another office.
• 12 contained actual information or documents.

Nothing was disclosed on contracts, tenders or vendor data-handling terms. Nothing on match thresholds or accuracy audits. Nothing on retention periods. No privacy impact assessment was produced, because, on the record available, none was carried out. One district treated a request for drone deployment logbooks as "a query" rather than information under Section 2(f) — despite the standard operating procedure requiring operators to log the time, area and purpose of every flight. Replies arrived between day 57 and day 66 against a 30-day statutory limit.

IFF has said it will file first appeals under Section 19(1) within 30 days of each reply, and second appeals before the Central Information Commission under Section 19(3) where those fail, asking the Commission to use its Section 19(8)(a) power to direct publication of the surveillance standing orders and SOPs, and to impose Section 20 penalties for unjustified refusals.

#Why the DPDP Act does not close the police facial recognition gap

The instinctive reading — India now has a data protection law, so this is covered — is wrong in both directions.

Section 17(1)(c) of the DPDP Act, 2023 lifts the Act's core obligations for processing in the interests of prevention, detection, investigation or prosecution of offences. Section 17(2)(a) goes further and lets the Central Government exempt any notified "instrumentality of the State" from substantially the whole Act, on grounds including sovereignty, security of the State and public order. There is no judicial authorisation requirement, no sunset, and no independent oversight attached to that power.

The second direction matters just as much. For the obligations that do bite, the clock has not run out. The Act commenced on 13 November 2025. Consent Manager registration under Rule 4 switches on 13 November 2026. The substantive duties on data fiduciaries — notice, purpose limitation, security safeguards, breach reporting, erasure — commence on 13 May 2027. And the Data Protection Board of India, legally constituted since November 2025, still has no appointed Chairperson and no Members; MeitY invited applications on 6 May 2026 and again on 6 June 2026, and no appointment notification has been published. A data principal scanned at Jantar Mantar has, on paper, a grievance route. In practice there is nobody to hear it.

#The Act also narrowed the only tool that surfaced any of this

Here is the part that deserves more attention than it gets. Every fact in the preceding sections exists in public because of the Right to Information Act — and Section 44(3) of the DPDP Act amended that statute.

Section 44(3) rewrote Section 8(1)(j) of the RTI Act to exempt "information which relates to personal information" outright, removing the balancing test that previously allowed disclosure where the information related to public activity or where the public interest justified it. Three constitutional challenges — by transparency activist Venkatesh Nayak, by The Reporters Collective and journalist Nitin Sethi, and by the National Campaign for People's Right to Information — were referred to a larger bench on 16 February 2026 by a Bench of CJI Surya Kant, Justice Joymalya Bagchi and Justice Vipul M. Pancholi, which declined to stay the amendment in the meantime. No bench has been constituted since.

The C4i standing order itself is not personal information, so Section 8(1)(j) was not the barrier here. But the asymmetry is now structural: a data protection statute that exempts state instrumentalities from its own obligations has simultaneously narrowed the transparency law that was doing the work of holding them to account. In this episode, "does not pertain to this office" did the blocking. The narrowed Section 8(1)(j) is the tool waiting for the next one.

#What this means for data fiduciaries, and it is not abstract

Strip out the policing and a familiar compliance failure is left: an organisation processing sensitive personal data at scale, pointing to a governing document that does not describe the processing.

That defence will not survive contact with the DPDP framework, and private companies have none of the state's exemptions. Section 17(2)(a) covers instrumentalities of the State. A vendor is not one because it sells to one. The surveillance contractors named as respondents in the Supreme Court petition — Aditya Infotech Ltd. for the command vehicle, Dimension NXG Pvt. Ltd. for AjnaLens — are data fiduciaries in their own right the moment they determine purposes and means of processing biometric data.

Three obligations make the record itself the compliance:

Rule 6 requires demonstrable safeguards, not stated ones. Encryption or masking, access control, continuous logging and monitoring, and backup and recovery, with logs and processing records retained for at least a year. A policy that never names the processing it governs produces no logs that map to it.

Rules 12 and 13 turn assessment into paperwork you must file. A Significant Data Fiduciary must run a Data Protection Impact Assessment every twelve months and an independent audit, with significant observations furnished to the Board. Volume, sensitivity and risk of harm to data principals are the Section 10 criteria for that designation — exactly the profile of anyone running live biometric identification at civic scale. No SDF has been notified yet, which is a timing fact, not a safety net.

Section 8(5) and Rule 7 make the breach the test of the record. When something goes wrong, the first question is what you were authorised to hold and for how long. "We had a standing order" is only an answer if the standing order says so.

The practical exercise is unglamorous and worth doing before 13 May 2027: take each processing activity, name the document that authorises it, and check that the document actually describes that activity. Organisations that run this audit tend to find at least one activity governed by a policy written for something adjacent. Our resources library sets out the Section 10 designation criteria and the Rule 6, 12 and 13 obligations that follow.

#The record is the regulation

The significance of 2 October is not that Delhi Police uses facial recognition — that has been known and officially confirmed for years. It is that the single document the Union government offered Parliament as proof of lawful authority turned out, when finally read, to govern a telephone console and a bank of number plate cameras.

That is what an accountability vacuum looks like from the inside: not a refusal, but a citation that nobody checked. The Supreme Court will decide the constitutional question in A.A. Rahim. Parliament has not yet enacted the biometric surveillance statute that would supply the legality limb Puttaswamy demands. The Data Protection Board has nobody sitting on it, seven weeks before it is meant to start registering Consent Managers.

For everyone else — the data fiduciaries who get no exemption and no delay beyond May 2027 — the lesson transfers cleanly. Under the DPDP Act, compliance is not what you intended, and it is not what your policy is called. It is what your documents say, what your logs show, and whether the two match when somebody finally reads them.

Sources: Internet Freedom Foundation — IFF makes public the Delhi Police Order cited for Facial Recognition as it continues evasion · LiveLaw — Supreme Court Agrees To Hear MP's Plea Against Police Use Of Facial Recognition & Biometric Surveillance Tools At Protest Sites · Bar and Bench — CPI(M) MP moves Supreme Court against use of facial recognition tech by police at Jantar Mantar protest site · LiveLaw — Supreme Court Refers Pleas Challenging DPDP Act Amendment To RTI Act To Larger Bench · LiveLaw — India's Data Protection Board: Established In Law, Absent In Fact · MeitY — Invitation of applications for Chairperson and Members, Data Protection Board of India · SFLC.in — DPDP Rules, 2025: Significant Data Fiduciaries and Data Transfers · Internet Freedom Foundation — IFF writes to the Commissioner of Police and files RTIs on live facial recognition at Jantar Mantar