Responsible AI for All: Adopting the Framework, A Use Case Approach on Facial Recognition Technology (NITI Aayog discussion paper, November 2022)

NITI Aayog's 2021 approach document on responsible AI (Part 1 of February 2021 and Part 2 of August 2021) set out seven principles but left their application to later work.⁷ The facial recognition paper states that the principles needed to be "tested out in a use case to determine the efficacy of the approach recommended and identify challenges thereon", and chooses FRT as "the first use case". It is the third paper in the series and was released as a "draft discussion paper" seeking public comments by 30 November 2022.¹

The choice of FRT reflects both its spread and its risks. The paper notes that India's major cities rank among the most surveilled in the world by CCTV density, that FRT is in use for policing in Punjab, Gujarat and Tamil Nadu, for admissions in Andhra Pradesh and Telangana and for attendance of municipal workers in Mumbai, and it lists examples in an annexure, among them the National Automated Facial Recognition System proposed by the National Crime Records Bureau.¹ The paper calls the Ministry of Civil Aviation's DigiYatra programme "an interesting use case" of how government can meet its stated aim of responsible deployment, and later cites the public disclosure of DigiYatra's policy as a positive example of transparency.¹

The paper was prepared with the Vidhi Centre for Legal Policy as knowledge partner, with inputs from the Ministries of Civil Aviation, Home Affairs and Electronics and IT, the Department of Science and Technology, the Office of the Principal Scientific Adviser and UIDAI.¹

Part I explains how FRT works (face detection, feature extraction and recognition against a gallery, in 1:1 verification or 1:n identification). It separates non-security uses, which usually rely on prior consent and 1:1 matching, from security uses, which involve 1:n matching against watchlists, do not rely on a registration-based consent, and, in the case of live FRT, compound the risks of inaccuracy and misidentification.¹ The paper sets out design-based risks (inaccuracy from technical factors, bias from under-representation, poorly trained human operators, adversarial tweaks, security breaches, unclear liability and opacity) and rights-based risks drawn from Puttaswamy, such as informational autonomy, the position of non-participants and anonymity in public spaces. It ends with a survey of regulation in the European Union, United Kingdom, United States, Australia and Canada.¹

Part II is the case study. It covers the DigiYatra programme, its benefits (less congestion, a 'seamless, paperless and contactless' experience and lower operating costs), its legal framework, and an evaluation against the seven principles, followed by actionable recommendations.¹

The introduction adds a framing statement: use of FRT should be with due consent and voluntary, and "at no time should FRT become mandatory". It should be limited to cases where public interest and constitutional morality are in step, and efficiency alone should not justify it.¹

DigiYatra is a biometric boarding system in which a passenger enrols in an app, creates a digital identity wallet on the phone using public-private key encryption, and is verified by facial matching at airport checkpoints. CISF personnel carry out the first-level check, passengers may opt for the normal manual process, and the paper says the scheme may be expanded to more airports "with necessary legal frameworks in place".¹³

Legal aspects. Because the DigiYatra Foundation is a company under the Companies Act, 2013, it is a 'body corporate' under the SPDI Rules, 2011, which treat biometric information as sensitive personal data. The policy envisages the Foundation obtaining an Authentication User Agency licence under the Aadhaar Act, 2016. If DigiYatra were ever made mandatory, the paper says it would have to meet the Puttaswamy tests of legality, necessity and proportionality.¹

Evaluation against the principles. The paper's table shows the following:¹³

DigiYatra's "value-added services", such as sharing data with cab operators, should be on an opt-in basis with revocable consent rather than opt-out, the paper says.¹

The paper groups its recommendations by audience.¹

Law and policy. India should establish a codified data protection regime, retaining the obligations, regulator, penalties and remedies of the withdrawn 2019 Personal Data Protection Bill and protecting individuals against state agencies including law enforcement, with sensitive biometric data covered. Any government FRT deployment should satisfy the three-pronged test of legality, reasonability and proportionality from Puttaswamy, together with its four proportionality identifiers: a legitimate goal, suitability, the least restrictive effective alternative, and no disproportionate impact on the right holder. Non-privacy risks such as bias and algorithmic accountability warrant separate regulation, by codes of practice, self-regulation or statute. Public FRT deployments should be disclosed, with an exemption for time-sensitive security surveillance. Ethics committees with autonomy should draft explainability guidelines, standards for dataset representativeness and acceptable error rates, oversee compliance with SOPs, define grievance structures and publish annual reports.

Developers and vendors. Systems should be 'self-explainable', 'meaningful' and accurate in their explanations (principles adapted from a NIST report on explainable AI), identifying for example which facial regions drove a match, using techniques such as LIME. They should have stated knowledge limits, so that no output is produced below a confidence threshold. Vendors should set up independent internal ethics committees, subject systems to periodic external audits, report accuracy by Indian face types, gender and age, build in human review, follow privacy by design, and never infer consent to biometric processing from conduct.

Procurement. Requests for proposals should state a problem rather than a specific solution and justify why AI is needed; carry out an initial risk and impact assessment; require continuous measurement and public disclosure of overall and demographic error rates; fix data-access terms before choosing a vendor; favour interoperable systems to avoid lock-in; and align with the 2018 strategy and the 2021 responsible-AI papers.

Affected individuals. Accessible grievance redress, possibly through an ombudsman that can escalate serious cases to a constitutional court, and feedback loops and surveys feeding periodic impact evaluations.

MediaNama's coverage summarised the paper's recommendations and DigiYatra analysis, and observed that FRT was spreading across government while India lacked a privacy-protection framework, and that it was unclear whether the recommendations would be reflected in DigiYatra's operation.²³

The Internet Freedom Foundation (IFF) filed comments, reported on 15 December 2022. It argued that the paper did not adequately address police surveillance, citing at least 29 ongoing police FRT projects and the NCRB's national system, and that the draft Digital Personal Data Protection Bill, 2022 would exempt law enforcement broadly. It said the paper mischaracterised explainability, ignored stochasticity and brittleness in machine learning, and omitted emotion recognition, which it called pseudoscientific. It recommended a blanket ban on law-enforcement FRT, a blanket ban on emotion recognition, a case-by-case framework for FRT in public spaces, and provisions against function creep.⁴

The Software Freedom Law Centre (SFLC) asked for 'informed explicit consent', independent review of DigiYatra's data-handling SOPs by legal, technical and civil-society experts with the results made public, strict purpose limitation, sector-specific impact assessments before deployment and a separate law on AI and FRT, independent of general data protection law. It also asked NITI Aayog to study the use of FRT by law enforcement in criminal investigations.⁵

The paper is the clearest statement by an Indian government body of how facial recognition should be governed by principle: voluntary, consent-based, proportionate, transparent and auditable. It is also an early official application of the principles in NITI Aayog's 2021 documents to a real programme. But it is a discussion paper, with no binding force, and its legal recommendations depended on a data protection law that did not yet exist.¹

That law has since arrived. Parliament passed the Digital Personal Data Protection Act, 2023 in August 2023, which includes broad exemptions for State instrumentalities that the government may notify, a feature that IFF and SFLC had flagged in the 2022 draft.⁴⁵⁶ DigiYatra and police use of FRT are covered in separate entries. As of 15 October 2026, the sources reviewed for this entry did not show that NITI Aayog had issued a final or revised version of the facial recognition paper, so it is treated here as a draft.