Facial Recognition in Hostels: Proportionality, Children's Data and the Outsourced State

The standard. K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 requires an invasion of privacy to satisfy four requirements: legality; a legitimate State aim; a rational connection between the measure and that aim; and necessity in the sense of the least restrictive means, followed by a balancing of the intrusion against the benefit.

(i) Legality - fails. Executive action must rest on a statute or valid subordinate law, not merely an administrative order or a procurement contract. The State identifies no statute authorising mandatory facial recognition in hostels.

(ii) Legitimate aim - passes. Preventing ghost beneficiaries and ensuring that hostel grants reach the students for whom they are meant is legitimate and connects to Articles 21 and 46.

(iii) Suitability - passes weakly. Facial recognition may reduce proxy attendance, but it does not verify whether the student actually resides in the hostel or eats the food, which is the real object of the grant.

(iv) Necessity - fails. Less intrusive alternatives exist: periodic physical verification by wardens, sample audits by the department, social audits by students' committees, Aadhaar-linked direct benefit transfer already tied to bank accounts, or manual registers with random checks. The State has not shown why these are inadequate.

(v) Balancing - fails. The intrusion is severe and asymmetric. There are 9,600 students, 1,200 of them minors; the food allowance is conditioned on biometric enrolment, so refusal costs a basic entitlement; templates, timestamps and geo-location sit on a foreign server with no deletion schedule and no grievance mechanism; and an insider leak has already occurred. The chilling effect on hostel residence and education outweighs the incremental gain in verification.

Conclusion. The scheme is disproportionate and violates Article 21; the absence of any statutory authority also makes it arbitrary under Article 14.

Consent and notice. The 2023 Act permits processing only on consent or a notified legitimate use. Consent must be free, specific, informed and accompanied by a notice stating the purpose, the data collected, the manner of exercising rights and the grievance-redressal mechanism. No consent is sought at all, so the scheme must stand or fall on the legitimate-use route.

State benefits. Provision of a subsidy, benefit or service by the State is a recognised legitimate use, so consent may not be strictly required for the hostel grant. But that route is an exception to consent, not a licence to ignore the other obligations of a data fiduciary: accuracy, security safeguards, breach notification, erasure where consent was the basis, and grievance redressal. The contract's silence on deletion, security and grievance is a direct breach of those duties.

Children. Where the data principal is a child under 18, the Act requires verifiable parental consent and prohibits tracking, behavioural monitoring and targeted advertising directed at children. The 1,200 minors cannot be enrolled on their own consent, and continuous geo-location capture is close to the prohibited behavioural monitoring.

Cross-border transfer. Transfer abroad is permitted subject to restrictions notified by the Central Government. Absent a notified restriction the transfer is not automatically unlawful, but the absence of any transfer assessment or contractual safeguard is a governance failure.

International standard. Article 16 of the UNCRC protects children from arbitrary interference with privacy, and General Comment 25 (2021) applies that protection to the digital environment.

Conclusion. Even on the legitimate-use route, purpose limitation, minimisation, security and the special protection of children are mandatory; the scheme fails on each.

Interim. Suspend enrolment of new students and the use of data already collected; direct the vendor to return and delete all templates and images with a written certificate; preserve audit logs pending inquiry.

Design safeguards.

• Minimisation: no raw images retained; matching on the device, with only a yes/no attendance record stored.
• Localisation and retention: storage in India, retention limited to the shortest necessary period, automatic deletion.
• Alternatives: manual attendance with periodic audits, and a documented opt-out that does not affect the mess allowance.
• Children: verifiable parental consent, no behavioural monitoring, no third-party sharing.
• Accountability: a published data protection impact assessment before rollout, an independent security audit, access logs, a grievance officer, and breach notification to affected students.

Legal remedies. A writ petition under Article 226 or 32 for a declaration of unconstitutionality and for deletion of the data; a complaint to the Data Protection Board once constituted; and a complaint to the human rights commission, since privacy is a human right and denial of the food allowance engages Article 21. The student whose photograph leaked should receive compensation for the breach, and the employee's access should be investigated.

Outsourcing does not dilute duty. The department remains the data fiduciary; it cannot transfer its constitutional obligations to a vendor. The contract must therefore contain security, deletion, audit and indemnity clauses, and the State must retain the power to inspect and to terminate.

Reasoning point. Proportionality is not a one-time design test. It requires continuing review, and the complete absence of any review mechanism is itself a proportionality defect.