We wrote to NCRB and MHA requesting them to halt their ongoing National Automated Facial Recognition System (AFRS) project

Tl;dr

The National Crime Records Bureau (NCRB) has sought to revise its Request for Proposals (RFP) for tender bids for the creation of a National Automated Facial Recognition System (AFRS) according to an update on its website dated March 23, 2020. IFF has previously called for a three year moratorium on the government use of facial recognition technologies under its ongoing #ProjectPanoptic. In this instance, we have shared a representation with the NCRB and the Hon’ble Minister of Home Affairs Mr Amit Shah. In it, we highlight legal and constitutional issues with such projects. As a remedy our representation seeks a recall of this RFP and a halt to the tender process itself. It also provides concrete policy recommendations for the Government to consider.

Background on AFRS

The RFP invites bids for the creation of a National Automated Facial Recognition System (AFRS), which has an estimated budget of INR 308 crore, to further create a national database of photographs. According to the RFP, this database is purported to be used to swiftly identify criminals by gathering existing data from various other databases like:

1. Passport database under the Ministry of External Affairs,

2. Crime and Criminal Tracking Network and Systems (CCTNS) by the National Crime Records Bureau(NCRB) under the Ministry of Home Affairs (MHA),

3. Interoperable Criminal Justice System (ICJS) by the NCRB under the MHA ,

4. Women and Child Development Ministry's KhoyaPaya Portal,

5. Automated Fingerprint Identification System (AFIS) by the NCRB under the MHA

6. Any other image database available with police/other entities.

The NCRB first released the RFP calling for bids for the creation of AFRS on 28 June, 2019 (Document Reference: 02/001). Initially, the deadline for submission of bids was on August 16, 2019 (Read our first post on the subject here). However, the deadline for submission has been extended six times due to administrative reasons by the NCRB. According to an update dated March 23, 2020 published on the NCRB’s website, the RFP is now being revised. The current deadline for submission is May 22, 2020.

As pointed out in our previous blogpost on the matter, use of this technology without having legal safeguards in place could lead to harms such as discrimination and exclusion which will be difficult to undo. Additionally, in the absence of a strong data protection law, use of this technology could easily lead to mass surveillance. A strong data protection law is needed to hold AFRS accountable in terms of collection, storage and usage of data including sharing of data across government agencies and with third parties to ensure that there is proportionality in processing the data collected. Proportionality during processing of personal data means that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.

Steps taken by IFF

IFF has sought a three year moratorium to be imposed upon all government use of facial recognition technology. IFF has also consistently opposed the use of facial recognition by NCRB since the first report on AFRS came to light. IFF has previously sent a legal notice to NCRB seeking that they recall the RFP and halt the tender process since the project lacks a legal basis. IFF would like to thank the NCRB for responding to our previous legal notice and also for their decision to revise the RFP. However, we are of the opinion these steps being taken by the NCRB are insufficient and there is a need for further changes and immediate action.

In this representation, therefore IFF recommends that:

1. NCRB immediately rollbacks its request for proposals and halts its ongoing tender process for the creation of a National Automated Facial Recognition System.

2. The Government of India place a moratorium of three years on the use of facial recognition technology by government authorities in India during which time an informed consultation takes place between the various stakeholders and civil society organizations to understand the ambit of this technology.

3. The Government of India immediately passes a strong data protection law to hold government functionaries accountable when they collect people’s personal data whilst deploying such systems.

4. The Government of India should pass a specific law with regard to facial recognition technology to regulate the technology in the country. This law should be developed as a result of the informed consultation process as mentioned above.

What’s Next?

IFF has been mapping the use of facial recognition all over the country as a part of its ongoing #ProjectPanoptic. In addition to seeking a three year moratorium on the use of this technology, we have been constantly seeking information about these projects all over India and have also been engaging with government authorities whenever the need arises. IFF will be developing and publishing more material as part of our ongoing analysis of this topic under this project in the coming months.