The Camera on Your Face: India's Privacy Law in the Age of the Watching Wearable

Abstract

India's Digital Personal Data Protection Act, 2023 (DPDP Act) was drafted for a world of forms and apps, built around a consent architecture that assumes a known Data principal, a known Data fiduciary, and a specific affirmative act of agreement. This article argues that ambient wearable cameras, epitomised by Reliance Jio's newly announced JioFrames and the privacy controversies surrounding Meta's Ray-Ban smart glasses in Kenya, expose three structural failures in that architecture: the inability of consent to function when a bystander does not know that they are being recorded, an overbroad personal-use exemption under Section 3(c)(i) that may place mass real-time biometric capture entirely outside the Act's reach, and the absence of any heightened protection for biometric data such as facial geometry and voiceprints. Drawing on Reliance Jio's own history of data-handling controversies, the constitutional privacy jurisprudence of Justice K.S. Puttaswamy (Retd.) v. Union of India, the narrow scope of existing voyeurism and image-capture offences under the IT Act and the Bharatiya Nyaya Sanhita, and comparative regulatory responses from the European Union, the United Kingdom, and Pennsylvania, the article contends that India's data protection framework requires targeted legislative correction, including a tamper-evident recording indicator, closure of the personal-use exemption for third-party capture, a distinct consent category for biometric data, and concrete retention and breach-disclosure obligations, before ambient wearable surveillance becomes normalised.