Watching the Watchers, Eventually: A Comparative View at Digital Surveillance Governance
Across democracies, a similar trend seems to replicate – how surveillance infrastructure expands well ahead of the statutory frameworks meant to govern it. Formal oversight arrives only once the capability has fully scaled. Germany, for instance, developed its foreign intelligence surveillance body only in 2022 after the Federal Constitutional Court ruled in 2020 that the BND’s foreign surveillance regime required independent oversight functionally equivalent to judicial review. A 2017 comparative study jointly produced by the parliamentary libraries of the UK, Australia, New Zealand found each of the Five Eyes nations exercising a blend of parliamentary, independent and judicial review in different proportions. Oversight, to put it simply, is rarely built alongside the infrastructure governing it. Almost always, it follows. Until it is reversed, the interval belongs to people whose only real check on how they are watched is the state's own restraint rather than an external one. It is against that fuller possibility, and that cost, that India trajectory is worth reading
This interval is not abstract. It is measured in facial-recognition watchlists compiled before anybody has tested them for bias, in data-fusion centres proposed before Parliament has decided who may query them and a citizen's only remedy to is a court whose ruling, whichever way it goes, will arrive years after the infrastructure it reviews has already gone live - the Supreme Court’s own Aadhaar verdict came only in 2018, roughly six years after the scheme had been first challenged in court and well after enrolment had already crossed a billion.
In June 2026, the Central Industrial Security Force (CISF) Director General Praveer Ranjan announced a proposal to link facial recognition cameras at six major airports (Delhi, Mumbai, Bengaluru, Hyderabad and Kolkata) to a new data fusion centre in Delhi. This draws on feeds from roughly 1,50,000 CCTV cameras at security sensitive sites and matches them against the National Intelligence Grid or NATGRID. This effort was a logical extension of the earlier expansion where NATGRID was linked to the National Population Register and opened to state police at Superintendent rank – up from its original intended access limited to intelligence agencies . Post-2008 Mumbai attacks the NATGRID was conceived to close information sharing gaps between agencies. It continues to operate under executive control (an office under the Ministry of Home Affairs), rather than a dedicated statue.
The Digital Personal Data Protection Act (DPDP Act) comes closest to intersecting with this infrastructure. Passed in 2023 and phased into force through Rules notified in November 2025. Section 17 permits the Central Government to exempt its selected agencies from the act’s most significant obligations on the grounds of sovereignty, security and public order. This provision is currently before the Supreme Court. In February 2026, a bench led by Chief Justice Surya Kant issued notice on a set of writ petitions challenging the Act – including questions about the Data Protection Board’s structural independence as the members are appointed through a process government controls, and referred the case to a larger five-judge bench. So far, it has declined to put a stay on the Act’s operations. Some might even call it an act of silencing the right to know.
A useful reference for contrast here could be how Germany has chosen to pair its new surveillance, AI, and cyber powers this August with an enlarged mandate for the Independent Control Council in the same legislative package - the German cabinet’s 12 August 2026 omnibus reform of intelligence law, which for the first time gives the Council its own statute and folds the G10 Commission’s oversight functions into it. Democracies need to reconcile privacy and surveillance. No doubt it took Germany the better part of two decades and a constitutional ruling to arrive at it, but the road is open for all to tread on. The comparative benchmark is worth noting for jurisdictions across the globe.
For India, the moment for this comparison is now rather than later: the DPDP Rules are already being implemented, CISF's proposal is already public, and the matter is already before a five-judge constitutional bench – which is to say, the interval described above is not hypothetical. It is the one India is currently inside of. The same clock is running regionally: Nepal, Bangladesh and Sri Lanka are each building national digital-identity and data-exchange infrastructure this year, with their oversight questions largely still open rather than settled. Globally, the pattern is not closing but accelerating – Freedom House's most recent assessment recorded a fifteenth consecutive year of decline in global internet freedom, driven substantially by government-backed AI and surveillance systems expanding faster than the rights frameworks meant to govern them. Read together, India is a live case inside a pattern still being written - in a region now making the same choices at the moment where the rest of the world is not obviously getting this right either.
No single trajectory is a textbook solution and India’s approach is not an outlier. Different democracies have reached through different trajectories to broadly similar oversight infrastructures – independent bodies, parliamentary review, judicial pre-authorization - the Council of Europe’s Venice Commission catalogues this same trio of models across dozens of member states in its comparative report on the democratic oversight of security and signals - intelligence agencies. These infrastructures are reached through by complex dynamics of varying speeds, domestic security contexts or even legislative preferences. What this comparison here offers is a way of reading India’s current moment, less as an exception, and more as a data point in a pattern that recurs across infrastructures and laws built on different clocks. With the Supreme Court’s pending review – the logical next point, we will witness this gap either narrowing or formally being left open.