The database breach of the government’s digital platforms highlights the vacuum in legislation to adequately deal with such breaches. In the absence of legislation providing redress, attributing liability and adequate punishment— the fundamental right to privacy in India remains a toothless tiger. The author outlines the key shortcomings of automated facial recognition systems and proposes policy recommendations to address them effectively.