Back
Kerala High Court Flags Privacy Risks in Digi Yatra: Notice to Foundation, Data Board Details Sought
In a significant move for passenger privacy, the issued notice to the on , while hearing a filed by C R Neelakandan. A Division Bench led by Chief Justice Soumen Sen and Justice Syam Kumar V.M. addressed concerns over the collection, storage, and processing of sensitive passenger data at Indian airports under the Digi Yatra digital travel platform. The court also directed the Union government to confirm the constitution of the under Section 18 of the (DPDP Act), adjourning the matter to March 19.
Passenger Data Under Scrutiny: The PIL's Urgent Call
The PIL, WP(PIL) No. 15 of 2026 , targets the (), , , and others, including the —a non-profit under the , managing the facial recognition-based Digi Yatra system rolled out at major airports.
Petitioner C R Neelakandan, a 68-year-old resident of Thrikkakara, alleges risks in how biometric and personal data of air travelers is handled amid the DPDP Act, 2023, and its 2025 Rules. He seeks interim orders to enforce strict compliance, halt unauthorized data sharing by airport concessionaires, and pause tenders involving private parties until robust data protection clauses are embedded. Reports highlight fears of commercial exploitation and breaches, with the court greenlighting a supplementary affidavit detailing specific confidentiality lapses.
Petitioner's Plea vs. Government's Silence: Arguments Unfold
Advocates and for the petitioner argued for immediate safeguards, emphasizing the DPDP Act's mandate on sensitive personal data like biometrics used in Digi Yatra for seamless check-ins. They urged restraints on data transmission to third parties and a freeze on contracts lacking compliance, citing potential violations amid growing airport digitization.
The Union, represented by , , and , faced initial scrutiny without substantive counter-arguments at this admission stage. The bench focused on procedural steps, pressing for transparency on the 's status—a key enforcement body under the Act.
Decoding the Order: Precedents and Privacy Principles at Play
While no precedents were cited in this interim order, the proceedings invoke core DPDP Act provisions, particularly Section 18 on the Board's role in oversight, consent, and breach redressal. The court drew a line on like AAI and Digi Yatra, stressing for passenger data—mirroring global standards like GDPR amid India's push for contactless travel post-pandemic. The PIL distinguishes routine aviation security from unregulated commercial data flows, spotlighting Section 18's unimplemented potential.
Key Observations
"Issue notice to the fifth respondent. In addition to service to be effected by speed post with acknowledgment due, notice may also be sent by e-mail."
— Order, Para 1
"We request the learned counsel appearing for respondent Nos.1 and 3 to ascertain whether a Board has been constituted under by the adjourned date and in the event such Board has been constituted, the constitution of the said Board shall be disclosed by way of an affidavit on the adjourned date."
— Order, Para 2
"The learned counsel for the petitioner has prayed for leave to file a supplementary affidavit disclosing the instances where the confidentiality has been breached. The said affidavit may be filed within the aforesaid time upon prior service on the learned counsel appearing for the parties."
— Order, Para 4
What's Next: Ripples for Airports and Travelers
The court adjourned to , paving the way for deeper scrutiny. No final relief was granted, but the directives signal judicial oversight on Digi Yatra's expansion, now live at over 20 airports. Success could mandate DPDP-aligned contracts nationwide, curbing data leaks and boosting traveler trust. For now, it underscores a pivotal tension: innovation versus privacy in India's skies.
