'Make Data Protection Board Functional In 8 Weeks': Kerala High Court In PIL Raising Privacy Concerns In 'Digi Yatra'

The Kerala High Court recently disposed of a public interest litigation that raised concerns over the protection of passengers' personal data collected at airports through digital systems, such as Digi Yatra. [2026 LiveLaw (Ker) 570]

As per the Digi Yatra website, it is an initiative led by the Central Ministry of Civil Aviation that uses face biometrics to digitally validate identity, travel, health or other data needed for the purpose of air travel. The app only allows AADHAAR as the government ID. It is also stated that the app has a secure wallet inside, which stores all the afore credentials.

When the matter came up on Wednesday, the Division Bench of Chief Justice Soumen Sen and Justice Syam Kumar V.M. observed:

"The issue raised by the writ petitioner cannot be ignored, as we find that the privacy of citizens is being compromised."

It also recorded the submission of the Digi Yatra Foundation's counsel that as of now, Aadhaar Card and Driving Licence can be considered as proof of identity. It then observed:

"In future, we expect that the authorities may also consider accepting the Voter ID as proof of identity for the aforesaid purpose."

During the last hearing, the Court had issued notice to the Digi Yatra Foundation, a non-profit company incorporated under the Companies Act, 2013 involved in implementing the Digi Yatra platform.

It had also sought a clarification from the Union as to whether the Data Protection Board of India as per Section 18 of the Digital Personal Data Protection Act, 2023 has been constituted. The central government counsel, on instructions, submitted that the Board has been constituted but has not made functional.

After recording the submission, the Court directed that the Board be made functional within 8 weeks:

"Considering the purpose for which the Act of 2023 has been enacted, we expect that the Board will be made functional within a period of eight weeks from date."

The PIL had sought interim directions to the Union Ministry of Civil Aviation, the Airports Authority of India (AAI), and the Ministry of Electronics and Information Technology to ensure that handling of sensitive passenger data complies strictly with the DPDP Act and the Digital Personal Data Protection Rules, 2025.

Counsel for the petitioner: Jayasankar R.

Counsel for the respondents: O.M. Shalina - Deputy Solicitor General of India, Thomas P. Kuruvila - Digi Yatra Foundation, Monali Dutta, B. Ananthu, K. Venkatesan, Arjun Venugopal - CGC