Kerala High Court Questions Data Security in Digi Yatra, Notice to Centre, Digi Yatra Foundation
(Judicial Quest News Network)
The Kerala High Court has stepped into the intensifying national debate on digital surveillance and passenger privacy, issuing notice to the Digi Yatra Foundation in a Public Interest Litigation that raises serious questions about the safety and legality of personal data collected from millions of air travellers across India.
The order was passed on March 5 by a Division Bench comprising Chief Justice Soumen Sen and Justice Syam Kumar V. M. while hearing a petition that highlights the potential risks surrounding the large-scale collection, storage and processing of sensitive passenger information through digital airport facilitation systems such as Digi Yatra.
The petition, filed by public activist C. R. Neelakandan, seeks urgent judicial intervention to safeguard the privacy rights of passengers using airports across the country.
It contends that the widespread adoption of biometric and facial recognition–based travel systems has created an ecosystem where vast quantities of personal data including facial images, identity details and travel patterns are collected and processed, potentially exposing travellers to privacy breaches, misuse or unauthorized commercial exploitation.
At the heart of the petition is the argument that the handling of such data must strictly conform to the safeguards envisaged under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
The petitioner has sought interim directions to the Ministry of Civil Aviation, the Airports Authority of India and the Ministry of Electronics and Information Technology to ensure that every stage of passenger data collection, storage and processing is carried out strictly within the statutory framework governing digital privacy.
Raising alarm over the possibility of commercial exploitation of passenger information, the petition also calls for a temporary restraint on airport operators and their private collaborators from sharing, monetising or disclosing travellers’ personal data to third parties without explicit legal authorisation.
It further seeks a stay on ongoing tenders or contractual arrangements involving private companies where passenger data is collected or processed, until robust data protection clauses aligned with statutory requirements are incorporated into such agreements.
During the proceedings, the Bench directed that notice be issued to the Digi Yatra Foundation a non-profit company incorporated under the Companies Act, 2013 which plays a central role in the development and implementation of the Digi Yatra platform across Indian airports.
The system enables passengers to pass through airport checkpoints using facial recognition technology instead of physical boarding passes or identity verification, a move intended to streamline travel but one that has increasingly attracted scrutiny from privacy advocates.
In a significant development, the Court also asked counsel appearing for the Union Government to clarify whether a Data Protection Board has been constituted under Section 18 of the Digital Personal Data Protection Act, 2023.
If such a statutory body has indeed been established, the Bench directed that complete details regarding its composition and functioning be placed before the Court through a formal affidavit.
Further strengthening the factual foundation of the case, the Bench permitted the petitioner to file a supplementary affidavit outlining specific instances where the confidentiality of passenger data may have been compromised or placed at risk within the Digi Yatra ecosystem.
The matter has now been posted for further hearing on March 19, 2026, when the Court is expected to examine responses from the concerned authorities and determine whether additional safeguards or interim directions are required to protect the privacy rights of air travellers.
The proceedings are likely to assume national significance, as the case places India’s rapidly expanding digital travel infrastructure under judicial scrutiny while raising fundamental questions about how technology-driven convenience must coexist with the constitutional promise of privacy in the digital age.
Counsel for petitioner: Santosh Mathews (Sr.), Jayasankar R
Counsel for Respondent: O M Shalina (DSGI), Arjun Venugopal (CGC)
