KERALA HIGH COURT DEMANDS CENTRE, DIGI YATRA FOUNDATION'S RESPONSE ON PRIVACY ISSUES IN DIGI YATRA:

The Kerala High Court has issued notice to the Digi Yatra Foundation in a public interest litigation (PIL) concerning the protection of passengers' personal data collected through digital systems like Digi Yatra at airports across India. The Division Bench, consisting of Chief Justice Soumen Sen and Justice Syam Kumar V.M., heard the petition on March 5, 2026. The PIL highlights alleged potential risks associated with the collection, storage, and processing of sensitive passenger information, including biometric and personal details, raising serious questions about privacy safeguards in the country's aviation digital infrastructure.

The petitioner, C.R. Neelakandan, has urged the court to issue interim directions to key authorities, the Union Ministry of Civil Aviation, the Airports Authority of India (AAI), and the Ministry of Electronics and Information Technology (MeitY) to ensure that all handling of passenger data adheres strictly to the provisions of the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025. The plea emphasizes the need for robust compliance to prevent misuse or unauthorized access to such sensitive information.

Among the key reliefs sought are temporary restraints preventing airport operators, along with their commercial partners, licensees, concessionaires, service providers, or intermediaries, from sharing passengers' personal data, exploiting it commercially, or disclosing it to any third parties without proper authorization. The petition also requests a stay on any ongoing tenders or contractual arrangements with private entities that involve the collection or processing of passenger data. This stay would remain in place until the contracts incorporate adequate data protection clauses fully aligned with the prevailing legal framework.

The court has specifically directed that notice be served on the Digi Yatra Foundation, a non-profit company registered under the Companies Act, 2013, responsible for implementing and managing the Digi Yatra digital travel platform. This platform facilitates seamless, paperless, and contactless airport processes through biometric verification and data integration.

Additionally, the Bench instructed counsel representing the Union Government to verify whether the Data Protection Board of India has been duly constituted under Section 18 of the Digital Personal Data Protection Act, 2023. If the board has indeed been formed, the government must file an affidavit providing full details of its constitution and composition for the court's consideration.

The court has further allowed the petitioner to file a supplementary affidavit furnishing specific instances, if any, where breaches of passenger data confidentiality may have occurred. This provision enables the inclusion of concrete evidence to substantiate the claims of vulnerability in the current system.

The matter is now scheduled for further hearing and consideration on March 19, 2026, when the court will review the responses from the respondents, including the Union Government and the Digi Yatra Foundation, along with any additional submissions.

This development underscores growing judicial scrutiny over digital initiatives in public infrastructure, particularly those involving large-scale collection of personal and biometric data. As Digi Yatra expands to promote efficiency in air travel, the case highlights the critical balance between technological convenience and the fundamental right to privacy and data protection for millions of passengers. The outcome could set important precedents for how sensitive information is managed in government-backed digital platforms nationwide.