Kerala High Court Issues Notice to Digi Yatra Foundation Over Data Privacy Concerns

The Kerala High Court on 5 March 2026 admitted a public interest litigation challenging the Digi Yatra programme's collection and processing of passenger biometric data at Indian airports. A division bench led by Chief Justice Soumen Sen issued notice to the Digi Yatra Foundation and directed the Union government to clarify whether the Data Protection Board under Section 18 of the Digital Personal Data Protection Act, 2023 (DPDP Act) has been constituted. The PIL, filed by C.R. Neelakandan at the Ernakulam bench, names six respondents including the Ministry of Civil Aviation, the Airports Authority of India, MeitY, and the Digi Yatra Foundation.

The petitioner seeks three interim reliefs: that all collection, storage, and processing of passenger personal data at airports be brought into strict compliance with the DPDP Act and the DPDP Rules, 2025; that airport concessionaires and service providers be restrained from sharing passenger data with third parties; and that all pending tenders involving private parties handling passenger data be stayed until DPDP-compliant contractual clauses are incorporated. The petitioner has also sought leave to file a supplementary affidavit detailing specific instances of confidentiality breaches.

The Court's direction to the Centre on the Data Protection Board is the most consequential part of this order. The Central Government notified the establishment of the Board via G.S.R. 844(E) on 13 November 2025, headquartering it in the National Capital Region. But notification and operational constitution are different things. The Court is, in effect, asking whether the Board actually exists as a functioning adjudicatory body. If it does not, the enforcement architecture of the DPDP Act remains hollow: there is no institution to receive complaints, conduct inquiries, or impose penalties under Sections 35 and 38 to 43.

The matter is listed next on 19 March 2026. Organisations operating biometric or identity verification systems at airports should treat this PIL as a compliance signal. Judicial attention on DPDP compliance in the aviation sector is now active, and the absence of a fully constituted Board will not serve as a shield against accountability.