Citizens’ privacy was compromised, says Kerala HC; orders the Center to operationalize the Office for Personal Data Protection in eight weeks

The Kerala High Court has directed the Union government to operationalize the Personal Data Protection Board set up under the Personal Data Protection Act, 2023 within eight weeks.

Chief Justice Soumen Sen and Justice VM Syam Kumar issued the directive while disposing of a public interest litigation to ensure that the collection, storage, processing and transmission of sensitive personal data of passengers at airports across India is done in strict compliance with the provisions of the Personal Data Protection Act, 2023 and the Personal Data Protection Rules, 2025.

The court said that the petitioner’s concerns could not be ignored as it was found that the privacy of the citizens was being violated.

The court had earlier ordered that the Digi Yatra portal, which collects personal data at airports for identity verification, could not insist on Aadhar details to ascertain a passenger’s identity. In this connection, the Digi Yatra Foundation informed the court that along with the Aadhar card, the driving license was also accepted as proof of identity. In the future, according to the court, the authorities expected that the authorities could also consider the voter ID card as valid evidence.

The petition also sought to prohibit all existing commercial licensees, concessionaires, service providers and intermediaries operating at airports from further sharing, commercial exploitation or unauthorized disclosure of passenger personal data to third parties.

Published – 11 October 2026 17:25 IST