The Kerala High Court on Wednesday remarked that furnishing Aadhaar details should not prima facie be mandatory for registering on the DigiYatra platform [CR Neelakandan v. Union of India & Ors.].
A Division Bench of Chief Justice Soumen Sen and Justice Syam Kumar VM made the observation while considering a public interest litigation (PIL) petition that raised concerns about the security of passenger data collected at airports through the DigiYatra platform.
The PIL also alleged that the digital interface was not secured in line with the Digital Personal Data Protection Act, 2023 (DPDP Act).
While the petitioner's counsel today informed the Bench that his client wished to withdraw the PIL due to health concerns, the Bench refused the request as the petition was filed in public interest.
Additional Solicitor General of India ARL Sundaresan, appearing for the Union government and the Airports Authority of India (AAI), submitted that using the DigiYatra platform is voluntary.
However, the Bench opined that regardless of whether use of the platform is mandatory, it may not be proper to compel users to disclose Aadhaar details to register on it.
"We are prima facie of the view that Aadhaar details may not be necessary while registering on DigiYatra if the petitioner has any other identity proof to establish his identity. The matter is adjourned at the instance of the learned counsel appearing for DigiYatra to apprise this court if any other identity proof would be sufficient for access to the portal by a person," the Court said in its order.
Chief Justice Sen orally added that going by the law laid down by the Supreme Court in the KS Puttaswamy v Union of India, the government cannot insist on Aadhaar details.
"As per Puttaswamy, this (using Aadhaar for registering on DigiYatra) cannot be compulsory. You cannot insist on this," Chief Justice Sen said.
The Bench proceeded to adjourn the matter for two weeks and directed the counsel representing DigiYatra to apprise it as to whether any other ID proof would be sufficient for registering on the platform.
'DigiYatra' is a biometric-based system that enables contactless airport entry and passenger processing, using facial recognition technology.
The platform is operated by the Digi Yatra Foundation, a not-for-profit company incorporated under the Companies Act, 2013, as a joint initiative of the AAI and some private airport operators. The objective is to ensure seamless and contactless passenger movement at airports.
The PIL petition filed by social activist and advocate CR Neelakandan contended that passengers are often compelled to disclose highly sensitive personal information, including biometric data through the 'DigiYatra' platform. Such details include passport particulars, Aadhaar-linked information, travel history, mobile numbers, financial transaction data etc.
Neelakandan claimed that passenger data was being collected not only by government authorities but also by numerous private entities and service providers who are operating within airport premises.
He argued that there was no transparent framework governing how this data is stored, processed, retained or shared. He further submitted that the agreements governing these engagements do not contain any safeguards on data protection or cybersecurity standards despite the enactment of the DPDP Act.
The petition also relied on the Supreme Court's decision in KS Puttaswamy v Union of India (right to privacy case) to argue that the existing system of large-scale data collection at airports fails to satisfy the constitutional requirements of legality, necessity and proportionality.
The PIL thus sought directions to the Central government and airport authorities to formulate and implement binding guidelines governing the collection, storage, processing and protection of passenger data at airports in compliance with the data protection laws.
