AIRPORT PRIVACY UNDER THE SCANNER: KERALA HIGH COURT QUESTIONS MANDATORY AADHAAR FOR DIGI YATRA REGISTRATION
High Court Bench Demands to Know Why Alternate Government Identity Proofs Cannot Suffice for Voluntary Biometric Boarding
Public Interest Litigation Exposes Friction Between Aviation Convenience and India’s Landmark Data Protection Laws
By Legal Editor
New Delhi: July 16, 2026:
The continuous push toward automated public infrastructure has reached a significant legal crossroad at the gates of India’s domestic airport terminals. The Kerala High Court’s recent prima facie observation—challenging the mandatory imposition of Aadhaar for registering on the biometric boarding platform Digi Yatra—brings to the forefront an essential debate regarding digital identity, state-sponsored convenience, and constitutional privacy rights.
Hearing a Public Interest Litigation (PIL) filed by social activist and advocate C.R. Neelakandan, a Division Bench comprising Chief Justice Soumen Sen and Justice Syam Kumar V.M. questioned the legal rationale behind restricting registration credentials exclusively to Aadhaar data. The court noted that if a passenger can purchase a standard ticket and clear manual airport security via alternative government-issued identity documents, enforcing a single biometric database identifier for a purportedly voluntary digital application appears inherently contradictory.
This judicial intervention highlights a growing systemic friction. On one hand, the Ministry of Civil Aviation and the emphasize that Digi Yatra is a modern ecosystem designed to optimize transit speed through facial recognition technology. On the other hand, civil liberties advocates argue that by making Aadhaar the exclusive gateway to access the platform, the state creates an environment of constructive compulsion. The legal challenge insists that the implementation architecture of the Digi Yatra Foundation must remain subservient to broader domestic privacy benchmarks, specifically the (DPDPA) and landmark Supreme Court decisions governing biometric identity.
Decoding the Legal Architecture: The Aadhaar Act vs. Voluntary Services
To understand why the High Court has expressed skepticism, one must examine the statutory foundation of Aadhaar authentication. The primary legal framework governing the unique identification project is the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. The statutory boundary of mandatory Aadhaar usage was firmly drawn by the Supreme Court of India in its historic five-judge Constitution Bench judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India (2018).
The Supreme Court’s majority opinion clarified that the state can only mandate Aadhaar authentication under Section 7 of the Act when the specific service, benefit, or subsidy is funded directly out of the Consolidated Fund of India. For any application falling outside this specific fiscal classification—such as school admissions, private bank account linking, or mobile SIM cards—compulsory linking was struck down as unconstitutional and disproportionate.
| THE LEGAL GAP IN BIOMETRIC BOARDING |
+---------------------------------------------------------------------------------------+
| AADHAAR ACT (SECTION 7) | DIGI YATRA ECOSYSTEM |
| - Applies to State Subsidies & Benefits | - A Voluntary Transit Facilitation System |
| - Funded by Consolidated Fund of India | - Commercial Aviation Infrastructure |
| - Deemed Proportional for Welfare | - Restricted Choice is Non-compliant |
Because commercial air travel is an open-market service and not a state-sponsored welfare subsidy under Section 7, the exclusion of other valid government identification records—such as Passports, Driving Licenses, or Voter ID cards—creates an impermissible legal hurdle. The Additional Solicitor General of India (ASGI) argued before the Kerala High Court that the Aadhaar requirement is simply a mechanism to verify identity for passengers who choose to sign up. However, the court’s counter-inquiry cuts straight to the doctrine of unconstitutional conditions: can a public facility offer a fast-track convenience system while conditioning its access on the surrender of personal biometric indicators through a single choice pool? The Bench’s decision to halt proceedings until the Digi Yatra Foundation clarifies its stance indicates that a rigid reliance on Aadhaar will face strict judicial scrutiny.
The Digital Personal Data Protection Act (DPDPA) Imperative
Beyond the limitations of the Aadhaar Act, the Digi Yatra infrastructure must comply with the . Under the DPDPA, any organization that determines the purpose and means of processing digital personal data is classified as a Data Fiduciary. Consequently, the Digi Yatra Foundation, partnering airport operators, and contracted technology developers operate under strict fiduciary responsibilities regarding passenger information.
[ Passenger / Data Principal ]
│ (Gives Free, Specific & Informed Consent)
▼
[ Digi Yatra / Data Fiduciary ]
│ (Must comply with statutory obligations)
┌──────────┴──────────┐
▼ ▼
Purpose Limitation Storage Limitation
The DPDPA introduces several core compliance mandates that directly challenge how biometric databases are handled at transit hubs:
1. The Standard of Absolute Consent
Section 6 of the DPDPA mandates that consent must be free, specific, informed, unconditional, and unambiguous, requiring a clear affirmative action. If an application restricts user choice by refusing alternative identification mechanisms, the validity of that consent becomes legally vulnerable. A passenger opting into a digital processing ecosystem under the impression that it is the only way to avoid extended waiting lines requires a transparent choice architecture to meet the high threshold established by the DPDPA.
2. Purpose and Storage Limitation
Sections 4 and 7 of the data protection law demand strict purpose limitation. The ASGI stated that passenger biometrics remain secure and are automatically purged from the local airport database once a journey is concluded. While this temporal containment aligns with the principle of storage minimization, the petitioner’s legal challenge raises deep structural concerns regarding data handling before deletion. The PIL explicitly seeks an injunction against airport operators and associated corporate partners from commercially exploiting or profiling passenger data without explicit authorization, highlighting the need for transparent independent compliance audits.
3. Extra-Statutory Data Sharing Risks
A primary argument in data privacy jurisprudence is the threat of function creep—where data collected for one intended purpose (e.g., identity verification for airport boarding) is utilized for secondary processing, such as commercial behavioural tracking or targeted advertising. The DPDPA categorically prohibits Data Fiduciaries from engaging in processing activities that result in unauthorized third-party sharing or data monetization. By demanding compliance with the DPDPA, the petitioner wants to ensure that the facial recognition data generated at terminal gates is completely separated from commercial analytics networks.
Balancing Technological Innovation and Civil Liberties
The immediate dispute over Digi Yatra reflects a broader global debate on integrating biometric technology into public life. Proponents of automated transit platforms highlight the undeniable operational benefits: reduced processing times, shorter airport security queues, and enhanced security verification. These improvements support the state's legitimate objective of modernizing aviation infrastructure.
However, the constitutional benchmark established in K.S. Puttaswamy v. Union of India (2017) dictates that any state action infringing upon personal privacy must satisfy a strict three-fold test: legality (backed by an explicit statutory law), need (serving a legitimate state aim), and proportionality (ensuring the least intrusive means are used to achieve the objective).
The Kerala High Court’s inquiry targets the proportionality prong of this constitutional test. Enforcing Aadhaar as the exclusive verification option on a platform designed for convenience fails the standard of the least intrusive means, particularly when alternative, non-biometric government identity options exist. If the Digi Yatra Foundation can adapt its platform to integrate alternative verification mechanisms, it can preserve operational convenience while respecting civil liberties.
Index of Key Statutes and Precedents Referenced
Searchable Legal FAQ Index: Understanding Airport Biometric Boarding Laws
Q1: Is Digi Yatra mandatory for air travelers?
Q2: Why is the Kerala High Court questioning the sole use of Aadhaar?
Q3: What protections does the DPDPA 2023 provide against tracking?
Q4: Can airports store passenger biometric data indefinitely?
Q5: What legal recourse do passengers have if their privacy is violated?
Q1: Is Digi Yatra mandatory for domestic air travellers in India?
Answer: No. Based on official statements submitted by the Additional Solicitor General of India (ASGI) and the , Digi Yatra is a purely voluntary convenience facility. Every passenger retains the legal right to opt out of biometric processing and choose traditional manual counter check-ins and standard security gate verifications using physical identity papers.
Q2: Why is the Kerala High Court questioning the sole use of Aadhaar for Digi Yatra registration?
Answer: The Division Bench highlighted a logical and legal contradiction: since passengers can purchase tickets and pass through standard terminal gates using various official IDs (like Passports or Voter ID cards), restricting digital registration exclusively to Aadhaar lacks a sound legal basis. Under the Supreme Court’s Puttaswamy (2018) ruling, mandatory Aadhaar integration is limited to state welfare distributions under Section 7 of the Aadhaar Act and cannot be enforced for everyday commercial transit platforms.
Q3: What protections does the DPDPA 2023 provide against tracking or commercial data exploitation at airports?
Answer: The mandates strict purpose limitation. Entities handling data are prohibited from repurposing biometric facial profiles for commercial data mining, behavioural tracking, or third-party marketing without explicit, separate consent. The pending PIL explicitly asks the judiciary to restrain airport stakeholders from commercializing passenger travel histories.
Q4: Can airports store passenger biometric data indefinitely within their systems?
Answer: No. To comply with both data minimization principles and the operational rules of the platform, passenger biometric facial templates must be purged from local airport systems within a specified period after a flight's completion. The government has confirmed that these details are only used temporarily for verification during the immediate transit period.
Q5: What legal recourse do passengers have if their data is leaked or processed without authorization?
Answer: Under the DPDPA, individuals whose data is compromised (Data Principals) have the right to grievance redressal through the Data Fiduciary's designated channels. If the resolution is unsatisfactory, they can escalate complaints to the Data Protection Board of India (DPBI). The Board has the power to investigate data breaches and impose severe financial penalties on non-compliant entities, with further appeals directed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Law / Legal Precedent — Relevant Section / Clause — Core Legal Implication for Digi Yatra Case
Digital Personal Data Protection Act, 2023 — Section 6 (Consent Architecture) — Requires passenger consent to be free, specific, unconditional, and driven by an affirmative action without restrictive identification mandates.
Digital Personal Data Protection Act, 2023 — Sections 4 & 7 (Purpose & Storage Limitation) — Dictates that biometric data can only be handled for passenger boarding and must be permanently deleted immediately after journey completion.
The Aadhaar Act, 2016 — Section 7 (Mandatory Provisioning Linkage) — Restricts mandatory Aadhaar integration to welfare benefits funded by the Consolidated Fund of India; commercial transit platforms do not qualify.
Supreme Court Judgment: K.S. Puttaswamy v. UOI (2018) — Constitution Bench Ratio Decidendi — Invalidated private and commercial compulsion of Aadhaar linking, establishing the necessity for alternative verification options.
Supreme Court Judgment: K.S. Puttaswamy v. UOI (2017) — Article 21 Privacy Framework — Mandated that any collection of personal biometric information must satisfy the three-fold constitutional test of legality, need, and proportionality.