Isabella Mariam

The High Court of Kerala Division Bench of Chief Justice Soumen Sen and Justice Syam Kumar V.M. issued notice to the Digi Yatra Foundation while admitting a public interest litigation raising concerns over the collection, storage, processing, and transmission of sensitive personal data of air passengers at airports across India. The court also directed the Union of India and the Ministry of Electronics and Information Technology to ascertain whether a Data Protection Board has been constituted under the Digital Personal Data Protection Act, 2023, and adjourn the matter to 19 March 2026.

A public interest litigation was filed before the Kerala High Court by petitioner C R Neelakandan raising concerns over the handling of sensitive personal data of air passengers at airports across India. The petition named the Union of India through the Ministry of Civil Aviation, the Airports Authority of India, the Ministry of Electronics and Information Technology, and the Digi Yatra Foundation, among others, as respondents.

The petitioner sought interim directions to the Union Ministry of Civil Aviation, the Airports Authority of India, and the Ministry of Electronics and Information Technology to ensure that the collection, storage, processing, and transmission of passenger data at airports across India complies strictly with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

Among other reliefs, the plea sought a temporary restraint on airport operators and their commercial partners from sharing or commercially exploiting passengers' personal data or disclosing it to third parties without authorisation. It also sought a stay on pending tenders or contractual arrangements involving private entities where passenger data collection or processing is involved, until adequate data protection clauses consistent with the law are incorporated.

The court ordered that notice be served upon the Digi Yatra Foundation, a non-profit entity registered under the Companies Act, 2013, through both speed post with acknowledgment due and e-mail.

Also Read: After Former Husband Consents, Kerala High Court Allows Correction Of Father's Name In Birth Certificate Of Child Born Out Of Extra-Marital Affair

The court called upon counsel representing the Union of India and the Ministry of Electronics and Information Technology to verify whether a Data Protection Board has been formed pursuant to Section 18 of the Digital Personal Data Protection Act, 2023. Should such a Board be in existence, its constitution is to be formally disclosed through an affidavit before the next date of hearing.

The court additionally granted the petitioner liberty to place on record a supplementary affidavit setting out particular instances where the privacy of passenger data is alleged to have been compromised, provided that copies are served upon counsel for all parties in advance.

The case has been listed for further proceedings on March 19, 2026.

Advocates Representing the Parties:

For the Petitioner: Mr. Santhosh Mathew (Senior Advocate) instructed by Mr. Jayasankar R.

For the Respondents: Smt. O. M. Shalina, Deputy Solicitor General of India; Mr. Arjun Venugopal, Central Government Counsel; Mr. Venkatesan Krishnamacharry

Case Title: C R Neelakandan v. Union of India & Ors.

Neutral Citation: Not available

Case Number: WP(PIL) No. 15 of 2026

Bench: Chief Justice Soumen Sen and Justice Syam Kumar V.M.