Privacy of citizens being compromised, says Kerala HC; directs Centre to make Data Protection Board functional in eight weeks

This case highlights the crucial role of the judiciary in ensuring the implementation of statutory frameworks meant to protect fundamental rights, particularly the Right to Privacy, which was recognized as a fundamental right under Article 21 of the Constitution by the Supreme Court in the landmark Justice K.S. Puttaswamy (Retd.) vs Union of India judgment (2017). The court's intervention underscores the governance gap created by the delayed operationalization of the Data Protection Board (DPB). The DPB is the designated enforcement authority under the Digital Personal Data Protection Act, 2023, responsible for addressing grievances, conducting inquiries into data breaches, and imposing penalties on data fiduciaries (entities collecting data). Without a functional DPB, the rights granted to citizens (Data Principals) under the Act remain largely theoretical, leaving individuals without effective recourse if their data is misused. The court's order acts as a catalyst for institutional reform, pushing the executive to fulfill its legislative mandate and establish the necessary regulatory architecture for digital governance.

The collection and storage of sensitive personal data, such as biometric information, by platforms like Digi Yatra present significant cyber security challenges and potential threats to internal security. Digi Yatra is designed to facilitate contactless passenger movement at airports using Facial Recognition Technology (FRT). However, the massive aggregation of this sensitive personal data by private entities or semi-government foundations creates lucrative targets for cyberattacks and data breaches. The petitioner's concern regarding the onward sharing or commercial exploitation of this data by concessionaires and third parties is a critical issue. The Digital Personal Data Protection Act, 2023 aims to mitigate these risks by imposing obligations on data fiduciaries to implement reasonable security safeguards. The court's insistence on alternative identity proofs like driving licenses, rather than solely relying on Aadhaar, aligns with the principle of data minimization and reduces the risks associated with centralized biometric databases. For UPSC, understanding the balance between leveraging technology for efficiency (like seamless airport transit) and ensuring robust cyber security and data privacy is paramount.

The High Court's observations directly address the tension between state/corporate data collection practices and the individual's Right to Privacy. The Digital Personal Data Protection Act, 2023 is built on principles such as purpose limitation, data minimization, and lawful processing. The mandatory requirement of Aadhaar for availing services like Digi Yatra, if enforced, would violate the principle of proportionality laid down in the Puttaswamy judgment, which requires that any infringement on privacy must be backed by law, have a legitimate state aim, and be proportional to that aim. By ensuring that alternative documents (like driving licenses and potentially Voter IDs) are accepted, the court is protecting the citizen's right to choose and preventing the indirect compulsion of Aadhaar linking for non-welfare services. The petition also highlights the right of Data Principals to be protected against unauthorized disclosure of their data to third parties, a core tenet of the DPDPA that requires a functional Data Protection Board to enforce.