Kerala High Court Directs Centre to Make the Data Protection Board Functional Within Eight Weeks
The Kerala High Court directed the Union government to make the Data Protection Board of India, set up under the Digital Personal Data Protection (DPDP) Act, 2023, functional within eight weeks.
A Division Bench (two judges) of Chief Justice Soumen Sen and Justice V.M. Syam Kumar gave the direction while disposing of (finally deciding) a public interest litigation (PIL).
The PIL asked that the collection, storage, processing and sharing of passengers' sensitive personal data at Indian airports should follow the DPDP Act, 2023 and the DPDP Rules, 2025. It also asked the court to stop airport licensees, service providers and intermediaries from sharing or selling passengers' data to third parties.
The court observed that the petitioner's concerns could not be ignored, as the privacy of citizens was being compromised.
Earlier in the case, the court had said Digi Yatra (the face-recognition system for airport entry) could not insist on Aadhaar to verify a traveller's identity. The Digi Yatra Foundation told the court that a driving licence is also accepted. The court said authorities may in future also consider the Voter ID as valid proof.
The Board exists in law, but as of mid-2026 its Chairperson and Members had not yet been appointed, so it could not hear complaints or impose penalties.
Right to Privacy as a Fundamental Right (Article 21)
The right to privacy means every person has the right to be left alone and to control information about themselves: their body, their home, their personal choices and their personal data. In India, this is a fundamental right, guaranteed by the Constitution. The Supreme Court declared this in 2017 in the case Justice K.S. Puttaswamy (Retd.) v. Union of India. Privacy is protected mainly as part of the right to life and personal liberty under Article 21, and also as part of the freedoms in Part III of the Constitution.
The Kerala High Court's remark that "the privacy of citizens was being compromised" applies the Puttaswamy principle to passengers' data at airports. Since privacy is a fundamental right, the State must provide a working system, including a functioning Data Protection Board, to protect people's personal data and to hear their complaints.
Digital Personal Data Protection (DPDP) Act, 2023
The Digital Personal Data Protection Act, 2023 is India's first full law to protect people's personal data in digital form. It tells companies and the government (called Data Fiduciaries) how they may collect and use the personal data of people (called Data Principals), mostly based on consent. It gives people rights over their data and creates the Data Protection Board of India to enforce the law and punish breaches.
The Kerala High Court found that without a functioning Board, the DPDP Act cannot actually protect anyone, because there is nobody to hear complaints or punish misuse of data, such as passengers' data at airports. Its eight-week deadline pushes the Centre to complete appointments and make the Board work.
Writ Jurisdiction of High Courts (Article 226)
Article 226 of the Constitution gives every High Court the power to issue orders, called writs, to any person or authority, including the government, within its territory. High Courts can use this power to enforce fundamental rights and also "for any other purpose", meaning other legal rights. This makes the High Court's writ power wider than the Supreme Court's power under Article 32.
The Kerala High Court acted under its writ jurisdiction in a PIL. By directing the Union government to make the Board functional within eight weeks, it used its power to command a public authority to carry out a duty that flows from a law Parliament has already passed.
- Court: Kerala High Court; Division Bench of Chief Justice Soumen Sen and Justice V.M. Syam Kumar
- Direction: make the Data Protection Board of India functional within 8 weeks
- Case type: public interest litigation on passengers' personal data at airports
- Laws involved: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
- DPDP Rules notified: 13 November 2025; full compliance due by May 2027 (18 months)
- Board: established under Section 18 of the DPDP Act; penalties up to ₹250 crore; appeals to TDSAT
- Digi Yatra: face-recognition based airport entry, launched 1 December 2022 (Delhi, Bengaluru, Varanasi); run by the not-for-profit Digi Yatra Foundation
- Court's earlier stand: Digi Yatra cannot insist on Aadhaar; driving licence accepted; Voter ID may be considered
- Right to privacy: fundamental right under Article 21 (Puttaswamy, 24 August 2017)