Kerala High Court Orders Data Protection Board to Function Within Eight Weeks

In a landmark judgment, the Kerala High Court responded to a petition that highlighted alleged privacy violations arising from the Digi Yatra digital travel system, directing the state to render the Data Protection Board fully operational within eight weeks. The court underscored the constitutional guarantee of privacy, noting that the current inertia jeopardises citizens' personal data as the scheme expands across transport hubs. By imposing a concrete deadline, the judiciary signalled its readiness to enforce data‑security standards in the digital age.

The tension underlying the ruling stems from the rapid rollout of Digi Yatra, which integrates biometric verification with ticketing, juxtaposed against an under‑resourced regulatory body tasked with overseeing data handling practices. Government officials have argued that the board's activation requires substantial staffing and technical infrastructure, while civil‑society groups contend that delays expose millions of travellers to profiling and data breaches. The court's directive forces the executive to reconcile these competing imperatives, potentially reshaping the governance model for emerging technologies.

The immediate fallout includes a scramble among ministries to appoint board members, draft procedural guidelines and establish grievance redress mechanisms. Transport operators are now required to audit their data pipelines, a process that may temporarily disrupt service continuity. Over the coming months, the enforced activation is likely to set a benchmark for other Indian states, prompting a cascade of data‑protection reforms that could elevate national standards and influence future legislative drafts on digital privacy.