Digi Yatra to Pilot Face-Based Boarding for International Departures at Five Airports, Seeks EU Interoperability

The news

New Delhi. Digi Yatra, the facial-recognition system that lets domestic passengers pass airport gates without paper ID, is preparing to extend its biometric travel system to international departures and is working on interoperability with the European Union’s equivalent framework, The Hindu reports. Facial recognition here means a camera at the gate compares a traveller’s live face with a photograph already verified and linked to the boarding pass. A pilot for international departures will run between October and December at Bengaluru, Delhi, Hyderabad, Kochi and Mumbai airports, Digi Yatra CEO Suresh Khadakbhavi told the paper. It will test electronic passport-based enrolment: a traveller scans an e-passport — a passport carrying a chip that stores the holder’s data and photograph — and verifies identity with a selfie. The resulting digital credential will be stored on the passenger’s phone and linked to a boarding pass that the airline issues before the passenger reaches the terminal. Air India and IndiGo are expected to join; the trial covers Indian and foreign nationals departing on international flights. It will first be used at entry points and security checkpoints; immigration stays out of phase one because of its regulatory and operational sensitivity. The trial will gather passenger feedback before any wider rollout, including possible domestic use by foreign travellers. Digi Yatra is also working on interoperability with the EU Digital Identity, which lets EU citizens, residents and businesses store and share verified identity data and official documents. Through their APTITUDE consortium, the platform aims to enable cross-border sharing of travel credentials within three to six months; the longer-term objective is for a passenger flying from India to Europe to share verified credentials with both the departure and destination airports. The effort is part of a broader “self-sovereign identity” push — a model in which the individual, not a central database, holds and chooses to share verified credentials — under the International Air Transport Association’s One ID initiative for contactless air travel. Domestically, Digi Yatra is active at 39 airports and should reach 64 by March 2027, per the Civil Aviation Ministry. The report says face recognition is “mandatory” at terminal entrances and security checkpoints where the system is available, but face-based boarding remains uneven across airports and airlines; officials attribute the inconsistency to investment decisions, infrastructure gaps and differing operational priorities. The syllabus link is GS3 on IT awareness and GS2 on e-governance and privacy.

Static syllabus linkage

1. Digi Yatra is run by a not-for-profit company, not by a government department. The Digi Yatra Foundation was set up in 2019 as a joint venture company under Section 8 of the Companies Act, 2013, which governs companies formed to promote objects such as commerce, science or social welfare that apply their income to those objects and pay no dividend. Per a PIB release of the Civil Aviation Ministry, the Airports Authority of India holds 26% of its shares and the operators of Bengaluru, Delhi, Hyderabad, Mumbai and Kochi airports hold the remaining 74% equally. The Ministry describes it as a decentralised, mobile wallet-based identity management platform. Because it is a company rather than a department, questions have been raised about whether it is fully answerable under the Right to Information Act, 2005.
2. The DPDP Act, 2023 governs how Digi Yatra may use a face. Under the Digital Personal Data Protection Act, 2023, personal data may be processed on the basis of the data principal’s consent, which must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, or for certain legitimate uses listed in the Act. The data fiduciary must use the data only for the stated purpose, erase it when that purpose is served, and protect it with reasonable security safeguards. A data principal may withdraw consent as easily as it was given. Unlike the European law, the Act does not create a separate category of sensitive personal data, so biometric data gets no higher tier of protection in the statute itself.
3. Puttaswamy (2017) requires any intrusion into privacy to be proportionate. In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge bench of the Supreme Court held that privacy is a fundamental right protected under Article 21 and Part III. Any State intrusion must satisfy legality (a law must exist), a legitimate aim, proportionality between the measure and the aim, and procedural safeguards against abuse. In the Aadhaar judgment of 2018, the Court applied this test to biometric identification and struck down certain uses while upholding the core scheme. A facial-recognition system backed by the state must pass the same test, and voluntariness is one of the strongest arguments in its favour.
4. The EU’s rules and the aviation bodies set the terms for cross-border identity. The EU General Data Protection Regulation (GDPR) treats biometric data used to identify a person as a special category whose processing is prohibited except under listed conditions such as explicit consent. Under Article 45 of the GDPR, the European Commission may adopt an adequacy decision finding that a non-EU country offers an essentially equivalent level of protection, allowing data to flow freely; India has no such decision. The International Civil Aviation Organization (ICAO), a UN specialised agency created by the Chicago Convention of 1944 and headquartered in Montreal, sets the global standard for machine-readable and electronic passports in its Document 9303. The International Air Transport Association (IATA), whose One ID initiative Digi Yatra is following, is an industry association of airlines, not an inter-governmental body.

Why UPSC loves this

1. Digital public infrastructure and privacy are paired themes in GS2 and GS3. UPSC has asked about the right to privacy after Puttaswamy, about Aadhaar, and about the risks and benefits of facial recognition in governance. Digi Yatra is the live example of a biometric system run through a company rather than a statute, which is exactly the kind of institutional question Mains examiners like to probe.
2. Prelims tests which body does what. Questions distinguishing ICAO from IATA, asking under which Act a not-for-profit company is registered, or what the DPDP Act means by a data fiduciary are likely. Learn the pairs: ICAO sets passport standards and is a UN agency; IATA is an airline trade body that runs One ID.
3. Cross-border data flows are a trade and foreign-policy question. Questions on India–EU relations and on data localisation can use this story, since interoperability with the EU Digital Identity will test whether Indian protections are accepted as adequate by European regulators. It links GS2 bilateral relations to GS3 technology.

Analysis

1. Holding the credential on the phone is the design choice that makes this defensible. The strongest privacy criticism of biometric systems is the central honeypot: one database of faces that can be breached or repurposed. A credential stored on the traveller’s phone and shared only at the gate is the self-sovereign model, and if the design really keeps no central store, most of that risk falls away. The catch is that the promise is architectural and can be changed quietly by a software update. That is why the design should be written into binding rules and audited, not left to the goodwill of a company.
2. Keeping immigration out is prudent, but it also limits the gain. Immigration is where a traveller’s identity is checked against watch lists by the state, and mixing that with a private company’s credential would raise serious questions of legality under the Puttaswamy test. Leaving it out of the first phase is therefore wise. But the queues that frustrate international passengers are largely at immigration, so the pilot covers the easy parts of the journey. The real test of the EU link will come only when a border authority, not an airport operator, is asked to rely on the credential.
3. Interoperability with Europe is really a test of India’s data law. The EU treats biometric data as a special category and allows transfers abroad freely only to countries it finds adequate, and India has no adequacy decision. A traveller sharing credentials voluntarily may be enough for a pilot, but a scaled system linking airports will invite scrutiny of India’s DPDP Act, especially its broad exemptions for government processing and its lack of a sensitive-data tier. The counter-view is that consent-based, user-held credentials may not need adequacy at all. Either way, the project could become a quiet lever for strengthening Indian data protection.
4. “Mandatory” is the word to watch. The report says face recognition is mandatory at entrances and checkpoints where the system exists, while Digi Yatra has been sold as optional. If a manual lane remains, consent is real; if the manual lane shrinks through neglect, consent becomes a formality, which is how voluntary systems drift into compulsory ones. A proportionality analysis turns on this detail. The Civil Aviation Ministry should publish a clear rule that manual verification will always be available and equally quick.
5. The governance model needs to catch up with the scale. A company owned by AAI and five airport operators is now running identity checks at 39 airports, heading to 64, and wants to plug into a foreign identity system. Section 8 status gives flexibility but weak public accountability, and a statute or at least binding rules would settle questions of RTI coverage, audit, grievance redress and liability for errors. Uneven adoption, which officials blame on investment and infrastructure gaps, also shows that without a framework the benefits depend on each airport’s commercial choices. Scale should bring statutory clarity, not just more gates.

Administrator's brainstorm