Kerala High Court tells the Centre to make the Data Protection Board functional in eight weeks

The news

Kochi. A Division Bench of the Kerala High Court, Chief Justice Soumen Sen and Justice Syam Kumar V.M., has directed the Union government to make the Data Protection Board under the Digital Personal Data Protection (DPDP) Act, 2023 functional within eight weeks, The Hindu and LiveLaw report. It disposed of a public interest litigation asking that passengers’ sensitive personal data at airports be collected, stored and processed in strict compliance with the Act and the DPDP Rules, 2025, saying “the privacy of citizens is being compromised”. It had asked whether the Board under Section 18 existed, and had earlier ruled that Digi Yatra, the portal that verifies travellers at airports by matching their face, could not insist on Aadhaar. It recorded that Digi Yatra now accepts Aadhaar and the Driving Licence, and expects the Voter ID to be considered too.

Static syllabus linkage

1. The DPDP Act, 2023 rests its enforcement on the Data Protection Board. Section 18 establishes the Data Protection Board of India; the Central Government appoints its chairperson and members (Section 19(2)). Civil courts cannot hear matters the Board is empowered to decide (Section 39). Per PIB (November 2025), the four-member Board works digitally and its orders are appealable to TDSAT; the highest penalty, up to ₹250 crore, is for failing to keep reasonable security safeguards.
2. Privacy is part of Article 21; High Courts enforce it under Article 226. Justice K.S. Puttaswamy v. Union of India (2017) held that any intrusion on privacy needs a law, a legitimate aim and proportionality. The 2018 Aadhaar judgment struck down Section 57, which let private firms demand Aadhaar. Article 226 lets High Courts issue writs for fundamental rights and “for any other purpose”.

Why UPSC loves this

1. Are statutory rights real when the regulator that enforces them is not working?. GS2: “statutory, regulatory and various quasi-judicial bodies” and “issues arising out of the design and implementation” of policies. Dimensions: privacy as a fundamental right, the regulator’s independence, and consent in digital public services.

Analysis

1. Until the Board sits, the Act’s rights cannot be enforced. A complaint goes first to the company or department; after that only the Board can hear it, because the Act keeps civil courts out. So a traveller whose face data is misused has nowhere to go today; the court had to ask whether the Board even existed. The other view: the Rules allow 18 months, so the regime was never meant to bite at once. That holds for firms’ duties, not for the grievance forum.
2. A court setting a deadline for the executive is enforcement, not policy-making. Courts do not run the government. But Parliament itself created the Board; the court only asks that Parliament’s law be carried out, the classic use of mandamus. The strongest objection is that courts often issue directions governments ignore: the Supreme Court’s police-reform directions in Prakash Singh (2006) are still only partly followed. That argues for a narrow, checkable order, which an eight-week deadline is, not for silence.
3. Lens — Innovation and safeguards: paperless boarding is good engineering, but consent and trust need a referee. Digi Yatra means faster queues and fewer paper checks. But consent counts only if refusing is easy: if the manual lane crawls, saying no costs time, which is why the court barred insisting on Aadhaar, echoing the 2018 judgment. And the Centre appoints every Board member while the Act lets it exempt notified State agencies under Section 17(2)(a). The other view: a new body needs State capacity to start; fixed tenure and published reasons can build independence later.

Administrator's brainstorm