Discuss the privacy concerns in facial-recognition-based services such as Digi Yatra. How far does the DPDP framework address them?

Digi Yatra uses facial recognition to verify air travellers, so a passenger's face becomes a reusable biometric credential. The Kerala High Court recently barred Digi Yatra from insisting on Aadhaar. It also directed the Centre to make the Data Protection Board functional within eight weeks [1]. Both orders show that the DPDP framework addresses these concerns only partly.

Privacy concerns in facial-recognition services

• Data that cannot be changed: a leaked password can be reset, but a leaked face template cannot. The harm from a breach is permanent.
• Forced consent: making Aadhaar mandatory for boarding takes away real choice. The HC noted that a driving licence is accepted and expects Voter ID to be considered too [1].
• Profiling: combining travel records with identity data can build a "360-degree profile" usable for surveillance [2].
• No working regulator: the petitioners wanted airport data handling to follow the DPDP Act and Rules, but the Board that enforces them was not working [1].

How the DPDP framework addresses them

• Deterrent penalties: a Data Fiduciary (the entity that decides how data is used) can be fined up to ₹250 crore for weak security safeguards. Failing to report a breach can cost up to ₹200 crore [3].
• Grievance forum: the Board has a Chairperson and four Members and works online, from complaint filing to tracking. Its decisions can be appealed to TDSAT [3].
• Phased compliance: the DPDP Rules, 2025 give fiduciaries 18 months to meet these duties [3].

Gaps that remain

• Government exemptions: the Centre can exempt its own agencies from any or all provisions. Storage limitation and the right to erasure do not apply to government bodies [2].
• No compensation: the Act does not regulate harm to individuals. Unlike GDPR Article 82, a traveller whose face data leaks gets no remedy for their own loss [2].
• Board independence: members serve two-year terms and can be reappointed. In Rojer Mathew (2019), the Supreme Court warned that this arrangement increases executive control [2].
• No surveillance safeguards: there are no PUCL-style tests of necessity, and no judicial approval of the kind the UK's Investigatory Powers Act, 2016 requires [2].

In short, the DPDP framework deals with private-sector misuse through penalties and a regulator. It leaves the State's use of data and harm to individuals largely unaddressed. The way forward is to make the Board work quickly and protect its members' tenure in the Act itself. Exempted processing should need judicial approval, and individuals harmed by misuse should be able to claim compensation. Digi Yatra should stay genuinely voluntary, with other IDs accepted. Together, these steps would meet the Puttaswamy test of proportionality and protect the right to privacy under Article 21.