Passengers say CISF, airport staff are collecting biometric data without consent

As year-end travel peaked at some of the busiest airports in the country last month, air travellers took to social media to express their shock and anger at the flagrant infringement of their privacy at airports, largely through the Digi Yatra initiative being aggressively promoted by the Union government

Next time you visit an Indian airport, beware of security personnel and private staff at the entry gate of passenger buildings who may be collecting your facial biometrics without your knowledge or consent. 

As year-end travel peaked at some of the busiest airports in the country last month, air travellers took to social media to express their shock and anger at the flagrant infringement of their privacy at airports, largely through the Digi Yatra initiative being aggressively promoted by the Union government. The app, which allows for digital processing of passengers, promoting paperless and seamless movement through airports, was rolled out as an entirely voluntary programme from December 2022.

On Christmas Eve, Tavish Pattanayak, an aerospace engineering scholar in the U.S. was scheduled to fly with IndiGo out of Delhi. He skipped the queue dedicated for Digi Yatra users, who have downloaded and registered on the app, allowing them to enter the passenger building through electronic gates equipped with cameras that scan their boarding passes and faces. However, Mr. Pattanayak soon realised that passengers in his line were also being requested to look into a camera, following which the CISF personnel would click a button on the screen to give consent on their behalf for a one-time sign up for Digi Yatra.

“The security person checked my identity document and ticket and asked me to look at a screen to capture my photo. At the bottom of the screen, in tiny fonts, you are asked whether you want to enrol for Digi Yatra. It is impossible to read the text and the camera interface takes up the entire screen. But I had read the text when there was another family ahead of me, so I quickly proceeded to click no,” Mr. Pattanayak told The Hindu. However, many passengers in a rush to catch their flight were not aware of what was going on and did not ask any questions, he said.

“I don’t trust the government with my data. India has seen the world’s largest data breach, and our privacy laws are ineffective because nobody takes them seriously or implements them,” Mr. Pattanayak says, explaining why he does not wish to sign up for Digi Yatra. In October 2023, the U.S.-based cybersecurity firm Resecurity reported that personal information of over 81.5 crore Indians sourced from the Indian Council of Medical Research’s database, including Aadhaar and passport details, was being sold on the dark web.

A spokesperson for the Central Industrial Security Force (CISF) claimed that “private airport staff are collecting facial biometrics at various kiosks outside the passenger building, but CISF personnel are not involved in this exercise”. A Delhi airport official, speaking on the condition of anonymity, contradicted this statement, saying, “Our staff are assisting CISF personnel in carrying out validation, and we have now briefed our teams at entry gates to ensure passengers are educated and consent sought from them.”

Suresh Khadakbhavi, CEO of the Digi Yatra Foundation, said that enrollments to the app have been ramped up since the December peak travel season by deploying scanners with CISF personnel as well as separate kiosks manned by airport staff for a one-time sign up of passengers on the day of travel. This was meant to “expose passengers to the benefit of a smoother way to pass through various checkpoints, he said. But since most passengers are not informed that they are being registered, they may not know that they can use the paperless facility.