Delhi HC Rejects Plea for Data Protection in Travel Industry

The Delhi High Court dismissed a plea on Wednesday that sought directives for the Centre to implement measures ensuring the confidentiality of personal data collected by international travel companies during ticket bookings.

The plea expressed concerns about the potential misuse of Indian citizens' data, including Aadhaar and passport details, by three foreign-owned corporations: MakeMyTrip, GoIbibo, and SkyScanner. It was highlighted that some of these companies have partial or complete Chinese investment, raising concerns about the security of sensitive personal information.

The plea, filed by advocate Ashwini Kumar Upadhyay, was rejected on the grounds that the petitioner should have approached the government with his concerns rather than directly petitioning the court. The petition underscored the need for stringent data protection measures in accordance with a Supreme Court ruling.

Citing the Digital Personal Data Protection Act, 2023 (DPDP Act), the plea argued that the Act's jurisdiction extends to the processing of digital data both within India and abroad, especially concerning goods or services offered to individuals in India. The petitioner stressed the importance of the government demanding clarity from these travel companies about their data protection practices, particularly for international operations.

The plea also referenced provisions of the Act which require data fiduciaries to inform data principals about the collection, use, and rights concerning their personal data. It emphasized the obligations of data fiduciaries to maintain data accuracy and notify relevant parties promptly in case of a data breach.

Moreover, the Act mandates the appointment of a data protection officer based in India and allows individuals the right to access summaries of their data, how it's used, and who it's shared with. These provisions, the plea argued, are essential for safeguarding individual privacy and data security in the digital era.