Digi Yatra Foundation says no risk of data theft on Digi Yatra app

Digi Yatra Foundation on Thursday said there is no risk of data theft on the Digi Yatra app amid privacy concerns raised in certain quarters about the application which will be used for facial recognition-based air travel solutions.

The airports at Delhi, Hyderabad and Bengaluru recently launched a beta version of the app.

With Digi Yatra, passengers' entry at airports is automatically processed based on a facial recognition system at various checkpoints, including at security check areas.

In a statement, a Digi Yatra Foundation spokesperson said there is no risk of data loss, data theft or breach of data relating to a passenger's Personal Identifiable Information (PII) or personal details as they are not stored in any central server or location.

A not-for-profit company, Digi Yatra Foundation is the nodal body for Digi Yatra.

''The passengers' digitally Verifiable Credentials (VC) like Identity data, Health data, Travel data or any other travel-related data like visas etc are stored on their own smartphone in the Digi Yatra Central Ecosystem (DYCE) or Digi Yatra App,'' he said.

According to the spokesperson, the VC data is shared from 24 hours to 2 hours before the scheduled departure time with the relevant verifiers, that is the CISF deployed at the airports only when a passenger gives consent on the app when s/he wants to travel.

''These data are purged automatically from the system on the same day within a few hours post departure,'' he added.

In the new DYCE, the spokesperson said the processes are fully automatic and there is no human intervention at any stage, right from enrolment to travel.

''The PII data is encrypted and stored in the passengers' own smartphone in the wallet of the DYCE (Digi Yatra) app and used only if they give their consent,'' he added.

Concerns about the privacy of passengers using the app have been raised in certain quarters.

''The DYCE is architected using Self-Sovereign Identity (SSI), Decentralized Identifiers (DID), a Distributed Ledger (Blockchain) and uses Verifiable Credentials as per the W3C standards (Worldwide Web Consortium)... the SSI is a fundamentally Privacy by Design/Default process which complies with the data privacy laws of the land,'' he said.

The foundation's shareholders are Airport Authority of India (AAI), Cochin International Airport Ltd (CIAL), Bangalore International Airport Ltd (BIAL), Delhi International Airport Ltd (DIAL), Hyderabad International Airport Ltd (HIAL) and Mumbai International Airport Ltd (MIAL).