Digi Yatra policy must clarify data deletion rules, privacy concerns: study

The policy for Digi Yatra – a digital platform to verify air travellers using biometric data – needs to spell out all the rules related to the deletion of passenger information from the database once the travel is complete, according to a study instituted by NITI Aayog. Need cybersecurity audits The study recommended that there must be frequent cybersecurity audits and vulnerability testing of the Digi Yatra platform to ensure that reliability, usability, and information security in the ecosystem are a subject of continuous engagement and are adaptive to the rapidly evolving threats that exist in this sphere. According to the study, the Digi Yatra SOP must specify timelines and purposes for the retention of different data types within the Digi Yatra Central Ecosystem, beyond which personal data is deleted. Amid persisting concerns over user data privacy, the Digi Yatra Foundation, in April, said the Digi Yatra Central Ecosystem never stores any of the ID credentials data, which has Personally Identifiable Information anywhere in any central repository.