The Kerala High Court has upheld the Ministry of Railways’ rule requiring Aadhaar-based one-time password authentication for online Tatkal ticket reservations, rejecting a public interest petition that claimed the policy infringed upon passenger privacy.
A division bench comprising Chief Justice Soumen Sen and Justice Syam Kumar V M ruled in a July 22 order that the mandatory verification is legally justified and meets the test of proportionality. The court observed that the system was introduced to combat historical abuses, including manipulation, fraudulent activities, and bulk ticket hoarding by automated software and unauthorized agents.
PAN Card Suggested as Alternative Option
While sustaining the policy, the bench recommended that the Indian Railway Catering and Tourism Corporation evaluate allowing PAN cards as an alternative identification method. The judges noted that PAN-linked verification also uses one-time password verification and could achieve the same objective of confirming individual passenger identities.
The judgment stems from a petition filed by Thrissur resident Bahadur Shah Anakkot Nasirali, who sought to strike down a June 10, 2025 notification issued by the Ministry of Railways. Represented by advocate S Prasath, the petitioner argued that forcing users to undergo Aadhaar verification on the IRCTC portal and mobile app breached citizens’ rights to privacy and informational autonomy without addressing technical flaws in the booking infrastructure. The petitioner also highlighted that no such authentication was mandatory prior to the June 10 decision.
Demand Regulation and Data Protection
Defending the policy, Additional Solicitor General of India P Sreekumar stated on behalf of the Railways and IRCTC that the system ensures ticket access is restricted to genuine individual travelers while blocking syndicates, touts, and automated scripts.
According to an IRCTC affidavit submitted on April 1, Aadhaar verification serves as a demand-regulating tool to ease server congestion caused by duplicate accounts and automated access, rather than increasing server processing power.
IRCTC assured the court that passenger data remains protected. The authentication process requires explicit user consent, occurs over encrypted channels, and is performed as a one-time setup rather than before every transaction. Neither IRCTC nor the Railways stores Aadhaar numbers, receiving only a binary yes-or-no verification response from the system. Additionally, passengers who prefer not to use Aadhaar verification retain the option to purchase Tatkal tickets directly at physical railway reservation counters without any such requirement.
