SC Issues Notice On CPI MP Binoy Viswam's Plea Seeking Data Protection On UPI Platforms

A Bench headed by Chief Justice of India SA Bobde issued issued notices to the Centre, Google, Amazon, Facebook and WhatsApp in the plea, despite objections from the Respondents who stated that issuance of notice by the Court would prevent them from functioning and would practically act as a stay.

Filed by Advocate-on-Record Sriram Parakkat, the plea seeks for "the protection of fundamental right to privacy of millions of Indian citizens who are using Unified Payments Interface (UPI)". Senior Advocate Shyam Divan and Advocate MS Vishnu Shankar appeared in the matter on behalf of the Petitioner.

Stating that in India, the UPI system is regulated and supervised by Respondents Reserve Bank of India and National Payments Corporation of India, the plea contends that they have failed to fulfil their statutory obligations of protecting and securing the sensitive data of users, thereby comprising their interest by allowing non-compliant foreign entities to operate its payment services in India.

The plea goes on to submit that RBI and NPCI "have permitted the three members of 'Big Four Tech Giants' i.e. Amazon, Google and Facebook/WhatsApp (Beta phase) to participate in the UPI ecosystem without much scrutiny and inspite of blatant violations of UPI guidelines and RBI Regulations".

This conduct of the two authorities, submits the plea, invariably puts the sensitive financial data of Indian users at huge risk, especially in light of the fact that the Big Four Tech Giants have been "continuously accused of abusing dominance, and compromising data, among other things". There is also a reference to the fact that CEOs of these entities had been directed to testify in a hearing before the Judiciary Committee of US Congress.

"Although these entities are based in United States and take Indian data abroad, however, in absence of any strong scrutiny and responsibility the data shared on their platform is at very high risk of being misused. Moreover, these entities in the past have not only been blamed for misusing the data of its users, but has also been accused of reneging the promises made to the law makers and regulators".

However, it is stated in the plea, instead of actively looking into the allegations, RBI and NPCI have turned a blind eye and have permitted their operation on UPI platforms. Referring to an April 2018 circular issued by RBI directing all system providers to ensure data relating to payment systems operated by them to be stored in India, the plea submits that system providers, especially WhatsApp and Google Pay, have failed to follow the deadline of October 2018.

RBI, however, in complete disregard of the financial data of users, toned down the Circular in an FAQ and clarified that in cases of Data Processing done abroad, the data should be deleted from the systems and brought back to India within 24 hours. The plea submits that the FAQ was illegal and ultra vires the Circular issued, and prays for the same to be declared so.

The plea goes on to state that the entities have failed to comply with even the diluted data localization norms and, that RBI and NCPI have failed to take any action against them, thereby "jeopardizing the security of payments data of Indian citizens".

Positing that these entities already have access to immense personal data of millions of Indian users, "if they are permitted to collect unrestricted financial data of Indian users while operating at the UPI platform, the same will give them draconian control over sensitive India data".

"Further, in absence of any compelling state regulation, accumulation of such kind of data at such a large scale is also violative of Article 14 of the Constitution of India. Thus, the continuation of Amazon Pay, Google Pay and WhatsApp Pay, without proper safeguards ensuring that no data accessed by these entities through its payment services would be transferred outside India, stored indefinitely and shared with parent companies, would be against national interest".

In light of the above, the plea prays for directions to RBI and NPCI to ensure that WhatsApp Pay is not permitted to launch full-scale operations without fulfilling all legal compliances to the satisfaction of the Supreme Court.

It further prays for RBI to frame necessary regulations in an order to ensure that the data collection on UPI Platform is not exploited/used by the participants in any manner other than for processing of payments, and to ensure that the data collected by WhatsApp Pay, Google Pay and Amazon Pay is not shared with their parent company or any other third party.