Karnataka HC rejects PhonePe plea against police notice for user information

Justice Nagaprasanna said privacy cannot eclipse the lawful imperative of IOs to secure evidence. “Confidentiality must coexist with accountability,” he said

BENGALURU: The Karnataka high court has ruled that digital intermediaries cannot use privacy laws or their intermediary status to avoid cooperating with lawful criminal investigations and dismissed a petition by digital payments platform PhonePe against a police request for user information linked to alleged online sports betting transactions.

Justice M Nagaprasanna said user privacy was important but the firm could not brush aside lawful investigations, especially amid the recent surge in cybercrimes

Justice M Nagaprasanna said user privacy was important but the firm could not brush aside lawful investigations, especially amid the recent surge in cybercrimes.

“The protection of consumer privacy cannot eclipse the lawful imperative of investigating officers to secure evidence and take the investigation to its logical conclusion. Confidentiality must coexist with accountability,” the high court said in its ruling on April 29. The 32-page verdict was uploaded to the high court’s website on Monday.

The court was hearing a petition filed by PhonePe challenging a notice received from the police in December 2022.

According to the police, a Bengaluru resident said that he used PhonePe to transfer about ₹6,000 to a sports betting website to place bets during an India-South Africa cricket match but was later unable to withdraw his winnings. He filed a first information report against the website after it also blocked his access. As part of the police probe, the investigating officer sought information from PhonePe.

However, PhonePe challenged the notice arguing that as a digital intermediary governed by the Information Technology Act and the Payment and Settlement Systems Act, it had no role in the transactions in question. It cited legal obligations to protect customer confidentiality under the Bankers Books Evidence Act, asserting that such data could only be disclosed through a court order.

However, the high court held that existing laws, including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2011, permit information sharing with investigating authorities. These rules mandate that intermediaries must provide requested data within 72 hours of a lawful request.

“The duty to protect data must yield, where public interest and criminal investigation intersect,” the court said.

Rejecting the argument that customer data can only be released under court orders, the court said an investigating officer was a statutory authority empowered by law. Justice Nagaprasanna stressed that the notice was not a “fishing expedition” but a targeted request tied to a legitimate probe into possible illegal financial transactions.

The court said that PhonePe, as a regulated intermediary, could not claim immunity from investigatory summons when criminal activity was suspected. It dismissed the petition, reinforcing that digital platforms must “cooperate with lawful investigations in an era increasingly dominated by cybercrime.”

.”