SC notice on privacy concerns to Google, WhatsApp, Amazon UPIs

According to the petition, sensitive financial data of Indian users was at huge risk as these private entities are based abroad and can use the data of Indian citizens abroad in the absence of strong scrutiny by RBI

The Supreme Court on Monday issued notices to WhatsApp Pay, Google Pay and Amazon Pay on a petition raising concerns over data protection on their unified payment interface. The petition was filed by Rajya Sabha Member of Parliament (MP) Binoy Viswam from Communist Party of India (CPI).

Representational image. (AP)

Although a notice on the petition was earlier issued by the top court on October 15, 2020, responses were filed only by the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI). But with the absence of any response from WhatsApp Pay, Google Pay and Amazon Pay who were named as parties in the petition, Viswam’s counsel senior advocate Krishnan Venugopal informed the court that formal notice must be sent to them as well.

The three-judge bench headed by Chief Justice of India (CJI) SA Bobde issued a notice on the petition and also on an intervention filed by two information technology professionals Vaibhav Gupta and Yedhu Krishna Menon. The bench sought responses from the UPI platforms and posted the matter for hearing after four weeks.

According to the petition, sensitive financial data of Indian users was at huge risk as these private entities are based abroad and can use the data of Indian citizens abroad in the absence of strong scrutiny by RBI. The petition cited an April 2018 circular of RBI that required all UPI operators to ensure that all the data related to payment systems operated by them is stored in India. The operators were asked to comply with the requirement within six months.

Subsequently, RBI filed an affidavit denying any role in this regard. The banking regulator told the top court that the NPCI has the responsibility to ensure the UPIs operate under the laws that govern them. Since the permission to operate UPIs has been granted by NPCI, the RBI has no regulatory control that can be exercised over UPIs operated by WhatsApp/Facebook, Google and Amazon.

On Monday, the CPI MP also filed an additional affidavit to bring on record the threat to privacy posed by WhatsApp by highlighting the case of the Pegasus Spyware attack on thousands of WhatsApp users last year which exposed the vulnerability of content shared on WhatsApp. Viswam, in a separate application, pointed out a recent incident involving the TRP scam where conversations between a top journalist and ex-CEO of Broadcast Audience Research Council (BARC) were leaked.

The application filed through his lawyer Sriram Parakkat said, “It is still not clear as to how these chats made their way into the public domain, when WhatsApp guarantees end-to-end encryption of messages sent within the application. These incidents raise serious questions to the sanctity and security of conversations on the application, and in the case of the Payments service offered by the application, the concern is not only limited to private conversations, but even more sensitive data that must be protected.”

The Supreme Court is already seized of two petitions on the issue of safety of UPIs and lack of regulatory regime to ensure protection of data exchanged on these forums. The first petition was filed by NGO Centre for Accountability and Systemic Change while the second petition was filed specifically against WhatsApp Pay by an unregistered think tank called Good Governance Chambers.