India Supreme Court seeks WhatsApp reply in petition against sharing mobile payment system data

The Indian Supreme Court on Monday issued a notice seeking a reply from the instant messaging service WhatsApp, owned by Facebook, Inc., in a petition against sharing of data collected on Unified Payment Interface (UPI) platforms. Similar big tech companies with payment platforms, such as Amazon Pay by Amazon, Inc. and Google Pay by Google, Inc., have also been impleaded as respondents in the proceedings.

The petition had been filed in September against the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI) by Binoy Viswam, a member of the parliament. The RBI is India’s central bank responsible for regulating the issue of banking notes and keeping of reserves. It is also the statutory body for regulating banks and payment systems. NPCI is one of the organizations authorized by the RBI to operate various retail payment systems in India under section 7 of the Payment and Settlement Systems Act, 2007.

Viswam’s plea requests the court to direct the RBI and NPCI to fulfill their statutory obligation to protect sensitive user data and ensure that the data collected on UPI platforms such as Amazon Pay, WhatsApp Pay and Google Pay is not shared with these platforms’ parent companies or other third parties. It alleges that the tech giants are in “blatant violation” of UPI guidelines as well as RBI regulations, and that the regulators are “compromising the interest of the Indian users by allowing non compliant foreign entities to operate its payment services in India.”

In its reply filed in January, the RBI denied all allegations, including that of “toning down” its regulations to oblige the big tech. The RBI’s 2018 circular requires system providers to ensure all “data relating to payment systems operated by them is stored in a system only in India.” According to the central bank, Amazon and Google’s compliance with data storage has been assessed by NPCI. WhatsApp has averred its compliance and the same is under review by NPCI.

The RBI also stated that matters of data privacy and sharing are the central government’s domain and any regulatory measure must ensure expeditious compliance without “[disrupting] the ongoing payment transactions under the existing payment and settlement systems of the country or adversely [affecting] the interests of the general public.”

The bench, comprising of Chief Justice SA Bobde and Justices AS Bopanna and V Ramasubramanian, has given WhatsApp four weeks to file its reply, after which the matter will be listed.