Supreme Court has asked the instant messaging app WhatsApp to file its response in connection to a petition seeking directions to RBI and NPCI to ensure that data collected on Unified Payment Interface payments is not exploited by sharing with their parent company or any other third party.
Three judge bench of Chief Justice S A Bobde, Justice A S Bopanna, and Justice V Ramasubramanian stated that if WhatsApp fails to reply, then the averment made in writ petition will be taken as accepted. The plea was filed by Rajya Sabha MP Binoy Viswam.
Multiple interlocutory applications have been filed in the plea which also seek the similar directions for framing to ensure that data collected on UPI platforms is not exploited and is only used for the payment processing.
However, senior counsel Arvind Dattar appearing for WhatsApp India submitted that no formal notice has been issued to the App in the plea for impleadment in the matter. Senior Counsel Kapil Sibal, also appearing for Whatsapp stated that WhatsApp Pay has received all the required permission.
Senior advocate V Giri representing Reserve Bank of India (RBI) submitted that they have submitted their response.
The petitioner’s counsel Krishna Venugopal stated that the last time the court asked the company if Israeli spyware Pegasus had preached their system, it stated that the issue was not pleaded in the plea, which is wrong.
The top court stated that it proposes to tag this plea with similar plea pending before Supreme Court and ask the Centre to file an affidavit in connection to spyware.
K Venugopal argued that despite matter being pending for months, Facebook and WhatsApp have not filed any affidavit till date.
RBI in its affidavit submitted, “It has no responsibility to conduct audit of members of United Payments Interface (UPI) ecosystem and responsibility to ensure that private firms like Google and WhatsApp comply with norms lies with National Payments Corporation of India (NPCI). The matters related to data privacy and data sharing are the domain of the central government.”
The affidavit filed by RBI also sought dismissal of the PIL. “It is submitted that RBI’s directions issued vide circular dated April 6, 2018 on storage of payment system data pertain only to payment date storage and not sharing or privacy. RBI has not issued any instructions on data sharing by TPAPs (Third Party Application Providers) or the participants of UPI. Matters related to data privacy and data sharing come under the domain of Government of India. It said that since NPCI is the owner and operator of the UPI, it would be more appropriate for them to respond on the status of compliance of WhatsApp with the system rules /procedural guidelines governing UPI,” the affidavit said.
The petitioner had claimed that RBI and NPCI had allowed participation of three of four tech giants including Amazon, Google and Facebook/WhatsApp (Beta phase) in the UPI ecosystem without much scrutiny and in spite of blatant violations of UPI guidelines and RBI regulations.
“This conduct of RBI and NPCI put the sensitive financial data of Indian users at huge risks, especially when these entities have been continuously accused of abusing dominance and compromising data, among other things,” the plea alleged.
The plea further submitted that these allegations have become particularly worrisome at a time when India has banned host of Chinese applications on the ground that those applications were or could be used for data theft and could lead to security breaches.