In UPI Data Privacy Case, SC Issues Notices To Facebook, Google, Amazon

The Supreme Court of India, on Monday, sought responses from Facebook, Google, WhatsApp and Amazon to a plea that seeks to ensure data privacy of users of UPI platforms. 

The public interest litigation (PIL), filed by Communist Party of India (CPI) Member of Parliament (MP) Binoy Viswam, seeks directions to the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI) to ensure data privacy of users of third-party payment apps and e-wallets being operated by players such as Paytm, PhonePe, Google Pay and WhatsApp Payments (WhatsApp Pay). 

An earlier impleading application (IA) in the court had stated that the PIL was for RBI and NPCI to ensure that WhatsApp is not permitted to launch full-scale payments operations in India, without fulfilling all legal compliances to the satisfaction of the court regarding the requisite regulatory compliances. In the last hearing on the matter, on January 28, 2021, the court had issued a notice on the IA. 

On Monday, a bench headed by Chief Justice of India SA Bobde issued a notice to WhatsApp India, after Advocate Krishnan Venugopal, appearing on behalf of the petitioner, said that despite the petition being pending for months, WhatsApp and Facebook hadn’t filed counter-affidavits in the matter. 

Meanwhile, another petition seeking an explanation from WhatsApp and Facebook on whether the Pegasus malware had breached their system, was tagged to the original matter of user privacy on UPI platforms. 

Senior Advocate Arvind Datar, appearing for WhatsApp, said that a detailed counter would be filed by the company. 

During the last hearing, RBI had filed a counter-affidavit claiming that the responsibility to ensure that companies like Amazon, Google and WhatsApp operate in compliance with laws governing UPI lies with NPCI and not RBI. 

The original petition contends that both RBI and NPCI, “have permitted the three members of ‘Big Four Tech Giants’ i.e. Amazon, Google and Facebook/WhatsApp (Beta phase) to participate in the UPI ecosystem without much scrutiny and inspite of blatant violations UPI guidelines and RBI regulations.”

It is worth mentioning WhatsApp had to wait for nearly two years since 2018, for regulatory clearances from both RBI and NPCI, before it was allowed the full-scale launch of its UPI payments service WhatsApp Pay by NPCI in November last year. NPCI relied on Deloitte’s audit of WhatsApp Pay’s compliance with data localisation norms. 

“NPCI is saying the technology audit by Deloitte is sufficient. They are not saying that we have verified through our own means whether they are storing data in India or not. India has enough technical experts in IITs and other places. Why not set up an independent committee to review the compliance?,” Sriram Parakkat, a lawyer representing Viswom, had said last week. 

The next hearing in the matter will be held after four weeks, by which time, all concerned parties are required to file their responses. 

Notably, WhatsApp is facing legal challenges to its updated privacy policy in India, forcing it to tweak the language of the privacy policy document. 

Hearing a separate matter on Monday itself, the court issued more notices to Facebook, WhatsApp and Twitter, in a plea which sought to make these leading social media platforms directly responsible for spreading hate speech.

Note: We at Inc42 take our ethics very seriously. More information about it can be found here.