Razorpay-Alt News Controversy Turns Spotlight Again On Data Security, User Consent & Deplatforming

With the growing controversy around payments unicorn Razorpay and the suspension of the payment links for donations to fact-checking platform Alt News, the focus is now on the sanctity of payments data of individuals and companies sharing such data with authorities without user consent.

The concerns have grown louder as the government has looked to keep a tighter lid on financial data generated from India over the past two years, with changes such as platforms saving card data for recurring payments, card tokenisation, storage of payments data within India and more.

And even as Razorpay has claimed to be abiding by the law, there has been plenty of outrage over why data for all donors to Alt News was shared when the company could have requested authorities for a narrower scope. The company’s failure to directly inform users whose data has been shared is another point that some critics of Razorpay have highlighted.

What Happened Between Razorpay & Alt News?

On June 27, Alt News cofounder Muhammad Zubair was arrested by Delhi police in a case related to an “objectionable tweet” he had posted in 2018.

While opposing the bail application by Zubair, public prosecutor Atul Shrivastava argued that the company had received funds from foreign bank accounts in Pakistan, UAE, Syria, Singapore, and Australia. Delhi Police has also alleged that Alt News’ parent company Pravda Media received more than INR 2 Lakh in foreign funding.

It was further claimed that Alt News was not registered to receive payments from foreign accounts or cars as donations.

However, the platform has denied these allegations and claimed that only Indian bank accounts can make donations to the platform and foreign credit cards were never enabled in the Razorpay backend.

Soon after Zubair’s arrest, Razorpay suspended the payments link bringing in donations to Alt News.

Razorpay then issued a clarification over the suspension of the payment link for Alt News, claiming it abided by the laws and regulations of India. The startup said it had received a written order from law enforcement under Section 91 of the Indian Criminal Procedure Code. A Section 91 notice is issued to parties linked to ongoing cases to access material evidence.

The company added that financial services entities are mandated to comply with such notices as per the regulation under the provision of Indian law.

“Razorpay is a law-abiding, fully compliant organization. The merchant account was deactivated from the Razorpay platform temporarily, as a safety precaution, during the preliminary investigation by the law enforcement authorities. Following clarity on the issue, we have unblocked and reactivated the account,” a Razorpay spokesperson told Inc42.

But the company has not clarified whether it takes similar action against other entities also under investigation.

Responding to the blockage, Alt News claimed Razorpay had shared its donor data with the police without adequate consent. The payments link for donations have been reactivated by Razorpay after Alt News contacted the company.

Currently, Alt News’ donation page carries a disclaimer that it does not accept foreign funds as it is not registered under the FCRA.

“While we look for alternatives, we will continue with Razorpay as the donation platform for now,” Alt News said.

Deplatforming Comes To India

Zubair’s arrest has raised plenty of public concerns about the lack of due process in arrests and restrictions on online free speech. But the Razorpay involvement has also brought about questions about deplatforming by the fintech company even when the case was under investigation and no judgement has been pronounced.

In the context of the Indian internet ecosystem, deplatforming of media organisations and business entities is a rare sight. While in the West, the narrative has shifted towards ‘cancelling’ access to services for certain organisations, so far this has not been applied in any significant way in the Indian market.

The lack of explanation about the reason for suspending the payments link is another grey area, as is the lack of notifications to users over data sharing. Typically, organisations that share user account data with law enforcement inform such users via emails or in-app notifications. Razorpay has not responded to these issues.

In fact, in its lawsuit against the Indian government, Twitter has also said that the government did not inform users whose data it has accessed.

Besides Alt News, Razorpay also works with media outlets such as The Wire, News Laundry among others that have a subscription or a donation-based free news model.

This is not the first time that a major payments company has come under public fire for sharing data with the government. In May 2018, Vijay Shekhar Sharma-led Paytm was in the midst of controversy for sharing the personal data of users in Jammu & Kashmir with the Indian government, as reported by Cobrapost.

Paytm vice president Ajay Shekhar Sharma reportedly was caught on camera saying the company had handed over personal data of users after receiving a call from the Prime Minister’s office following incidents of stone-pelting in the erstwhile state.

At the time, it was alleged that Paytm had shared the data of all users in J&K, which was well beyond the purview of any particular incident involving a few citizens. Paytm denied the allegations that came at the time.

But, similarly, some media founders are arguing that Razorpay ought not to have shared the data of all donors indiscriminately. The company could have sought time to share data of just those transactions that originated outside India.

Tighter Control Over Financial Data 

In the aftermath of demonetisation in 2016, there were plenty of concerns raised about whether the push for a cashless economy will lead to financial surveillance in this manner.

The Indian government’s proposed Personal Data Protection (PDP) Bill, which is still to be tabled in the parliament, currently has clauses allowing law enforcement agencies to process personal data of users without consent for “reasonable purposes” when it is in the public interest.

The exemptions will be for prevention and detection of any unlawful activity including fraud, whistle blowing, mergers and acquisitions, network and information security, credit scoring, recovery of debt, processing of publicly available personal data and operation of search engines.

Besides this credit card companies such as Mastercard, American Express and Diners Club International were also penalised for storing data of users abroad. The RBI had restricted Mastercard from acquiring new domestic customers onto its card network from July 2021 to June 2022 because the credit card giant had violated the data localisation policy.