SC seeks WhatsApp reply on plea for not sharing UPI data with any third party
A three-member bench including Chief Justice SA Bobde said that if WhatsApp does not file its reply, then the averment made in the writ petition filed by Rajya Sabha MP Binoy Viswam will be taken as accepted.
The Supreme Court on Monday asked instant messaging app WhatsApp to file its response on a plea seeking a direction to the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI) to ensure that data collected on Unified Payments Interface (UPI) platforms is not shared with the parent company or any other third party under any circumstances.
A bench of Chief Justice SA Bobde and Justices AS Bopanna and V Ramasubramanian said if WhatsApp does not file its reply, then the averment made in the writ petition filed by Rajya Sabha MP Binoy Viswam will be taken as accepted.
Several interlocutory applications have been filed in the plea, which also seek direction for framing regulation to ensure that data collected on UPI platforms is not exploited or used in any manner other than for processing payments.
Senior advocate Arvind Dattar, appearing for WhatsApp India, said no formal notice has been issued to it in the plea for impleadment in the matter.
Senior advocate V Giri, appearing for RBI, informed the top court that they have filed their reply in the matter.
Senior advocate Kapil Sibal, also appearing for WhatsApp, said WhatsApp Pay has received all necessary permission.
Senior advocate Krishna Venugopal, appearing for the petitioner, said the last time the court had asked WhatsApp if Israeli sypware Pegasus had breached its system, the company had stated that the issue was not pleaded in the petition, which is wrong.
The bench said that it proposes that the petition be tagged with a similar one pending in the top court and asked the Centre to file an affidavit on the issue of spyware.
Venugopal said that till date Facebook and WhatsApp have not filed a counter-affidavit in the matter, even though the petition has been pending for months and they should also be asked to file a counter-affidavit.
At the fag end of the hearing, the CJI told the counsels for WhatsApp that pleas challenging its new privacy policy are pending before the Supreme Court and posted the matter for further hearing after four weeks.
In its affidavit, RBI has told the top court that it has no responsibility to conduct audit of members of the UPI ecosystem and the duty to ensure that private firms like Google and WhatsApp comply with norms lies with NPCI.
RBI also said matters related to data privacy and data sharing are the domain of the central government.
The banking regulator also sought dismissal of the public interest litigation filed by Viswam seeking direction to it to frame regulation to ensure that data collected on UPI platforms is not exploited or used in any manner other than for processing payments.
The affidavit said: "It is submitted that RBI's directions issued vide circular dated April 6, 2018 on storage of payment system data pertain only to payment date storage and not sharing or privacy.
"RBI has not issued any instructions on data sharing by third party application providers (TPAPs) or the participants of UPI. Matters related to data privacy and data sharing come under the domain of the government of India."
RBI said that since NPCI is the owner and operator of UPI, it would be more appropriate for them to respond on the status of compliance of WhatsApp with the system rules/procedural guidelines governing UPI.
Earlier, WhatsApp had denied in the court the allegations that its data can be hacked by Pegasus, which had led to a controversy last year over breach of privacy following claims that Indian journalists and human rights activists were among those globally spied upon by unnamed entities.
Prior to this, on October 15 last year, the apex court had issued notice to RBI and others on Viswam's plea seeking direction for framing regulation to ensure that data collected on UPI platforms is not exploited or used in any manner other than for processing payments.
It had also sought responses of the Centre, RBI, NPCI and others including Google Inc., Facebook Inc., WhatsApp, and Amazon Inc. on the plea.
RBI and NPCI have permitted the three members of the "Big Four Tech Giants", i.e. Amazon, Google and Facebook/WhatsApp (Beta phase), to participate in the UPI ecosystem without much scrutiny and in spite of blatant violations of UPI guidelines and RBI regulations, the plea claims.
The plea has alleged that this conduct of RBI and NPCI put the sensitive financial data of Indian users at huge risk, especially when these entities have been accused of abusing dominance and compromising data, among other things.
It said these allegations have become particularly worrisome at a time when India has banned a host of Chinese applications on grounds that they were or could be used for data theft and could lead to security breaches.
The plea has further sought a direction that RBI and NPCI ensure WhatsApp is not permitted to launch full-scale operations of WhatsApp Pay in India without fulfilling all legal compliances to the satisfaction of the court regarding requisite regulatory compliances.
Edited by Lena Saha