RBI counters plea filed in Supreme Court in unregulated payment App issue

RBI counters plea filed in Supreme Court in unregulated payment App issue

RBI says that the National Payments Corporation of India is responsible to ensure UPI platforms abide by laws of the land

The Reserve Bank of India (RBI) on 28 January 2021 submitted an affidavit before the Supreme Court stating that the responsibility of ensuring that the companies like Amazon, Google and WhatsApp to operate in compliance with laws governing Unified Payments Interface (UPI) lies with National Payments Corporation of India (NPCI), and not RBI.

The plea in the instant matter was filed before the Supreme Court, by Binoy Viswam, Member of Rajya Sabha, from Communist Party of India, seeking a direction to the RBI to frame necessary regulations and ensure the data of Indian citizens collected on UPI platforms was not exploited by companies like Amazon, Google, and Facebook.

The plea had prayed for the protection of the fundamental right to privacy of millions of India citizens who are using UPI, following which a notice was issued by the Apex Court on 15 October 2020.

The plea also contended that Indians' right to privacy should be protected from being misused by 'giant corporations' for their 'financial ends'. "Millions of Indians use UPI platforms for making payments and with the RBI and NPCI allowing the Big Four Tech Giants to participate in this UPI ecosystem without much scrutiny, sensitive financial data of the Indian citizens are at risk of being misused," that the Respondents RBI and NPCI have failed to fulfil, which is their statutory obligation, the plea read.

The conduct of the two authorities, as per the plea, continuously puts the sensitive financial data of Indian users at huge risk, especially because the Big Four Tech Giants have been "continuously accused of abusing dominance, and compromising data, among other things". There is also a reference to the fact that CEOs of these entities had been directed to testify in a hearing before the US Congress Judiciary Committee.

In this context, the Affidavit stated that RBI had not given approval or authority to Third Party App Provider (TPAP) and therefore, they cannot be defined as 'system providers' as per Section 2(q) of the Payment and Settlement Systems Act, 2007. RBI contended that they do not fall within the purview of the regulatory domain of RBI directly.

"On the other hand, NPCI is the system provider of UP and, therefore, comes under the regulatory radar of RBI. Since it was NPCI that allowed Amazon, Google and WhatsApp to operate under UPI, the responsibility to ensure that these entities to comply with all the Rules/Regulations/Guidelines governing UPI lies with NPCI," reverted RBI.

In addition, RBI issued directions vide circular dated 6 April 2018 on Storage of Payment System Data pertain only to payment data storage and not data sharing or privacy – "RBI has not issued any instructions on data sharing by TPAPs or the participants of UPI. Matters related to data privacy and data sharing come under the domain of Government of India".

In light of the above, the Affidavit prayed that the reliefs sought by the Petitioner do not lie with the RBI.