Google to Delhi High Court: Allowed to Share Google Pay Customer Transaction Data With Third Parties With NPCI Permission

Google India Digital Services, which operates the Google Pay app, has told the Delhi High Court that it is allowed to share customers transaction data with third parties with the prior permission of NPCI and payment service providing (PSP) banks.

The submission has been made by Google in its affidavit filed before a bench of Chief Justice D N Patel and Justice Prateek Jalan in response to a PIL seeking action against Google Pay for allegedly violating the RBI's guidelines related to data localisation, storage and sharing.

The high court on Thursday listed the matter for hearing on November 10 as the Centre and Reserve Bank of India (RBI) have not filed their responses yet.

Google, in its affidavit, has contended that under the Unified Payment Interface (UPI) procedural guidelines, issued by the National Payments Corporation of India (NPCI), apps like Google Pay are permitted to share customers transaction data with third parties and group companies with prior permission of NPCI and PSP banks.

It has also said that Google Pay only stores ordinary customer data, like name, address, email ID, and transaction related details, in accordance with the NPCI guidelines and not payment sensitive data like debit card number or UPI PIN.

A customer's payment sensitive data is stored only on the servers of the PSP bank, it has claimed.
The affidavit was filed in response to the petition by advocate Abhishek Sharma who has sought a direction to Google not to share any data from UPI switch with any other party.

Google has contended that it was complying with the NPCI procedural guidelines which govern functioning of all third party application providers (TPAPs) like Google Pay.

It has also claimed that the petition was not maintainable as Sharma has available to him several alternate remedies like the customer care feature in the app or approaching the NPCI in accordance with the Payment and Settlement Systems Act of 2007 or asking RBI to exercise its supervisory jurisdiction.

Google has further contended that there are other TPAPs like Google Pay, but the petition has been "selectively filed" against it.

Sharma, in his plea, has also sought a direction to Google to give an undertaking to not store data on its app under UPI ecosystem and further not to share it with any third party, including its holding or parent company.

The plea has claimed that the company was storing personal sensitive data in contravention of UPI procedural guidelines of October 2019, which allows such data to be stored only by PSP bank systems and not by any third party application.

Google has denied the claim, saying customers' payment sensitive data is stored with the PSP banks and Google Pay only accesses it in accordance with the guidelines.

It has also denied the allegation that it accesses customers' location to gain revenue from offering highly targeted or personalised advertising opportunities to advertisers.

Are Apple Watch SE, iPad 8th Gen the Perfect ‘Affordable' Products for India? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.