[Data Protection on UPI platforms] NPCI, not RBI responsible to ensure Amazon, Google, Whatsapp comply with UPI regulations: RBI to SC

The Reserve Bank of India (RBI) has told the Supreme Court that the responsibility to ensure that tech giants like Whatsapp, Google and Amazon comply with rules and regulations governing Unified Payments Interface (UPI) platforms, lies not with the RBI but with the National Payments Corporation of India (NPCI)..In an affidavit filed before the Supreme Court, the RBI said Third Party App Providers (TPAPs) are not given any sanction by the RBI under the Payment and Settlement Systems Act, 2007 (PSS Act). "They are not system providers as defined in Section 2(q) of the PSS Act, i.e. authorised payment system operators, and therefore they do not fall under the regulatory domain of RBI directly. On the other hand, NPCI is the system provider of UPI and, therefore, comes under the regulatory radar of RBI," the RBI said..It was, therefore, the NPCI that allowed Amazon, Google and WhatsApp to operate under UPI. Consequently, RBI has said that the responsibility to ensure that these entities comply with all the rules/ regulations/ guidelines governing UPI lies with NPCI..The affidavit was filed in a plea by Communist Party of India MP, Binoy Viswam seeking directions to ensure that the data of Indian citizens collected on UPI platforms is not misused by corporations..A Supreme Court bench of Chief Justice of India SA Bobde and Justices AS Bopanna and V Ramasubramanian had issued notice in Binoy Viswam's plea in October 2020..The RBI in its affidavit said that the petition should be dismissed with cost as the PSS Act gives RBI the power to regulate and supervise the payment systems in India .."The Reserve Bank is the statutory regulatory authority for payment and settlement systems under the PSS Act. The Reserve Bank has also been vested with the powers, inter-alia, to determine policy and issue directions to the payment system operators under the provisions of the PSS Act," the affidavit filed by RBI on December 8, 2020 states. .RBI also said that while it is important that the requirement of storage of payment data only in India is met with expeditiously, it has to be ensured that "any regulatory measures do not disrupt the ongoing payment transactions under the existing payment and settlement systems of the country or adversely affect the interests of the general public.".CPI MP Binoy Viswam moves Supreme Court seeking protection of data collected on UPI platforms from misuse by giant corporations.Appearing for Viswam, Senior Counsel Shyam Divan had explained that the petition calls for protection of the data collected by these services on their UPI platforms.Divan had highlighted that the service providers are required to have their servers in India as one of the conditions laid down by the Reserve Bank of India (RBI). This, Divan argued, is where WhatsApp was not in compliance..Referring to giant corporations such as Google, Amazon and WhatsApp, the petitioner had prayed that RBI and National Payments Corporation of India (NPCI) should ensure that the data collected by these entities for the purpose of facilitating payments is not shared with their parent companies or any other third parties..The RBI in its affidavit has said that NPCI is the owner and operator of UPI and that it is NPCI which is the system provider as per the PSS Act.."Under Section 8 (1) of the PSS Act, if a system provider, (i) contravenes any provisions of this Act, or (ii) does not comply with the regulations, or (iii) fails to comply with the orders or directions issued by the designated authority, or (iv) operates the payment system contrary to the conditions subject to which the authorisation was issued, the Reserve Bank may, by order, revoke the authorisation given to such system provider under this Act," the affidavit points out. .RBI further submitted that UPI operates on a bank-led model wherein only banks can become the members of UPI. Thus, any non-bank like Amazon Pay, Google, WhatsApp, cannot be a direct participant but have to be sponsored by a bank.