PhonePe files appeals before Karnataka High Court against police notice for user data

Payment app PhonePe on Wednesday appealed before a Division Bench of Karnataka High Court against a single-judge's April 29 order that upheld a police notice seeking user information in a cheating case relating to online betting apps [PhonePe Vs State of Karnataka]

A Division Bench of Chief Justice Vibhu Bakhru and Justice CM Poonacha issued notice on the appeal and listed the matter for further hearing on February 12.

Advocate Nitin Ramesh, appearing for PhonePe, argued that the single-judge failed to appreciate that UPI service providers are statutorily protected under the Payment and Settlement Systems Act, 2007 (PSS Act) and the Bankers’ Books Evidence Act, 1891 and therefore, cannot be compelled to furnish customer data merely through a Section 91 CrPC notice.

He submitted that the central question before the Court was the legality of demanding broad data sets from a UPI intermediary under Section 91.

“The issue pertains to interpretation of Section 91 of CrPC, Section 22 of the Payment and Settlement Systems Act and the Bankers’ Book Evidence Act,” Ramesh said.

He further asked whether the entire dump of information can be sought from a UPI service provider through a Section 91 notice issued by a police officer.

PhonePe stressed that the company is licensed and regulated under the PSS Act and cannot be treated like any ordinary intermediary for the purpose of data disclosure.

The matter related to a cheating case filed in 2022. A man claimed that he had used PhonePe to make multiple deposits of money (about ₹6,000 in total) with a sports betting website, while India versus South Africa cricket matches were going on.

However, he was later unable to withdraw money from his virtual wallet and the website was eventually blocked from access.

He filed a complaint seeking return of his money and accused the website of cheating him.

In connection with this complaint, the police issued a notice to PhonePe, informing it of the registration of a complaint about the alleged use of its platform for the deposit of money with online gambling websites.

The notice was issued in December 2022, under Section 91 (summons to produce document or other thing) of the then-prevailing Code of Criminal Procedure (CrPC).

The notice also sought information from PhonePe on the details of the user to whom such payments were made, whether PhonePe did any due diligence before onboarding customers, whether PhonePe suspected any fraud and whether it had noticed any online gambling-related activity on its platform. It was further asked to furnish a list of customers who are involved in online gambling.

PhonePe challenged this notice. It argued that it had a legal obligation to protect the confidentiality of user data under the Payment and Settlement System Act, 2007 and the Bankers Books Evidence Act, 1891, and that it can only share such private information if a court passes an order to do so.

The single-judge, however, held that the laws cited by PhonePe permit the sharing of information with statutory authorities including investigating agencies. It added that the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2011 too require online intermediaries to provide information to investigation officers within 72 hours of a lawful request being made.

This ruling has now been challenged by PhonePe before Division Bench.