Law students move Bombay High Court alleging breach of privacy by Truecaller App; claim app collects sensitive user data

The Bombay High Court on Wednesday issued notice on a public interest litigation (PIL) petition seeking directions against the mobile application Truecaller for allegedly accessing contact details of users and auto-registering the users on Unified Payments Interface (UPI) linking their bank accounts. (Shashank Posture & Ors. v. Union of India & Ors.).The petition filed by law students, siblings Shashank and Manasi Posture and Bisma Mulla claimed that there was an immediate need to protect millions of users due to unlawful collection of their data.They stated that such collection of data would cause a negative impact on the national security and amounted to breach of privacy of users. .The petitioners submitted that the personal sensitive financial data like the bank account details or credit/debit card details or UPI details was breached by Truecaller after the users were automatically registering their users on the UPI without seeking consent.The Truecaller allegedly made UPI IDs for its users who had accounts in the ICICI Bank..After a brief hearing, a Bench of Chief Justice Dipankar Datta and Justice GS Kulkarni issued notice to the Centre, State governments, National Payment Corporation of India (NPCI) and ICICI Bank seeking their response..Referring to Truecaller's official website, the petitioners submitted that Truecaller collected information including geo-location, IP address, device ID, as well as browsing history and data on the calls being made..The petitioners stated that by virtue of their privacy policy (which was a standard form of contract), Truecaller was obtaining consent from its users for obtaining a third party's data which was a void consent and a violation of fundamental right under Article 21 of the Constitution. By inserting an exemption clause in the privacy policy, the users barely had any choice or alternative but to adhere to the terms of service..The petitioners submitted that the data gathered by Truecaller could be used for marketing and advertising calls thereby, infringing privacy of the users.Truecaller also allegedly collected data from users even after deactivation of their accounts, the petition stated..The NPCI, an umbrella organisation for operating retail payments and settlement systems, was created by the Reserve Bank of India and Indian Banks Association for creating a robust payments and settlement infrastructure in India.The grievance against NPCI in the petition was that it purportedly failed to perform its duties of monitoring the functioning of Truecaller and ICICI Bank..The petitioners submitted that they approached all respondents to find a solution to their grievance. They did not receive any responses except from Truecaller, which was not a satisfactory response.Petitioners also approached the Public Grievance Portal created by the Ministry of Electronics and Information Technology.In view of this, they were compelled to approach the Court with the present PIL..The PIL sought the following reliefs:declaration that terms & services and privacy policy of Truecaller was opposed to public policy.direction to Truecaller to delete and clear all personal data of Indian citizens obtained without valid consent.directions to Central government to conduct an inquiry into the alleged practices of Truecaller and ICICI Bank in the present petition..In response to the notice issued by the Court, Truecaller issued a press statement refuting the claims in the PIL calling it a false information. .The company assured that the mobile application was compliant with data privacy laws and stand ready to comply with other data protection laws anywhere in the world. "Truecaller practices 'data minimisation' - taking only the data required for our service to work, and nothing else", they declared. .Truecaller stated that they had discontinued offering UPI payment services and had not signed up any new users on UPI since August 2019.Their statement declared that,"We would like to assure all Truecaller users that their data is safe. Truecaller does not sell or share user data. We deeply care about our users and their data, and would like to assure them that we securely handle their data and process it as per our Privacy Policy"..[Read order]