A division bench of Chief Justice Satish Chandra Sharma and Justice Subramonium Prasad noted that Google Pay is a mere third-party app provider for which no authorisation is required from the Reserve Bank of India (RBI) under the Payment and Settlement Systems Act (PSS Act).
The Court further said that Google Pay is not a system provider under the PSS Act.
“It can be safely gathered that NPCI [National Payments Corporation of India] is the operator of the UPI system for transactions in India and is a “system provider” which is authorized by the RBI under the PSS Act to extend its services for facilitating transactions and the transactions carried out via UPI through Google Pay are only peer-to-peer or peer-to-merchant transactions and is not a system provider under the PSS Act, 2007,” the Court explained.
The bench also rejected the contention that Google Pay is actively accessing and collecting sensitive and private user data.
“The UPI Guidelines, 2019 also make it exceedingly clear that data may be stored under two types, namely, ‘customer data’ and ‘customer payments sensitive data’. While the former may be stored with the app provider in an encrypted format, the latter can only be stored with the payment services providers bank systems, and not with the third party app under the multi model API approach that Google Pay has opted for,” the Court said.
The order was passed on a plea by advocate Abhijit Mishra who moved the the High Court arguing that operations of Google Pay in India as a payment system provider were unauthorized for want of obtaining necessary permissions.
Hence, Google Pay storing sensitive information of Indian citizens would tantamount to violations under the Aadhaar Act, 2016 as well as the PSS Act, he contended.
Source: Barandbench
