Google India Digital Services Pvt. Ltd., which operates the GPay app, has told the Delhi High Court that it is allowed to share customers transaction data with third parties with the prior permission of NPCI and payment service provider (PSP) banks.
The submission has been made by Google in its affidavit filed before a Bench of Chief Justice DN Patel and Justice Prateek Jalan in response to a PIL seeking action against ‘Google Pay’ (GPay) for allegedly violating the RBI’s guidelines related to data localisation, storage and sharing.
The High Court on September 24 listed the matter for hearing on November 10 as the Centre and Reserve Bank of India (RBI) have not filed their responses yet.
Google, in its affidavit, has contended that under the Unified Payment Interface (UPI) procedural guidelines, issued by the National Payments Corporation of India (NPCI), apps like GPay are permitted to share customers transaction data with third parties and group companies with prior permission of NPCI and PSP banks.
It has also said that GPay only stores ordinary customer data — like name, address, email ID and transaction related details — in accordance with the NPCI guidelines and not payment sensitive data like debit card number or UPI PIN.
A customer’s payment sensitive data is stored only on the servers of the PSP bank, it has claimed.
The affidavit was filed in response to the petition by advocate Abhishek Sharma who has sought a direction to Google not to share any data from UPI switch with any other party.