The Delhi High Court has recently dismissed two public interest litigation (PIL) petitions that sought to halt the operations of Google Pay in India, alleging violations of regulatory and privacy norms.
A bench comprising of Chief Justice Satish Chandra Sharma and Justice Subramonium Prasad observed that Google Pay functions as a third-party app provider and, as such, does not require authorization from the Reserve Bank of India (RBI) under the Payment and Settlement Systems Act (PSS Act).
The division bench emphasized that Google Pay does not function as a system provider under the PSS Act.
“It can be safely gathered that NPCI [National Payments Corporation of India] is the operator of the UPI system for transactions in India and is a ‘system provider’ which is authorized by the RBI under the PSS Act to extend its services for facilitating transactions. The transactions conducted through UPI using Google Pay are solely peer-to-peer or peer-to-merchant transactions. Google Pay is not classified as a system provider under the PSS Act, 2007,” the bench stated.
Additionally, the bench rejected the argument that Google Pay improperly accesses and accumulates sensitive and private user data. The Court cited the UPI Guidelines, 2019, which categorize data into ‘customer data’ and ‘customer payments sensitive data’. The former can be stored with the app provider in encrypted form, while the latter can only be stored within the bank systems of payment services providers. This provision aligns with Google Pay’s chosen multi-model API approach.
The order was delivered in response to a petition filed by advocate Abhijit Mishra. The petitioner contended that Google Pay’s operations in India as a payment system provider were unauthorized due to the absence of requisite permissions. He argued that the storage of sensitive data belonging to Indian citizens by Google Pay would amount to violations of the Aadhaar Act, 2016, as well as the PSS Act.
