The Reserve Bank of India (RBI), in a letter dated November 01, 2019, to the National Payments Corporation of India (NPCI) has directed NPCI to ensure that Whatsapp Pay, the payment services leg of the messaging application Whatsapp ("Whatsapp"), is compliant with the data localization norms laid down in the RBI notification dated April 06, 2018 ("RBI Notification").
Contents of the Letter
The RBI has stated in the letter that the NPCI has to ensure that Whatsapp Pay complies with the requirements of the RBI Notification, prior to it being officially launched in India.
As per the RBI Notification, all payment system providers authorized by the RBI to set up and operate a payment system in India under Section 7 of the Payment and Settlement Systems Act, 2007, are required to ensure that the entire data relating to payment systems operated by them is only stored in a system located in India. This data should include end-to-end transaction details and information collected and processed. However, in case of cross-border transactions consisting of a foreign component and a domestic component, a copy of the domestic component may also be stored on a system outside India.
The RBI has issued this letter in furtherance of its role as a respondent to a petition filed by the Centre for Accountability and Systemic Change before the Supreme Court of India (SC) ("Petition").
Whatsapp Pay is currently in a beta testing mode, and the future plan of action is to allow Indian Whatsapp users to send and receive payments by employing the Unified Payments Interface (UPI) developed by the NPCI, akin to other services such as PhonePe and Google Pay.
Case before the Supreme Court
The Petition was filed by the CASC, an activist organization, before the SC against Whatsapp Inc., citing concerns regarding non-compliance of the RBI Notification and failure to appoint a grievance officer mandated by Rule 5(9) of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, upon entities acting as "intermediaries" (defined in Section 2(1)(w) of the Information and Technology Act, 2000).
The debate for data storage and localization has increasingly become significant in the era of fast development in technology, especially through artificial intelligence that needs data to provide better services to the consumers. The debate around data localization presently is whether the data garnered through Indian consumers should be stored and processed on servers present only in India, or whether it can be done on a global level through mirroring; wherein the data is processed on other servers across the globe, but is stored only in the Indian territory, the latter being the mandate set by RBI for payment specific data.
The draft Personal Data Protection Bill, 2018, which was prepared by the Justice Srikrishna Committee, proposes that a copy of personal data collected from Indian consumers must be stored in India and data notified as 'critical personal data' has to be mandatorily stored online in the Indian jurisdiction. However, the present government has been reported to be in the process of tweaking the Bill in an attempt to water down the data localization norms inherent in the same. The proposed change entails allowing personal data that is not notified as being 'critical' to be stored and/or processed anywhere in the world, while that identified as being critical will continue to be stored only in India.
Data localization has become significant for the following reasons; the first is internal security, where law enforcement agencies use personal data to conduct their investigations for the interests of national security, but this may be difficult in most cases since the plethora of social media and e-commerce companies are situated abroad, and therefore have to comply with the privacy laws of that jurisdiction before letting the law enforcement agencies have access to such personal data. The second concern being the boost given to the local economy by allowing data to be stored on Indian servers, and the consequential benefit to the Indian service providers.
To sum up, the controversy surrounding data and Whatsapp, the debate on data localization is here to stay. The claim that data localization benefits the local economy seems unfruitful, though it will benefit the development of digital infrastructure and incentivize investments in the sector. Taking this into account, the allied services needed for the development of data centers seem to be lacking in most parts of the country, such as constraints on electrical supply and access to other resources for the smooth running of data centers. The impact of this upon employment also seems vague at best, because these centers may not lead to significant changes in employment opportunities.
15 November, 2019
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.