We don’t share GPay customer data with third parties — Google dismisses media reports

Google denies media reports that state the company told Delhi High Court it had permission to share user data with third parties.

Google Pay | Representational image | pxfuel

New Delhi: Google has denied it shares customer transaction data from its payments app Google Pay with third parties with the permission of National Payments Corporation of India (NPCI) after media reports stated the tech giant made such a disclosure to the Delhi High Court.

In a hearing Thursday, Google had submitted an affidavit in the Delhi High Court in response to a petition by advocate Abhishek Sharma that sought action against Google Pay for violating the RBI guidelines on data localisation, storage and sharing. The case has now been listed for 10 November since the Centre and the Reserve Bank of India (RBI) are yet to file their responses.

According to Google, the media reports “do not represent the complete facts” of its affidavit.

In an email statement released by Google Friday, the company said, “This is to clarify that press reports on the basis of the affidavit filed by Google before the Delhi High Court, do not represent the complete facts. We would like to put it on record that Google Pay is in full compliance with Unified Payment Interface (UPI) procedural guidelines, issued by the National Payments Corporation of India (NPCI) and the applicable laws and does not share customer transaction data with any third party outside the payments flow.”

The reports had stated that Google, in its affidavit, had contended that under UPI  procedural guidelines, apps like Google Pay were permitted to share customers transaction data with third parties and group companies “with prior permission of NPCI and PSP (payment service provider) banks”.

According to a PTI report, Google said that GPay only stores ordinary customer data, such as name, address, email ID and transaction related details, in accordance with the NPCI guidelines and not payment sensitive data like debit card number or UPI PIN. A customer’s payment sensitive data is stored only on the servers of the PSP bank.

Sharma’s petition

Advocate Sharma petitioned the court to direct Google Pay to not share transaction data with any third parties.

His petition claimed that Google was storing personal sensitive data, going against UPI guidelines of October 2019 that allows only the bank providing the payment service to store such data.

Sharma, in his plea, had asked that Google be directed to give an undertaking that it will not store data on its app in the UPI ecosystem and not share data with any third party, including its holding or parent company.

Google says its actions comply with NPCI

In court, Google denied it was accessing customer location data to earn revenue by offering targeted advertising opportunities to advertisers.

Google maintained it was in compliance with NPCI guidelines that govern all “third party application providers (TPAPs)” which includes Google Pay.

Google also reportedly claimed Sharma’s petition was not “maintainable” since Sharma had other alternative solutions available to address the issue of data privacy, such as Google Pay’s customer care feature or approaching NPCI and/or RBI, instead of the court.

Google further noted that the petition was “selectively filed” against its payments app when there are other service providers with similar access to user data.