Think tank CASC seeks rollback of WhatsApp Pay pilot

Think tank CASC seeks rollback of WhatsApp Pay pilot
Photo Credit: Reuters
11 Feb, 2020

In an interim application filed with the Supreme Court on Monday, Delhi headquartered think tank Centre for Accountability and Systemic Change (CASC) has asked for the roll-back of WhatsApp Pay. The digital payment platform has been limited to a user base of one million in India since its launch in 2018 due to non-compliance with payments data localisation norms set down by the  Reserve Bank of India (RBI) in April 2018.

The interim application was filed days after media reports said Facebook owned WhatsApp had received a go-ahead from regulators including RBI and National Payments Corporation of India (NPCI) for a full scale launch as it met all compliance requirements.

CASC said that according to RBI, WhatsApp Pay was non-compliant with the data localisation requirements as on November 2019.

In its affidavit submitted in November 2019, reviewing the third party auditor reports on compliance submitted by WhatsApp, RBI had stated that the company was required to ensure that payments system data elements including transaction ID and other particulars are not stored outside of India beyond the timelines specified by RBI, according to a copy reviewed by TechCircle. It also asks NPCI to ensure that WhatsApp does not store payment data in any encrypted or hashed format outside India.

Referrring to the Pegasus spyware attack to break encryption on WhatsApp messages of a group of individuals which was made public in October 2019, the application says that “..Facebook, WhatsApp and Instagram, which all are Facebook group companies are integrating their data, thus rendering the entire user data, irrespective of the service, at risk.” 

CASC has also asked to make public all correspondence between WhatsApp, RBI and NPCI, according to the application reviewed by TechCircle.

In January last year, CASC had filed a writ petition with the apex court stating that WhatsApp Pay was running its pilot in contravention to the payment data localisation requirements which gave all payment service providers time till October 15, 2018 to comply.