Indian authorities are concerned that WhatsApp’s payment service might share user data with group companies Facebook and Instagram, compromising the security, privacy and non-commercial information of its subscribers.
The government has asked the National Payments Corporation of India (NPCI) to look into the matter and ensure that user data collected through payment services such as WhatsApp and Google Pay is not shared, top officials said. NPCI is the agency that operates retail payment and settlement systems in India.
WhatsApp’s proposed payment service is based on Unified Payments Interface (UPI), a system that enables real-time transfer of funds between bank accounts. “WhatsApp so far has said that Facebook and its non-WhatsApp subsidiaries do not use WhatsApp UPI transaction data for any commercial purposes,” one official said.
However, WhatsApp’s cloud service provider is Facebook, its parent company, the official said, adding that when the country is debating the Personal Data Protection Bill, it was important that even “non-commercial information” or information about a user collected on the WhatsApp payment platform must not be shared with Facebook or its other subsidiaries.
The popular chat app plans to roll out its payment service in India by the year end, said Will Cathcart, WhatsApp’s new global head who is currently on his maiden visit to the country.
Bill to Protect Personal Data
He is meeting officials in the Prime Minister’s Office and telecom and IT minister Ravi Shankar Prasad this week, where the privacy concerns are being raised, the officials said. WhatsApp said in October it had developed a system to store payment-related data in India to comply with policy. While the Reserve Bank of India and NPCI have mandated local storage of commercial data, India is also looking to protect and secure personal data through the PDP Bill, which will shortly be introduced in Parliament.
Data on the use of the payment service for online purchases may automatically go to Facebook and even Instagram without the user knowing about it, another official said. If the two companies keep using the data collected by WhatsApp payment, that is a violation of the individual’s privacy and must not be allowed, the official said.
India is WhatsApp’s largest market, with estimates of users ranging from 200 million to 400 million. Its payment service would pit it against Paytm, PhonePe and Google Pay in a market that grew 51% to 31.34 billion digital transactions in FY19 and is expected to touch 40 billion by FY20 end.
Company officials said WhatsApp expects its user base to surge after starting the payment service. “WhatsApp is already ubiquitous in India and payments will just be a default option on the app, unlike other apps which people will have to download separately,” they said.
“We built payments based on the UPI standard, partnered with banks here in India… We believe that if we did this right, it will accelerate financial inclusion and bring more people in India’s fastgrowing digital economy,” Cathcart said on Thursday.
However, he did not clarify whether the company had received the go-ahead from the regulator and policymakers to start the service.
WhatsApp officials told ET on condition of anonymity that the social media platform had asked its support partners to be on ‘high alert’ for the past one month, indicating an “anytime launch.”
In a response to ET’s queries, WhatsApp said there is no timeline that can be shared and that an audit is under way. The messaging app needs a third-party auditor to validate that all its data involving payments will be stored only on Indian servers.
WhatsApp began testing the payment service in India more than a year ago and has since been awaiting regulatory approvals. Its payment service blueprint in India has been caught in a bind over concerns related to authentication and data storage practices. In the past, local rivals have alleged that WhatsApp’s payment platform has security risks for consumers and is not in compliance with the guidelines.
