In India, protecting data privacy becoming a nightmare for companies, startups

By Andy Mukherjee

Twitter Inc. recently took the Indian government to court over what it views as “arbitrary” and “disproportionate” directions to take down content and block accounts. Last year, Meta Platforms Inc.’s WhatsApp began legal proceedings in New Delhi against India’s new internet rules demanding traceability of chats. Such an obligation, the messaging service contends, will force it to break its promise of end-to-end encryption, posing a serious risk to journalists and political activists.

Beyond those high-profile cases, though, a bigger worry is the deteriorating operational environment for ordinary digital businesses in India. Their rapid growth is routinely applauded, but the minefields they navigate on a daily basis don’t get enough attention.

That changed last week with Razorpay, an eight-year-old Bengaluru startup that acts as a payment gateway. The firm unwittingly kicked up a storm after it became known that it had been compelled to supply customer data in a police investigation against Alt News, a fact-checking website that annoys Prime Minister Narendra Modi’s Hindu right-wing Bharatiya Janata Party no end.

On June 27, Mohammed Zubair, one of Alt News’ two co-founders, was arrested for allegedly hurting religious sentiments. The original complaint was over a tweet referencing an old Bollywood movie he sent more than four years ago. Since then, however, the Delhi Police has widened the charges to include alleged violation of a law that prohibits non-profits from accessing foreign funds without registration. Alt News received money “through Razorpay from Pakistan, Syria, Australia, Singapore, and the UAE, which all require further investigation,” a public prosecutor told the magistrate at the techie-turned-journalist’s bail hearing on July 2. Zubair’s lawyer has denied all charges.

The website of Alt News clearly states it does not accept overseas payments; besides the fact checker’s Razorpay gateway only connects to Indian payment instruments such as bank accounts, digital wallets or credit and debit cards. So the police investigation, at least based on what the prosecutor has revealed thus far, is about the overseas location of devices used for payment — which doesn’t prove that the donation itself was from foreigners. Therefore, Razorpay users are quite right to ask why the firm gave Alt News donors’ data to the police so easily, potentially leaving customers vulnerable to harassment for their political views.

The answer is simple: Razorpay didn’t have a choice. The police demanded information using the sweeping powers available to it under Section 91 of India’s criminal procedure code. So while the gateway didn’t provide a data dump of everything it had on customers — such as donors’ tax identification numbers or their physical addresses — it had to share the phone numbers, IP addresses and the payment instruments used for transactions over a certain period. Specific demands are impossible for an intermediary to turn down without risking its license.

A digital service provider faces serious consequences for not complying with a Section 91 notice. In a blog post, Delhi-based lawyer Abhinav Sekhri explains how Alibaba Group Holding Ltd.’s cloud business in the country got into serious trouble last year. Alibaba had earned less than $2,000 from hosting the website of an allegedly fraudulent enterprise. But because it hadn’t adequately responded to the data demand of the police team investigating the website, its bank account was frozen. The cloud operations were “virtually at a standstill” before Alibaba got interim relief from India’s Supreme Court on a third hearing date in November, Sekhri writes. To think that Razorpay could gave gotten itself a quick court order against the Delhi Police’s notice is wishful thinking, divorced from the reality of doing business in the country.

For companies like Razorpay, the only hope lies in a data protection law, which has already been five years in the making. It may help them build trust if service providers are required to provide color codes indicating whether a particular piece of personal data obtained by them will be given to the police on demand; or if at least a court order will be required first. Regulated businesses like finance and banking deserve a further layer of protection. In the Razorpay fiasco, the police’s Section 91 notice should ideally have been routed via the Reserve Bank of India.

The RBI has to be satisfied the data won’t be used for an unrelated purpose such as carrying out tax raids on Alt News donors. “One can’t over-emphasize the role of civil-society organizations in the country’s development,” says Ameet Datta, a tech privacy lawyer in Delhi. “The propensity of governments to do non-targeted surveillance has a chilling effect.”

It’s hard to be optimistic about any of this. No matter how stringent any Indian privacy law is on paper, the state is bound to seek a large exemption for itself on grounds of national security. Such a carve-out, according to one internet security analyst, will mean that any firm could in theory obtain sensitive data on its business rivals by getting a police inquiry started on a competitor’s customer.

Digital startups in India aren’t asking for much more than the freedom to keep their operations running, their proprietary data secure, and their reputation with customers intact. Founders have an added concern about personal safety: They shouldn’t be arrested for obstruction of justice in cases where the information that’s being asked of them is disproportional to the scope of the state’s inquiry, or irrelevant to its stated purpose.

Big Tech in India gets the headlines for occasionally standing up to the state’s overreach. However, as the Razorpay episode has underscored, the bigger vulnerability — for both India’s digital economy and its democracy — may be the plight of its smaller firms.