Data Privacy vs. Criminal Investigation: Judicial Balancing in the Digital Payments Ecosystem

 

By Abhishek Jat, Advocate

Factual Background

The case originated from a complaint regarding alleged financial fraud through online betting platforms, wherein the complainant claimed to have lost money via transactions conducted on multiple betting websites using PhonePe as a payment gateway. The police, investigating offences under the Information Technology Act, 2000 (Sections 66C and 66D) and the Indian Penal Code (Sections 419 and 420), issued a notice under Section 91 of the Code of Criminal Procedure, 1973 (CrPC) to PhonePe, seeking detailed information about certain merchants and users suspected of facilitating illegal betting transactions.

PhonePe, a prominent digital payments intermediary, challenged this notice, asserting that as a system provider regulated under the Payment and Settlement Systems Act, 2007 and the Bankers’ Books Evidence Act, 1891, it was bound to maintain the confidentiality of user and merchant data. The company contended that such information could only be disclosed upon a specific judicial order and not merely at the behest of an investigating officer.

Arguments Presented

Petitioner (PhonePe Private Limited)

• Intermediary Status: PhonePe argued it functions solely as an intermediary under Section 79 of the Information Technology Act, 2000, and does not have direct involvement in individual transactions.
• Confidentiality Obligations: The company emphasized its statutory duty to protect sensitive customer data under the Payment and Settlement Systems Act, 2007 and the Bankers’ Books Evidence Act, 1891. It maintained that these laws restrict disclosure of information except through a court order.
• Procedural Safeguards: The petitioner asserted that Section 91(3) CrPC itself carves out exceptions for records protected by special statutes, thus limiting the scope of police powers to summon such data directly.
• Risk of Precedent: PhonePe warned that complying with broad investigatory demands could undermine customer trust and the integrity of digital payment systems.

Respondents (State of Karnataka & Police)

• Investigative Necessity: The State argued that the police, as statutory authorities, are empowered under Section 91 CrPC to requisition documents and information necessary for effective investigation, especially in the context of cybercrimes.
• Public Interest Exception: It was submitted that confidentiality requirements cannot be used to shield criminal conduct or obstruct the investigation of offences involving digital financial flows.
• Regulatory Compliance: The State highlighted that the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2011, require intermediaries to provide information to law enforcement within 72 hours of a lawful request, and within 24 hours in cases involving online real money games.

Judicial Analysis and Findings

Justice M. Nagaprasanna undertook a detailed examination of the interplay between various statutes governing digital payments, data privacy, and criminal procedure:

• Scope of Section 91 CrPC: The Court clarified that Section 91 CrPC empowers both courts and police officers to summon documents or information necessary for investigation. While Section 91(3) protects certain privileged documents, it does not create a blanket exemption for intermediaries in the context of criminal investigations.
• Interplay of Special Laws: The Court analyzed the Payment and Settlement Systems Act, 2007 and the Bankers’ Books Evidence Act, 1891, concluding that these statutes do not override the lawful authority of investigating officers to seek information under Section 91 CrPC when public interest and the pursuit of justice are at stake.
• Nature of Digital Crime: The judgment recognized the evolving nature of crime in the digital era, noting that cybercrimes require prompt and targeted investigative responses. The Court observed that digital evidence can quickly dissipate, making timely disclosure by intermediaries essential.
• Limits of Privacy Shield: The Court unequivocally held that the right to privacy, though constitutionally protected, cannot be wielded as an absolute shield against lawful investigation. The duty to maintain confidentiality must coexist with the imperative of accountability, particularly when criminality is suspected.
• Specificity and Due Process: Emphasizing due process, the Court found that the notice issued to PhonePe was specific, targeted, and directly related to the investigation, rather than being a broad or speculative request.

Precedents and Case Laws Discussed

The judgment referenced several important decisions from other high courts to support the principle that confidentiality obligations do not obstruct criminal investigations:

• A. Ponnuswamy v. State (Madras High Court): The banker-customer relationship cannot be used to limit police investigations into crimes.
• Central Bank of India v. P.D. Shamdasani (Bombay High Court): The Bankers’ Books Evidence Act and the CrPC are not in conflict, and investigatory powers remain intact.
• Kattabomman Transport Corporation Ltd. v. State Bank of Travancore (Kerala High Court): Bank officers must provide records upon lawful order and cannot refuse disclosure in the context of criminal investigations.

Key Judicial Pronouncements

• The Court declared that the protection of consumer privacy cannot eclipse the lawful imperative of investigating officers to secure evidence and pursue investigations to their logical conclusion.
• The Court stated, “Confidentiality must coexist with accountability,” underscoring that privacy and transparency must be balanced in the public interest.
• The judgment reaffirmed that intermediaries, including digital payment platforms, are obligated to comply with lawful requests from investigating agencies, especially when such requests are precise and linked to ongoing criminal investigations.

Glossary of Relevant Legal Terms

• Intermediary: An entity that facilitates digital or electronic transactions between parties, without direct involvement in the underlying transaction.
• Section 91 CrPC: A legal provision empowering courts and police officers to summon documents or other evidence necessary for investigation or trial.
• Bankers’ Books Evidence Act, 1891: Legislation governing the admissibility and confidentiality of bank records as evidence.
• Payment and Settlement Systems Act, 2007: A statute regulating payment systems in India, including confidentiality and compliance obligations.
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2011: Regulatory framework mandating intermediaries to provide information to law enforcement within stipulated timelines.

Case Title and Citation

PhonePe Private Limited v. State of Karnataka & Anr., Writ Petition No. 3757 of 2023 (GM - Police), Karnataka High Court, Judgment dated 29 April 2025

Bench: Hon’ble Mr. Justice M. Nagaprasanna

Conclusion and Implications

This judgment marks a pivotal development in Indian data privacy and fintech law, establishing that the demands of criminal investigation and public interest can, in appropriate circumstances, override the confidentiality obligations of digital intermediaries. The Karnataka High Court’s decision underscores the need for a pragmatic balance between privacy and accountability, particularly in the context of complex and rapidly evolving cybercrimes. Intermediaries must recognize their role in supporting lawful investigations, provided that requests are specific, justified, and within the bounds of statutory authority. The ruling serves as a guiding precedent for future cases at the intersection of data privacy and law enforcement in the digital economy.

Disclaimer: This article is intended for informational and academic purposes only. It does not constitute legal advice or create an attorney-client relationship. Readers are encouraged to consult a qualified legal professional for advice regarding specific legal issues or cases. The views expressed herein are those of the author and do not represent the official position of any organization or institution.
Copyright Notice: © 2025 Abhishek Jat, Advocate. All rights reserved. No part of this article may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the author. Unauthorized use or reproduction of this material is strictly prohibited and may result in legal action.