Time for India to blaze the trail further on UPI: Build guardrails for data privacy

UPI shares importantly much information connected the integer spending habits of consumers than accepted forms of transactions specified arsenic recognition cards. Also, UPI does not person immoderate information retention standards dissimilar accepted outgo systems which person strict standards specified arsenic Payment Card Industry Data Security Standard. Finally, the data-sharing policies of TPAPs are not publically available, limiting consciousness of the information implications of the UPI ecosystem. This concern of maximal information postulation and minimal standards is exacerbated by the fig of parties progressive successful a UPI transaction, expanding the anticipation of information leaks.

Privacy experts reason that the UPI ecosystem is capable to prolong without fees simply by virtuousness of being premised connected data-collection and data-sharing. This means that if you are not paying, you are the product. While information postulation successful UPI is not arsenic Orwellian arsenic the behavioural information postulation and monetisation by social-media firms, determination are parallels. And perhaps, lessons to beryllium learned. The existent outgo of the UPI duopoly is that the extracted information is entrenching the marketplace presumption of information affluent TPAPs. Data leveraging by TPAPs into adjacent markets whitethorn bounds contestability successful the broader fiscal products market, including security and micro loans. While concern models based connected information extraction are intelligibly a origin for concern, artificial market-share caps would not code this problem.

This treatment becomes important successful the discourse of the caller Digital Personal Data Protection (DPDP) Rules, 2025. TPAPs could autumn wrong the ambit of important information fiduciaries defined successful the draft. The draught regulations emphasise the rule of information minimisation which specifies that lone the information indispensable for fulfilling the purpose, for which consent has been obtained, indispensable beryllium collected. When applied to the UPI ecosystem, this would entail determining the slightest magnitude of accusation utilizing which UPI services tin beryllium rendered efficiently, safely and reliably. While the minimal information required tin beryllium freely shared among ecosystem participants, immoderate further postulation of idiosyncratic accusation should beryllium based connected informed, unambiguous and circumstantial consent. These pro-competitive principles of information minimisation and intent regulation tin mitigate harms of information accumulation by ample firms.

It is important to enactment that Rule 5(1) of the Draft DPDP Rules 2025 permits the authorities and its instrumentalities to process idiosyncratic information of a information main for the proviso oregon issuance of subsidies, benefits, services, etc. UPI would apt autumn wrong the scope of the exemption to authorities instrumentalities. However, specified exemption should beryllium constricted to the halfway infrastructure operated by NPCI. TPAPs, who are backstage operators riding connected the rails of the DPI, request not beryllium fixed specified exemptions. If the Draft DPDP Rules 2025 are enacted and applied successful a considered mode to the UPI ecosystem, it has the imaginable to make a precocious grade of transparency and extortion of idiosyncratic data, which tin support and turn nationalist spot successful UPI and code the contention issue.

The associated communiqué by the G20 Troika (India, Brazil and South Africa) connected DPI, AI and information for governance besides calls for reducing asymmetries successful integer economy, emphasises constitution of equitable principles for information governance to guarantee privateness and security. Perhaps it is clip for India to blaze the way further successful fiscal DPI and consolidate its presumption astatine the vanguard of innovation successful fiscal inclusion by implementing these information governance principles.

Malik is visiting professor, ICRIER Prosus Centre and Jagadeesh is chap (consultant), ICRIER