The Karnataka High Court has rejected a petition by digital payments giant PhonePe that sought to quash a police notice demanding user information related to an alleged online sports betting case. The court ruled that the company could not cite user privacy as a reason to withhold data from lawful criminal investigations.
Justice M. Nagaprasanna, delivering the verdict, highlighted the evolving nature of crime in the digital age and stressed the need for prompt and targeted investigative responses to cyber offences. “Today, conventional crimes have receded, and new-age crimes have emerged in large numbers. These new-age crimes are cyber crimes – the clandestine modern offences. Such offences demand a swift, targeted, and effective response,” the judge observed.
The case arose from a 2022 complaint by an individual who alleged that he had deposited approximately ₹6,000 via PhonePe into a sports betting website during the India vs South Africa cricket series. The complainant claimed that the website became inaccessible after his deposit, leaving him unable to withdraw the money. He subsequently lodged a police complaint alleging cheating.
In response, the police issued a notice to PhonePe under Section 91 of the then-applicable Code of Criminal Procedure (CrPC), seeking user data associated with the betting transactions. The notice also requested information on any due diligence conducted by the company while onboarding users and any suspicions of gambling-related activity.
PhonePe contested the notice, arguing that under the Payment and Settlement Systems Act, 2007, and the Bankers’ Books Evidence Act, 1891, user confidentiality could only be breached by a court order. The company maintained that it had a duty to safeguard user privacy.
However, the High Court held that these statutes do permit disclosure to statutory bodies and investigating agencies. It further referred to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2011, which require intermediaries to provide data to law enforcement within 72 hours of a valid request.
Justice Nagaprasanna ruled, “While privacy, as contended by the petitioner, should be maintained, it cannot be wielded as a shield against lawful investigation.” He further emphasised that “confidentiality must coexist with accountability” and that the notice issued to PhonePe was specific, lawful, and aimed at tracking illegal financial networks.
The court concluded, “The duty to protect data must yield where public interest and criminal investigation intersect,” and dismissed the petition.
Advocate Nitin Ramesh represented PhonePe, while Additional Government Advocate Mohammed Jaffar Shah appeared for the State.
