Row over Alt News donor data: Personally identifiable info of donors not shared by Razorpay, say sources

“The police sought transaction data pertaining to a certain time period of a couple of months and not donor data specifically,” one person said. “The details sought were on source and destination of transactions to ascertain where the donations were from to confirm that there was no FCRA violation. PII (personally identifiable information) data of donors like bank accounts, PAN and addresses were not sought.”

The people said source and destination data in transactions can be sought by the authorities to check for money laundering and violations of the FCRA, and payment platforms such as Razorpay are required to share such information.

Moneycontrol reached out to Alt News as well as Razorpay for comment. While Razorpay said it did not have anything to add at this point, a response was not received from Alt News at the time of publishing. If they respond, this story will be updated. 

The information was shared after receiving a notice under Section 91 of the Code of Criminal Procedure (CrPC), Bengaluru-based Razorpay said in a statement on July 5. Under this section, any court or any officer in charge of a police station can seek data deemed important for an investigation. Seeking such information does not require a court order. 

Questions over sharing data

Technology and criminal lawyers told Moneycontrol that unless the ambit of the information sought is too wide, companies usually have to comply with such requests. While they have the option of challenging the request, proceedings can be initiated against them, too.

One lawyer said it’s a question of whether this is sound legal strategy because noncompliance can invite criminal action.

“You can challenge it before a high court, but any step like that is a risky legal step,” the lawyer said.

Another lawyer said notices issued under Section 91 are fairly common and are issued regularly to banks and payment providers.

“The information has to be necessary for the purpose of an investigation. Courts have held that it can’t be completely unrelated,” the lawyer said. “There has to be some nexus to the investigation. That information has to be within the power of the recipient. But assuming they have it, then there has to be a link to the investigation. That’s the limited test under law. Generally, leeway is given to police authorities because the court does not want to impede an investigation.”

He added that such requests are usually complied with and if a request is narrow enough – assuming it is investigating an offence – the courts generally allow it.

The first lawyer pointed out that the police has wide powers under Section 91 to go after Razorpay and it is not uncommon in cases involving financial transactions. Citing other instances, he said company bank accounts may also be frozen if they resist or oppose providing the data sought.

Donor funding

Alt News operates under the Pravda Media Foundation, a not-for-profit company and is funded primarily by donations that are eligible for tax exemption under Section 80G of the Income Tax Act. Donors must state whether they are Indian citizens and provide their names, email addresses and phone numbers.

Donors seeking tax exemption have to submit their PAN and physical address as well. This information is available with Alt News and Razorpay, according to their disclosures.

Questions of privacy violations due to the data being shared have been raised and it is important to point out that India does not have a data protection law. One of the lawyers said there is no law that requires a company such as Razorpay to store only minimal data.

Under Reserve Bank of India norms, payment system operators such as Razorpay are allowed to store customer data like name, mobile number, email, Aadhaar and PAN, as applicable. Payment aggregators can also store payment credentials and transaction data including origin and destination, system information, transaction reference, timestamp and amount.

Why Razorpay shared data

The issue regarding transaction data – particularly origin and destination information – came to the fore after the Delhi Police claimed Pravda Media received donations from Pakistan and Syria, among others.

Pravda Media does not have an FCRA licence that is required to get donations from other countries. It can get donations from Indian citizens with Indian bank accounts.

Following Zubair’s arrest,  Alt News tweeted a statement on July 4 after donations didn’t go through, stating that its payments provider Razorpay had disabled its account. The account was later enabled.

Razorpay issued a clarification that day stating that the account had been deactivated as a safety precaution.

“Following clarity on the issue, we have unblocked and reactivated the account. We have extended our full cooperation to the authorities in the investigation and will continue to do so, as needed,” it said.

Alt News said on July 5 that it did not know what clarity Razorpay received to reactivate its account.

“However, if Razorpay had indeed found that we had violated their terms of services, they wouldn’t have re-enabled our account,” it said, adding that data was handed over without informing them. Alt News added it will continue with Razorpay as its donation platform for now.

“Our donation form asks for information such as email address, phone number, PAN card number, address. We still need to collect this information from our donors, as this is based on various Government regulations,” Alt News said in the statement.