WhatsApp claims Facebook doesn’t have access to UPI transactions data; privacy concerns remain

Facebook-owned WhatsApp put out a statement on a company blog post which said that Facebook has no access to the Unified Payments Interface or UPI transaction data of WhatsApp Pay and that the “data is encrypted and Facebook doesn't have access to this data in clear format”.

Now this raises more questions than the post tried to answer. On top is the question: Who is policing the encryption key? Since this is a parent-child status, the blog post also raises questions of propriety as to why WhatsApp should even be sharing encrypted data of UPI transactions of WhatsApp Pay with Facebook. 

For long, it was said that ultimately Facebook will look to integrate WhatsApp and Instagram and a scenario which had raised red flags around data privacy issues. Seems the worry continues. 

Late on Thursday, Entrackr had reached out to WhatsApp, seeking clarity on what ‘clear format’ means and also on the larger issue of a conflict of interest. While the company PR team directed us towards its FAQs section immediately after our queries, there has been no meaningful response yet.

That said, the blog post was the first official comment from the instant messenger over its data-sharing arrangement for its UPI-based payment feature with its parent Facebook.

“WhatsApp is committed and works diligently to ensure that UPI enabled payments are completely secure and that WhatsApp payments remains in full compliance with the data localization guidelines issued by Reserve Bank of India,” WhatsApp said in the blog post.

WhatsApp further said that it does not capture or store UPI PIN in compliance with UPI guidelines issued by NPCI. The firm also said that it does not store other customer payment sensitive information such as your one-time password (OTP), full account number, or any debit card details.

“If there is any conflict between the WhatsApp India Payments Privacy Policy and the WhatsApp Privacy Policy, the WhatsApp India Payments Privacy Policy will control solely with respect to your use of UPI Payments,” the blog post added. 

The company’s latest statement on the sharing of UPI data with Facebook has now added to the confusion and raises serious data privacy concerns. 

WhatsApp's clarification on UPI data follows the recent policy update by the company that allows it to share data such as location and phone number with Facebook and other group companies with a deadline first set for February 8 for users to accept the new terms. However, the company extended the deadline to May 15, 2021 after a huge backlash in India, forcing the company to even issue full-page ads in newspapers clarifying their stand. 

With over 450 million monthly active users or MAU in India, WhatsApp received NPCI’s nod to roll out its payments feature for more users in India in early November. It took more than two and a half years for WhatsApp to launch its full-fledged peer-to-peer (P2P) money transfer feature after the pilot in early 2018.

According to NPCI data, WhatsApp had recorded 0.81 million transactions worth Rs 29.72 crore in December and 0.31 million transactions worth Rs 13.87 crore in the previous month.